Abstract: The disclosure provides an approach for cross-cluster service resource discovery. A method includes obtaining, at a common store in a first node cluster in a cluster set information about a service resource of a second node cluster. The method includes creating a multi-cluster object associated with the service resource, wherein the multi-cluster object provides an association between the service resource and one or more endpoints on the second node cluster. The method includes storing the multi-cluster object in the common store, wherein the multi-cluster object is accessible in the common store by any of the plurality of node clusters in the cluster set to access the service resource on any of the one or more endpoints on the second node cluster.

Abstract: An example method of automatically deploying a containerized workload on a hypervisor based device is provided. The method generally includes booting the device running a hypervisor, in response to booting the device: automatically obtaining, by the device, one or more intended state configuration files from a server external to the device, the one or more intended state configuration files defining a control plane configuration for providing services for at least deploying and managing the containerized workload and workload configuration parameters for the containerized workload; deploying a control plane pod configured according to the control plane configuration; deploying one or more worker nodes based on the control plane configuration, and deploying one or more workloads identified by the workload configuration parameters on the one or more worker nodes.

Abstract: The disclosure provides a method for providing a high availability control plane in a container-based cluster. The method generally includes determining a first control plane node is unreachable within a cluster; in response to determining the first control plane node is unreachable, activating a second control plane node previously deployed in the cluster, wherein prior to activing the second control plane node the second control plane node comprises: control plane components, not actively running on the second control plane node, that are configured to manage the other components within the cluster; removing the active control plane node from the cluster; determining a number of inactive control plane nodes associated with the second control plane node is less than a minimum number of inactive control plane nodes; and deploying one or more inactive control plane nodes associated with the second control plane node until the minimum number is reached.

Abstract: Disclosed herein is a system and method for controlling network traffic among namespaces in which various entities, such as virtual machines, pod virtual machines, and a container orchestration system, such as Kubernetes, reside and operate. The entities have access to a network that includes one or more firewalls. The traffic that is permitted to flow over the network among and between the namespaces is defined by a security policy definition. The security policy definition is posted to a master node in a supervisor cluster that supports and provisions the namespaces. The master node invokes a network manager to generate a set of firewall rules and program the one or more firewalls in the network to enforce the rules.

Abstract: Systems and methods for configuring an egress node for an egress pod set comprising one or more pods are provided. The egress pod set may be allocated one or more egress internet protocol (IP) addresses. The egress node may be selected among nodes of a cluster including the one or more pods. The egress node may be configured as the routing destination for an egress IP address selected among the one or more egress internet protocol (IP) addresses.

Abstract: System and computer-implemented method for managing multi-availability zone (AZ) clusters of host computers in a cloud computing environment automatically detects a degraded state of a first AZ in the cloud computing environment based on host failure events for host computers in a first cluster section of a multi-AZ cluster of host computers located in the first AZ and a recovered state of the first AZ based a successful scale-in operation of another multi-AZ cluster located partially in the first AZ. In response to the detection of the degraded state of the first AZ, a second cluster section of the multi-AZ cluster of host computers located in a second AZ is scaled out. In response to the detection of the recovered state of the first AZ, the second cluster section of the multi-AZ cluster of host computers located in the second AZ is scaled in.

Abstract: The disclosure provides an approach for firewall policy management. Embodiments include receiving, at a firewall from a first virtual computing instance (VCI), a registration request comprising a first identifier of the first VCI and a second identifier of a second VCI. Embodiments include determining, at the firewall, based on the second identifier included in the registration request, that the second VCI is associated with a network security policy at the firewall. Embodiments include applying, at the firewall, based on the first identifier included in the registration request, the network policy associated with the second VCI to the first VCI. Additionally, embodiments include allowing or disallowing network activity for the first VCI based on the applied network security policy.

Abstract: A method for efficient distributed object manager (DOM) owner migration in a virtual storage area network (VSAN) is provided. Embodiments include determining to migrate a DOM owner object from a source DOM owner server to a destination DOM owner server. Embodiments include determining that an input or output (I/O) operation affecting the DOM owner object is in progress. Embodiments include, prior to updating the DOM owner object based on the I/O operation, transferring the DOM owner object from the source DOM owner server to the destination DOM owner server. Embodiments include completing execution of the I/O operation on the destination DOM owner server. Embodiments include updating the DOM owner object on the destination DOM owner server based on the I/O operation.

Abstract: A computer-implemented method for electing a leader in a computing system is provided. In one aspect, a method includes identifying a computing resource for multiple container groups that each include one or more containers. A determination is made, from applications running in containers of the container groups, of multiple election candidate applications. Each election candidate application has an instance deployed in a corresponding container in each container group. For each container group, an election runner process is established within the container group. For each instance of each of the election candidate applications, a corresponding election watcher process is established. A communication link is established between the election runner process and each election watcher process. A request for leader election is transmitted from the election runner process to the computing resource. A response received from the computing resource.

Abstract: Disclosed are various embodiments provisioning a data processing unit in a host machine. There can be multiple data processing units within the host machine with varying hardware or software requirements for an installation image that can be utilized to provision the device. Multiple installation images can be generated for different data processing units having varying requirements in a heterogeneous environment.

Abstract: The disclosure provides a method for handling heterogeneous input/output (I/O) load for containers running in a virtualized environment. The method generally includes receiving, from an application running in a container, an I/O indicating to write data to a persistent volume backed by a virtual disk file in storage, determining a maximum number of in-flight write I/Os allowed for the persistent volume based on a share of a total write I/O bandwidth assigned to the virtual disk file and allocated to the persistent volume, determining a current number of in-flight write I/Os for the persistent volume, and determining whether the current number of in-flight write I/Os for the persistent volume is greater than or equal to the maximum number of in-flight write I/Os allowed for the persistent volume to determine whether the received I/O is to be rejected or processed.

Abstract: Aspects of the disclosure provide solutions for managing point in time (PIT) snapshots by a guest operating system (OS) to provide more rapid start-up time for virtualized component (VC) clones (e.g., virtual machines, VMs) and simplify restoration. Examples include the guest OS determining that the VC has completed a boot process and is in a known good state. The guest OS instructs the hypervisor to store a PIT snapshot of the VC, including a memory state of the VC. Because the snapshot is captured while the VC is executing, it may be used as an instant clone that avoids delays caused by booting the clone. Some examples include the guest OS detecting a restoration point trigger (e.g., a configuration change) and determining that the VC currently has a stable configuration. The guest OS instructs the hypervisor to store a snapshot of the VC to use later as a restoration point.

Abstract: The disclosure provides approaches for managing multicast group membership at a node. An approach includes policing whether a pod can join a multicast group based on one or more rules. The approach further includes updating forwarding tables of a virtual switch based on whether the pod is allowed to join the multicast group.

Abstract: The current document is directed to methods and systems that generate recommendations for resource specifications used in virtual-machine-hosting requests. When distributed applications are submitted to distributed-computer-system-based hosting platforms for hosting, the hosting requestor generally specifies the computational resources that will need to be provisioned for each virtual machine included in a set of virtual machines that correspond to the distributed application, such as the processor bandwidth, memory size, local and remote networking bandwidths, and data-storage capacity needed for supporting execution of each virtual machine. In many cases, the hosting platform reserves the specified computational resources and accordingly charges for them. However, in many cases, the specified computational resources significantly exceed the computational resources actually needed for hosting the distributed application.

Abstract: This disclosure is directed to automated computer-implemented methods for application discovery from log messages generated by event sources of applications executing in a cloud infrastructure. The methods are executed by an operations manager that constructs a data frame of probability distributions of event types of the log messages generated by the event sources in a time period. The operations manager executes clustering techniques that are used to form clusters of the probability distributions in the data frame, where each of the clusters corresponds to one of the applications. The operations manager displays the clusters of the probability distributions in a two-dimensional map of applications in a graphical user interface that enables a user to select one of the clusters in the map of applications that corresponds to one of the applications and launch clustering of probability distributions of the user-selected cluster to discover two or more instances of the application.

Abstract: Some embodiments provide a method for configuring a network to bridge data messages between a hardware-implemented L2 overlay network segment and a software-implemented L2 overlay network segment. The method identifies a host computer on which a logical network endpoint connected to the software-implemented overlay executes. The hardware-implemented L2 overlay connects at least a first set of network endpoints located in a first physical network zone and connected to a first L2 network segment and a second set of network endpoints located in a second physical network zone and connected to a second L2 network segment. The identified host computer is located in the first physical network zone. The method configures a forwarding element executing on the host computer to bridge data messages between the logical network endpoint and (i) the first set of network endpoints and (ii) the second set of network endpoints.

Abstract: Managing cloud snapshots in a development platform is described herein. One example method includes creating a snapshot of a virtual computing instance (VCI), provided by a cloud provider, using a development platform, receiving a request to revert to the snapshot, and performing a revert operation responsive to receiving the request. The revert operation can include creating a new boot disk on the cloud provider to replace a current boot disk in the development platform, creating a new data disk to replace a current data disk associated with the VCI, powering off the VCI and detaching the boot disk and the data disk, attaching the new boot disk and the new data disk to the VCI, powering on the VCI, and deleting the detached boot disk and the detached data disk.

Abstract: Some embodiments of the invention provide a method for an interference detection RAN application deployed across one or more RICs for detecting and identifying external interference in a RAN that includes multiple RAN base stations servicing users located across multiple regions, each region including at least one RAN base station. The method is performed for a particular region serviced by a particular RAN base station. The method detects an interference incident associated with the particular region. The method analyzes a pattern of spectrum interference associated with the particular region. Based on said analysis, the method determines whether the pattern of spectrum interference matches a first signature pattern associated with internal interference or a second signature pattern associated with external interference.

Abstract: Site reliability engineering (SRE) may be provided as a service to software products, such as an on-premises software product residing at a first computing environment. A SRE service site may be hosted at a second computing environment that is remote and separate from the first computing environment. A SRE agent resides at the first computing environment to monitor the software product, and provides information, such as metric data or log information pertaining to the software product, to the SRE service site. A SRE service of the SRE service site performs analysis of the information to identify an issue with the software product, diagnosis to determine a cause of the issue, and identifies a remediation that may be applied by the SRE agent to address the issue.

Abstract: Example methods and systems for connection establishment in a global server load balancer (GSLB) environment are described. In one example, a computer system may establish a first connection with a first entity and a second connection with the second entity. The first connection may be established based on first parameter information that includes a shared certificate and a first identifier (ID). The second connection may be established based on second parameter information that includes the shared certificate and a second ID. The shared certificate may be shared by multiple entities that include the first entity and a second entity. In response to receiving a first request, a first response may be generated and sent towards the first entity via the first connection. In response to receiving a second request, a second response may be generated and sent towards the second entity via the second connection.