In our previous post, we explored why micro-segmentation is becoming increasingly important for securing cloud-native infrastructures, particularly in Kubernetes environments. However, while the benefits of isolating workloads into separate network domains are clear, implementing this functionality across distributed Kubernetes infrastructures introduces several technical challenges. This is where Link-Layer Secure connectivity for Microservice platforms (L2S-M) comes into play.

L2S-M is a networking solution originally developed within the NEMO project that enables the creation and management of isolated virtual link-layer networks in Kubernetes. Unlike traditional approaches based on network policies or service meshes, L2S-M introduces a programmable networking layer that operates independently of the underlying Container Networking Interface (CNI), providing additional flexibility for managing workload connectivity.

At its core, L2S-M allows Kubernetes workloads to connect to isolated virtual networks, regardless of the physical nodes where they are deployed. These networks are represented as Kubernetes resources, meaning that they can be created, managed, and consumed through standard Kubernetes mechanisms. This approach simplifies the integration of advanced networking capabilities into cloud-native environments without requiring modifications to the applications themselves.

To achieve this functionality, L2S-M relies on a programmable overlay network composed of virtual link-layer switches distributed across the Kubernetes cluster. These switches are interconnected through Virtual Extensible LAN (VXLAN) tunnels, allowing workloads running on different nodes to communicate as if they belonged to the same local network. Multiple virtual networks can coexist within the same infrastructure while remaining logically isolated from one another.

However, creating virtual networks is only part of the solution. L2S-M also incorporates Software-Defined Networking (SDN) mechanisms to control how traffic flows through the infrastructure. Through an SDN controller, forwarding rules are dynamically installed in the virtual switches, ensuring that traffic is distributed according to the virtual networks and workloads associated with them. This programmable approach also opens the door to advanced traffic engineering capabilities, such as optimising communication paths or directing traffic through specific network functions.

Beyond connectivity within a single Kubernetes cluster, L2S-M also supports the interconnection of workloads deployed across different clusters. This functionality is particularly relevant for distributed cloud-edge infrastructures, where services may be deployed across geographically separated environments or different administrative domains.

To enable inter-cluster communications, L2S-M introduces Network Edge Devices (NEDs), which act as programmable network elements connecting different Kubernetes infrastructures through VXLAN overlays. These devices are coordinated by an Inter-Domain Connectivity Orchestrator (IDCO), which extends the SDN control mechanisms to manage connectivity between clusters. Within CyberNEMO, L2S-M builds upon the networking capabilities developed in the NEMO project to provide the virtual micro-segmentation mechanisms required by the Zero Trust Network Access (ZTNA) framework. However, CyberNEMO takes these capabilities a step further by extending L2S-M to support the dynamic application of network security policies within individual micro-segments. This evolution enables more granular control over workload communications, complementing the isolation provided by virtual networks with programmable traffic restrictions. In our next post, we will explore how these new capabilities enhance L2S-M and contribute to securing communications in distributed Kubernetes environments.