# US 2026/0100906 A1 · Connectivity between logical router pods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0100906 A1 - Document ID: US20260100906A1 - Status: Published application - Kind: A1 - Application number: 19/405,707 - Filed: 2025-12-02 - Published: 2026-04-09 - Earliest claimed: 2023-07-24 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Yu Ying; Yong Wang; Pankaj Gupta; Sreeram Kumar Ravinoothala - Web page: https://patentgrep.com/patent/US20260100906A1 ## CPC - H04L 45/76: Routing in software-defined topologies, e.g. routing between virtual machines - H04L 45/0377: for service chaining - H04L 45/586: of virtual routers - H04L 47/125: by balancing the load, e.g. traffic engineering - H04L 49/70: {Virtual switches} - H04L 49/354: for supporting virtual local area networks [VLAN] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments provide a method for implementing a logical router of a logical network at a first Pod executing on a first node of a Kubernetes cluster to implement data message forwarding for the logical router. The method receives a data message for processing by the logical router. The method determines that the data message requires layer 7 (L7) service processing at the logical router. The method selects a second Pod from multiple Pods that perform L7 service for the logical router. Each of the Pods executes on a different node of the cluster. The method forwards the data message to the second Pod via a layer 2 (L2) construct that connects the first and second Pods. ## Claims ### Claim 1 A method comprising: executing, at a first pod of a cluster to implement data message forwarding for a logical router: determining a need for a second pod for a layer 7 (L7) service for the logical router; generating Pod definition data for the second pod; calling a server to create the second pod based on the pod definition data; retrieving datapath interface attributes from a configuration database; and passing the datapath interface attributes to the second rod to configure data plane connectivity between the first pod and the second pod. ### Claim 2 (depends on 1) The method of claim 1, wherein the datapath interface attributes comprise a MAC address, a VLAN ID, and an IP address for a second interface of the second pod. ### Claim 3 (depends on 1) The method of claim 1, wherein the pod definition data comprises a container image specification corresponding to the L7 service to be performed by the second pod. ### Claim 4 (depends on 3) The method of claim 3, wherein the pod definition data comprises allocated memory and processor specifications for the second pod. ### Claim 5 (depends on 1) The method of claim 1, further comprising determining whether the second pod implements a security service. ### Claim 6 (depends on 5) The method of claim 5, further comprising: retrieving security keys in response to determining that the second pod implements the security service; and providing the security keys to the second pod using a Kubernetes secret scheme. ### Claim 7 (depends on 1) The method of claim 1, wherein determining the need for the second pod comprises detecting that configuration data for a new L7 service has been stored in the configuration database. ### Claim 8 (depends on 1) The method of claim 1, wherein the first pod executes a pod configuration agent configured to perform the determining, generating, calling, retrieving, and passing operations. ### Claim 9 (depends on 8) The method of claim 8, wherein the pod configuration agent communicates with a Kubernetes scheduler to assign the second pod to a node of the cluster. ### Claim 10 A system comprising: a cluster comprising a plurality of nodes; a first pod executing on a first node of the cluster, the first pod configured to implement data message forwarding for a logical router, the first pod comprising: a configuration database; a datapath; and a pod configuration agent configured to: determine a need for a second pod for a layer 7 (L7) service for the logical router; generate pod definition data for the second pod; call a server to create the second pod based on the pod definition data; retrieve datapath interface attributes from the configuration database; and pass the datapath interface attributes to the second pod to configure data plane connectivity between the first pod and the second pod. ### Claim 11 (depends on 10) The system of claim 10, wherein the pod definition data comprises a container image specification corresponding to the L7 service to be performed by the second pod. ### Claim 12 (depends on 10) The system of claim 10, wherein the pod configuration agent is configured to determine whether the second pod implements a security service. ### Claim 13 (depends on 10) The system of claim 10, wherein the pod configuration agent is configured to determine the need for the second pod by detecting that configuration data for a new L7 service has been stored in the configuration database. ### Claim 14 (depends on 10) The system of claim 10, wherein the pod configuration agent is configured to communicate with a Kubernetes scheduler to assign the second pod to a node of the cluster. ### Claim 15 A non-transitory computer-readable medium storing instructions that, when executed by a processor of a first pod of a cluster, cause the first pod to: determine a need for a second pod for a layer 7 (L7) service for a logical router; generate pod definition data for the second pod; call a server to create the second pod based on the pod definition data; retrieve datapath interface attributes from a configuration database; and pass the datapath interface attributes to the second pod to configure data plane connectivity between the first pod and the second pod. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the pod definition data comprises a container image specification corresponding to the L7 service to be performed by the second pod and allocated memory and processor specifications for the second pod. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the instructions cause the first pod to: determine whether the second pod implements a security service; retrieve security keys in response to determining that the second pod implements the security service; and provide the security keys to the second pod using a Kubernetes secret scheme. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the instructions cause the first pod to determine the need for the second pod by detecting that configuration data for a new L7 service has been stored in the configuration database. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the first pod further comprises a network management system agent configured to configure a datapath of the first pod with the datapath interface attributes to enable the datapath to send data messages to the second pod. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the instructions further cause the first pod to receive configuration data for the logical router from a central control plane of a network management system, the configuration data stored in the configuration database.