Abstract: Role-based access controls (RBAC) are extended to include multi-party authorizations for certain computing cluster operations or data items. Upon receiving a request to perform an operation over a computing cluster or its data, a check is carried out to determine if the operation (e.g., READ, WRITE, EXECUTE, DELETE, etc.) is subject to both a role-based access control as well as a multi-party authorization (MPA) consensus protocol. The determination to allow or deny the request includes (1) accessing a role-based access control record corresponding to the operation or data item, and (2) invoking the multi-party authorization consensus protocol. Prior to performance of the operation, a computer program collects “approve” or “deny” responses from individual ones of the multiple parties. When approval consensus is reached, the operation is performed. If approval is denied, or if an approval consensus is not reached within a time limit, then the operation is not performed.

Abstract: Methods, systems, and computer program products for thwarting a malware attack. A data storage system stores data items, some of which data items correspond to snapshots. Upon identification of a possible ransomware attack on a data item, the system identifies a version of the snapshot that is not subject to the ransomware attack and seeks to protect the data state of the system from further damage (e.g., due to performance of unauthorized operations on the version of the snapshot that is not subject to the ransomware attack) by requiring consensus from a multi-party authorization (MPA) consensus regime before carrying out requested operations over the snapshot. The MPA consensus regime operates by determining that the operation is subject to a role-based access control (RBAC) as well as a multi-party authorization (MPA) consensus protocol, and then allowing or denying execution of the requested operations based on achieving consensus from among candidate approvers.

Abstract: A scalable multi-cluster resource sharing facility. A global witness process runs on a first computing platform that communicates over one or more networks to any number of nodes situated over two or more clusters. The global witness process listens on the network for occurrences of leadership and/or resource requests from nodes of different clusters. The global witness processes a request by retrieving a resource request and a respective last known state value, comparing the last known state value to a global stored state value, then storing a new state value when the respective last known state value is equal to the stored state value. Any number of contemporaneous requests can be processed by the global witness process, however only one request can be granted. The other requestors each receive a rejection of their resource request when their proffered last known state value is not equal to the stored state value.

Abstract: Methods, systems, and computer program products for flexible virtualization system deployment into different cloud computing environments. A set of floating licenses to virtualization system software components is established. The set of floating licenses are configured to permit usage of the virtualization system software components on different cloud computing infrastructures. Workload parameters of a workload to be deployed to one of the different cloud computing infrastructures is considered with respect to cloud attributes corresponding to the different cloud computing infrastructures. One or more candidate target cloud computing infrastructures are selected based upon a comparison between workload attributes of a computing workload and cloud attributes of the candidate target cloud computing infrastructures. Virtualization system software components are deployed into the selected target cloud computing infrastructures.

Abstract: Examples described herein include virtualized environments including a virtualized file server. Examples of file server virtual machine managers are described which may setup and/or configure file server virtual machines in accordance with a target number of connections and/or a target throughput for the virtualized file server. The virtualized file server may be scaled up, scaled down, scaled in, and/or scaled out.

Abstract: Methods, systems, and computer program products for selection of a witness during virtualization system recovery after a disaster event. A recovery plan is configured to identify a witness that is then used to elect a leader to implement the recovery. Various system, and/or network, and/or component failures and/or various loss of function of components of the virtualization system can trigger initiation of the recovery plan. Based on the particular recovery plan that is invoked upon a determination of a network outage, or component failure or loss of function of a component of the virtualization system, a particular witness corresponding to a subset of entities of the particular recovery plan is selected. The witness is used to elect the leader, and the leader initiates actions of the recovery plan. The implementation of the recovery plan includes consideration of the health of components that would potentially be involved in the recovery actions.

Abstract: A system and method include receiving, by a database engine of a database system associated with a virtual computing system, a user request via a dashboard for provisioning a source database with the database system, receiving, by the database engine via the dashboard, selection of a database engine type, and receiving, by the database engine via the dashboard, selection of a Service Level Agreement (“SLA”) and a protection schedule. The system and method also include provisioning, by the database engine, the source database based upon the database engine type, creating, by the database engine, an instance of a database protection system based upon the SLA and the protection schedule, including associating the instance of the database protection system with the source database, and displaying, by the database engine, the source database within the dashboard.

Abstract: In accordance with some aspects of the present disclosure, a non-transitory computer readable medium is disclosed. In some embodiments, the non-transitory computer readable medium includes instructions that, when executed by a processor, cause the processor to receive, from a workload hosted on a host of a cluster, first I/O traffic programmed according to a first I/O traffic protocol supported by a cluster-wide storage fabric exposed to the workload as being hosted on the same host. In some embodiments, the workload is recovered by a hypervisor hosted on the same host. In some embodiments, the non-transitory computer readable medium includes the instructions that, when executed by the processor, cause the processor to adapt the first I/O traffic to generate second I/O traffic programmed according to a second I/O traffic protocol supported by a repository external to the storage fabric and forward the second I/O traffic to the repository.

Abstract: A system may include a memory having computer-readable instructions stored thereon and a processor of a control plane that executes the computer-readable instructions to receive a request from a tenant to update a portion of a database, determine an individual tenant identifier of the tenant, determine whether the portion of the database is associated with the individual tenant identifier or a global tenant identifier, and allow the tenant to update the portion of the database in response to determining that the portion of the database is associated with the global tenant identifier or the individual tenant identifier or restrict the tenant from updating the portion of the database in response to determining that the portion of the database is associated with neither the global tenant identifier nor the individual tenant identifier.

Abstract: A database management system may include a control plane comprising a memory having computer-readable instructions stored thereon and processor that executes computer-readable instructions to execute one or more services running on the control plane, the control plane connected to a plurality of database servers, wherein each of the plurality of database servers is connected to the control plane via a communication channel, wherein the control plane comprises a plurality of data streams, each of the plurality of data streams configured to communicate messages of a designated type, and wherein the control plane is configured to communicate with a database server of the plurality of database servers using the plurality of data streams and the communication channel associated with the database server and the control plane.

Abstract: Aspects of the present disclosure are directed to a system comprising a memory having computer-readable instructions stored thereon, and a processor of a database server, the processor executing the computer-readable instructions to generate a request to a control plane for an operation to be performed on the database server, wherein the control plane is configured to communicate with a plurality of database servers having a plurality of agents running thereon, and wherein each of the plurality of agents has a dedicated communication connection with the control plane, publish the request on the dedicated communication connection associated with the agent to send the request to the control plane, receive, on the dedicated communication connection, a response from the control plane, the response comprising a response to the request from a service of the control plane, and execute the operation on the database server based on the response.

Abstract: A system may include a memory having computer-readable instructions stored thereon, and a processor of a control plane that executes the computer-readable instructions to receive from a database server, over a first connection, a request for credentials, in response to the request for credentials, generate credentials for the database server, transmit the credentials to the database server over a second connection specific to the database server, receive, over the second connection, from the database server, a request for registering the database server, the request for registering the database server comprising the credentials, in response to the request for registering the database server, register the database server with a database management system associated with the control plane.

Abstract: A system may include a memory having computer-readable instructions stored thereon, and a processor that executes the computer-readable instructions to determine a plurality of scheduled events to be executed in a time period, determine a number of buckets in the time period based on a predetermined permissible interval, generate a plurality of buckets equal to the number of buckets in the time period, wherein each of the plurality of buckets is associated with a time interval, and schedule each of the plurality of scheduled events in one of the plurality of buckets, wherein execution of each of the plurality of scheduled events is delayed or advanced from an original scheduled time based on the predetermined permissible interval.

Abstract: In a distributed cloud environment, a collecting agent deployed external to a kernel of a compute host collects network data packets describing various raw events communicated between compute instances of the environment and metadata associated with the events from various sources. The collecting agent communicates the metadata to a cloud application. The collecting agent also communicates the packets to a stream processor that is decoupled from the collecting agent. The stream processor processes the packets in a stateful manner to generate a set of time series data. The time series data is communicated to the cloud application, where a set of enhanced time series data is generated by merging the time series data with the metadata in a distributed manner. A topology map describing the compute instances of the distributed cloud environment is then generated based on the set of enhanced time series data. The topology map is then displayed.

Abstract: Various embodiments set forth techniques for cache warmup. The techniques determining, by a node, identities of one or more target storage blocks of a plurality of storage blocks managed by a storage system, where the node previously cached metadata corresponding to the one or more target storage blocks; receiving the metadata corresponding to the one or more target storage blocks; and storing the metadata corresponding to the one or more target storage blocks in a cache memory of the node.

Abstract: Methods, systems and computer program products for data protection across computing infrastructure comprising a plurality of geographically distant computing clusters. The geographically distant computing clusters form a distributed system comprising clusters that are assigned into availability zones. Disaster recovery policies are maintained in each of the availability zones. A first cluster detects a modification of a disaster recovery policy. The modification of the disaster recovery policy that occurred at the first cluster is to be communicated over a wide area network. Synchronization of the disaster recovery policy is accomplished by carrying out a peer-to-peer communication protocol over the wide area network.

Abstract: Disclosed is an improved approach to implement I/O and storage device management in a virtualization environment. According to some approaches, a Service VM is employed to control and manage any type of storage device, including directly attached storage in addition to networked and cloud storage. The Service VM implements the Storage Controller logic in the user space, and can be migrated as needed from one node to another. IP-based requests are used to send I/O request to the Service VMs. The Service VM can directly implement storage and I/O optimizations within the direct data access path, without the need for add-on products.

Abstract: A system may include a memory having computer-readable instructions stored thereon and a processor that executes the computer-readable instructions to receive, from a user, a first login credential associated with an organization on a database management service. The system may receive, from the user, a selection of the first cloud account, retrieve a second login credential for the first cloud account based on the selection, automatically log in to the first cloud account using the second login credential, receive, from the user, input to perform an operation on data in the first database on the first cloud, and transmit, to the first cloud, using the second login credential for the first cloud account, a signal to perform the operation based on the input.

Abstract: An illustrative embodiment disclosed herein is an apparatus including a processor and a memory. In some embodiments, the memory includes programmed instructions that, when executed by the processor, cause the apparatus to upload an object to a source bucket in an object store and create a lambda bucket in the object store that is symlinked to the source bucket. In some embodiments, the lambda bucket is associated with a predefined transformation. In some embodiments, the memory includes the programmed instructions that, when executed by the processor, cause the apparatus to receive a request to download the object from the lambda bucket, detect that the object is in the source bucket, fetch the object from the source bucket, transform the object, by compute resources of the object store, using the predefined transformation, and download the transformed object.

Abstract: Bootstrapping a microservices container registry. A computing system node receives an installation package. The receiving computing system node bootstraps an initial invocation of the microservice by first installing a local container registry from the installation package and then by installing the microservice from the installation package. The installation package contains additional components that can be extracted, installed and invoked by executing the microservice at the computing system node after extracting from the local container registry. The installation package is generated by any node of the computing system and contains code corresponding to infrastructure microservices that are installed before invoking microservices that depend on the infrastructure. Temporary domain name services are installed from the installation package at a node-local IP address. The temporary domain name services are switched over to a different domain name service at a different IP address.