Abstract: Techniques for authenticating user access to a resource and providing access to the resource include non-transitory computer-readable media storing program instructions that, when executed by one or more processors associated with a first computing device, cause the one or more processors to perform a method including receiving, from a client device, a first request for an authentication token to access a resource and identifying a second computing device through which the resource is accessible. The method further includes transmitting a second request to the second computing device for the authentication token, receiving a signed authentication token from the second computing device, wherein the authentication token is signed by the second computing device and specific to the client device, and providing the signed authentication token to the client device.

Abstract: Techniques for pre-processing metadata for faster background decisions include, in response to a metadata entry associated with storage of data in a cluster being modified, generating a summary entry corresponding to the metadata entry. The summary entry includes a subset of the information from the metadata entry. A data management action is performed based upon a scanning process that reads a plurality of summary entries corresponding to a plurality of metadata entries for data in the cluster.

Abstract: In some embodiments, a method for tuning a disaster recovery preparation system for a storage system includes determining whether the disaster recovery preparation system has not met a recovery point objective; and in response to determining that the recovery point objective is not met: determining a state of the storage system; applying a machine learning model to determine a change to one or more of a plurality of adjustable parameters of the disaster recovery preparation system based on the state of the storage system and the recovery point objective that is not met; adjusting the one or more of the plurality of adjustable parameters based on the determined change to the one or more parameters; after adjusting the one or more parameters, monitoring one or more metrics of the disaster recovery preparation system or the storage system; and updating the machine learning model based on the monitoring.

Abstract: A database management system receives a user request for provisioning a database, autonomously selects a datacenter for provisioning the database based at least on a first pre-defined rule, autonomously selects at least one cluster in the datacenter based at least on a second pre-defined rule, determines a network location of each of the at least one cluster, and provisions the database on each of the at least one cluster using the network location of each of the at least one cluster.

Abstract: An improved flushing technique controls a draining speed of data from a temporary storage tier to a backend storage tier of a node so that draining logic does not overwhelm an input/output (I/O) workload that is serviced by the storage tiers. Illustratively, the temporary storage tier is a persistent write buffer embodied as an operations log (oplog) and the backend storage tier is persistent physical disk storage embodied as an extent store. The technique improves an oplog flushing algorithm by enabling control of the oplog draining speed (rate) to provide consistent performance when the I/O workload (e.g., a primary ingest I/O stream) is serviced by the extent store and/or oplog during one or more states (e.g., static inertia state, idle state and rebuild state) of the oplog.

Abstract: Placement scenario optimization mechanisms for automatic placement of computing entities onto nodes of a running multi-node computing cluster. A set of failure mode parameters define a high-availability requirement of the multi-node computing cluster. In advance of a failure event, and responsive to a determination that a then-current computing entity placement does not satisfy the high-availability requirement, the cluster is analyzed and a plurality of feasible placement scenarios are generated. Optimization criteria are applied to the feasible placement scenarios such that a best choice from among the feasible placement scenarios is identified and applied to the virtual machine placements over the cluster. A change monitoring and detection facility continually observes the multi-node computing cluster to detect a change of a failure mode parameter or to detect a change to the configuration of the virtual machines.

Abstract: Methods, systems, and computer program products for thwarting a malware attack. A data storage system stores data items, some of which data items correspond to snapshots. Upon identification of a possible ransomware attack on a data item, the system identifies a version of the snapshot that is not subject to the ransomware attack and seeks to protect the data state of the system from further damage (e.g., due to performance of unauthorized operations on the version of the snapshot that is not subject to the ransomware attack) by requiring consensus from a multi-party authorization (MPA) consensus regime before carrying out requested operations over the snapshot. The MPA consensus regime operates by determining that the operation is subject to a role-based access control (RBAC) as well as a multi-party authorization (MPA) consensus protocol, and then allowing or denying execution of the requested operations based on achieving consensus from among candidate approvers.

Abstract: A method may include, based on a recovery policy associated with the primary database, creating a first snapshot of the primary database at a primary computing system, replicating the first snapshot of the primary database to a secondary computing system, wherein a backup database of the primary database is hosted on the secondary cluster, in response to the primary database being unavailable, applying the first snapshot of the primary database to the backup database, creating, according to the recovery policy associated with the primary database, a snapshot of the backup database, in response to the primary database having restored availability, creating, according to the recovery policy associated with the primary database, a second snapshot of the primary database.

Abstract: Various embodiments set forth one or more non-transitory computer-readable media storing program instructions that, when executed by one or more processors, cause the one or more processors to perform steps of determining at least one physical resource of a node in a cluster of nodes is under contention by virtual computing instances or a virtual computing instance cannot be placed on the cluster of nodes, determining a placement for one or more virtual computing instances on the cluster of nodes, each virtual computing instance having a virtual resource associated with a profile that is compatible with a profile associated with a physical resource of a node on which the virtual computing instance is placed, and generating and executing a plan to achieve the placement, the plan including at least one of migrating at least one virtual computing instance or reconfiguring a profile associated with at least one physical resource.

Abstract: Methods, systems, and computer program products for moving a container-based application from a source HCI cluster to a target HCI cluster. An HCI storage cluster data replication mechanism operates to copy data and metadata from a plurality of storage devices that constitute a storage pool of the source HCI cluster. A container-based application replication mechanism operates to copy data and metadata from an executable container that is running on a node of the source HCI cluster. Periodically (1) the state of the container-based application is saved using the container-based application replication mechanism, and (2) the state of the storage cluster data of the HCI storage cluster is saved using the HCI storage cluster data replication mechanism. The saved state of the container-based application including its application data and metadata are combined with the saved state of the storage cluster data to bring-up the container-based application at the target HCI cluster.

Abstract: Systems and methods for scalable tracking of objects to be replicated are disclosed. A method may include in a first time period, updating, by one or more processors, a data structure with metadata of a received object to be replicated, wherein the data structure includes a plurality of classifications of objects to be replicated based on when the objects were received, in a second time period, after the first time period, updating, by the one or more processors, the data structure to modify a classification of the object based on the object being received in the first time period, and replicating, by the one or more processors, the object based on the modified classification of the object.

Abstract: A system may include a memory having computer-readable instructions stored thereon and a processor of a control plane that executes the computer-readable instructions to receive a request from a tenant to update a portion of a database, determine an individual tenant identifier of the tenant, determine whether the portion of the database is associated with the individual tenant identifier or a global tenant identifier, and allow the tenant to update the portion of the database in response to determining that the portion of the database is associated with the global tenant identifier or the individual tenant identifier or restrict the tenant from updating the portion of the database in response to determining that the portion of the database is associated with neither the global tenant identifier nor the individual tenant identifier.

Abstract: In one embodiment, a system for managing communication connections in a virtualization environment includes a plurality of host machines implementing a virtualization environment, wherein each of the host machines includes a hypervisor, at least one user virtual machine (user VM), and a distributed file server that includes file server virtual machines (FSVMs) and associated local storage devices. Each FSVM and associated local storage device are local to a corresponding one of the host machines, and the FSVMs conduct I/O transactions with their associated local storage devices based on I/O requests received from the user VMs. Each of the user VMs on each host machine sends each of its representative I/O requests to an FSVM that is selected by one or more of the FSVMs for each I/O request based on a lookup table that maps a storage item referenced by the I/O request to the selected one of the FSVMs.

Abstract: A database management system receives a user request for provisioning a database, autonomously selects a datacenter for provisioning the database based at least on a first pre-defined rule, autonomously selects at least one cluster in the datacenter based at least on a second pre-defined rule, determines a network location of each of the at least one cluster, and provisions the database on each of the at least one cluster using the network location of each of the at least one cluster.

Abstract: A system and method include creating, by an Availability Group (“AG”) controller in a virtual computing system, a first AG clone from a source database. The source database is stored on a primary replica node of an AG of the virtual computing system. The system and method also include creating, by the Controller, a second AG clone from the first AG clone and storing, by the Controller, the second AG clone on a secondary replica node of the AG. The second AG clone has a size of substantially zero.

Abstract: Examples described herein are generally directed towards file server access controls, and more specifically towards a mechanism to create consistent access control lists for local users across different file servers in a distributed file server environment. In operation, a local user system SID (e.g., external SID) may be generated for a first user of a first file server. A global ID based on attributes associated with the user of the first file server may also be generated. The global ID for the user may be stored in metadata associated with an access control list (ACL) for a file accessible through the first file server. Data, including the file may be migrated to a second file server. Based on receiving an access request at the second file server associated with the user based on the external ID, the external ID for the user may be translated into the global ID, and used to determine access to the file.

Abstract: Methods, systems, and computer program products for virtualized services implemented within a containerized computing system. Multiple components are operatively interconnected to establish virtualized storage services implemented within a containerized computing system. These methods, systems, and computer program products implement flexible IP network access for storage I/O service handlers in containerized systems. After configuring a storage I/O service handler as one or more executable container components for which its cloud-based logical NIC is given an initial IP address by the containerized system, then identifying one or more reserved IP addresses that are available for use in the containerized system. To assign a new IP address at runtime, in lieu of destroying all or parts of the container components and re-initiating the container components with a newly-assigned IP address, instead, assigning, at runtime, the one or more of the reserved IP addresses to the one or more container components.

Abstract: Anomaly detection includes receiving, for one or more data points of a data set, an anomaly label indicating whether the one or more data points is an anomaly; generating, using a first machine learning model, one or more hyperparameters based on the one or more data points and the anomaly label; and training a second machine learning model to determine anomalies in the data set, wherein the training is based on the one or more hyperparameters.

Abstract: Methods, systems, and computer program products for deploying virtualized storage services. Multiple components are operatively interconnected to establish virtualized storage services implemented within a containerized computing system. These methods, systems, and computer program products implement flexible IP network access for storage I/O service handlers. Deployments comprise (1) an underlay network, the underlay network being formed of one or more routers of the cloud-provided host network and the underlay network forming an isolated namespace that is distinct from namespaces of the cloud-provided host network; (2) a container-attached storage module that is situated within the underlay network, wherein container-attached storage module operates within the isolated namespace; and (3) a network interface component that facilitates network access to the container-attached storage module via a static IP address that is configured into the network interface component.

Abstract: Methods, systems and computer program products for bringing-up a computing cluster on a public cloud infrastructure. The method includes using a multicloud management system which is configured to bring-up a computing cluster on any one of a plurality of different public cloud infrastructures to bring-up the cluster in a user's account on the public cloud infrastructure, allowing the user to directly utilize tools and features of the public cloud infrastructure and/or computer security of the user's choice.