Abstract: Methods and systems are directed to discovering problem incidents in a distributed computing system. Events corresponding to historical problems incidents for the distributed computing system are retrieved from a data base. Sets of representative events of the various historical problem incidents for the distributed computing system are determined. A runtime problem incident in the distributed computing system is characterized by runtime events. The runtime problem incident is classified as corresponding to a historical problem incident of the historical problem incidents based on the runtime events and the sets of representative events. Remedial measures used to correct the historical problem incident may be used to correct the runtime problem.

Abstract: A method of reducing data transmission between neural networks in a distributed or federated learning environment, includes the steps of: training a quantization neural network by using a plurality of training vectors each having a dimension k, wherein the quantization neural network is configured to, based on said training, output quantization levels for approximating input vectors having the dimension k; after training the quantization neural network, randomly sampling coordinates of a vector having a dimension d, to provide a first set of k coordinates, wherein d is greater than k; inputting the first set of k coordinates to the quantization neural network to determine first quantization levels for approximating the first set of k coordinates; quantizing the vector having the dimension d based on the determined first quantization levels; and using the quantized vector in the distributed or federated learning environment.

Abstract: A management computer is configured to manage a desired state for hypervisors of a plurality of host computers, by performing the steps of: retrieving from each of the host computers, a plurality of binary files of a hypervisor executing on the host computer; for the hypervisor of each of the host computers, identifying installed software from the retrieved plurality of binary files, including: (1) a version of a base software image of the hypervisor, and (2) one or more of: a driver of the hypervisor, firmware of the hypervisor, and a software component for a software solution of the hypervisor; and in response to a selection of the identified installed software for the hypervisor of a first host computer: generating a desired state document including the selected installed software; and determining, for each of the host computers, a compliance status of the host computer with the generated desired state document.

Abstract: Described herein are systems, methods, and software to manage virtual workload priorities in a computing environment. In at least one example, a management service determines when preemption is required to deploy a virtual machine in a computing environment. When preemption is required, the management service identifies one or more hosts in the computing environment capable of supporting the virtual machine when at least one preemptible virtual machine of one or more preemptible virtual machines is stopped on a corresponding host of the one or more hosts. The management service then selects a host from the one or more hosts for the virtual machine, stops the at least one virtual machine, and deploys the virtual machine on the host.

Abstract: Disclosed are various embodiments relating to a security framework for media playback. In one embodiment, a client device has a decryption module, a streaming module, and a playback module. The playback module may be configured to request media data from the streaming module and render the media data on an output device. The streaming module may be configured to obtain the media data from the decryption module by a request that specifies a size of the media data. The size may be dynamically determined based at least in part on an amount of available temporary data storage. The decryption module may be configured to decrypt a portion of an encrypted media file based at least in part on the specified size to produce the media data.

Abstract: An example method of deploying a hypervisor to a host in a public cloud includes: obtaining, by a deployment service, a prototype hypervisor image from shared storage; obtaining, by the deployment service, configuration information for the host and a physical network of the public cloud to which the host is attached; customizing, by the deployment service, the prototype hypervisor image in response to the configuration information to generate a customized hypervisor image; storing, by the deployment service, the customized hypervisor image in the shared storage in a manner accessible by the public cloud; and invoking a deployment application programming interface (API) of the public cloud to retrieve and install the customized hypervisor image to the host.

Abstract: The disclosure provides a method for monitoring a disconnected component in a container orchestration system. The method generally includes obtaining, by an abstraction layer, monitoring data associated with the component while the component is connected to a network, wherein the abstraction layer comprises at least one proxy component acting as a proxy for the component in the container orchestration system; intercepting, by the abstraction layer, a query intended for the component, wherein the query originated from one or more monitoring agents configured to continuously monitor at least the component; and responding to the query based on the monitoring data obtained by the abstraction layer for the component.

Abstract: A method for coordinating distributed network address translation (NAT) in a network within which several logical networks are implemented. The logical networks include several tenant logical networks and at least one service logical network that include service virtual machines (VMs) that are accessed by VMs of the tenant logical networks. The method defines a group of replacement IP address and port number pairs. Each pair is used to uniquely identify a VM across all tenant logical networks. The method sends to at least one host that is hosting a VM of a particular tenant logical network, a set of replacement IP address and port number pairs. Each replacement IP address and port number pair can be used by the host to replace a source IP address and a source port number in a packet that is destined from the particular VM to a VM of the particular service logical network.

Abstract: Some embodiments provide a method for a connection server that handles a connection between a network management system in a public cloud and a datacenter belonging to a datacenter group managed by the network management system. The method receives an API request, having a first format, for a local network manager located at the datacenter. The method translates the API request into a second format used by the connection between the network management system and the datacenter. The connection is a type that (i) allows for the connection server to push data onto the connection when the connection is initiated by a connection agent at the datacenter and (ii) uses the second format. The method sends the translated API request in the second format to the connection agent via the connection. The connection agent translates the API request into the first format for execution at the local network manager.

Abstract: Example methods and systems for dynamic site selection in a global server load balancer (GSLB) environment are described. In one example, a computer system may obtain first health information from a first entity and second health information from a second entity. The first health information may be generated based on multiple first traffic flows between (a) multiple first client devices and (b) a first pool of backend servers. The second health information may be generated based on multiple second traffic flows between (a) multiple second client devices and (b) a second pool of backend servers. In response to receiving a request to access the service, the computer may select a selected site based on the first health information and/or second health information. A response may be generated and sent to cause a third client device to access the service by directing a third traffic flow towards the selected site.

Abstract: An example method for encrypting clusters during deployment may include retrieving, from a blueprint, resource information required to deploy a cluster including a host computing system and a virtual cluster manager node to manage the host computing system. The resource information may include host information and disk information required to deploy the virtual cluster manager node, and encryption information associated with a key provider. Based on the host information and the disk information, a clustered datastore may be created on the host computing system. Further, the virtual cluster manager node may be deployed on the clustered datastore. Based on the encryption information associated with the key provider, the virtual cluster manager node and associated disks may be encrypted. Upon encrypting the virtual cluster manager node, a cluster may be created and the host computing system may be added to the cluster.

Abstract: A method for provisioning images to deploy containerized workloads in a virtualized environment can include bringing up a containerized workload in a virtualized computing environment responsive to receiving a request to run a containerized workload in the virtualized computing environment. Bringing up the containerized workload can include creating a VMDK that includes a container image in shared storage of an image registry responsive to authenticating with the image registry, attaching the VMDK to a virtual computing instance, responsive to receiving a request, made by a container running in the VCI, for a file of the container image in the attached VMDK, retrieving the file from the shared storage, and bringing up the containerized workload using the file.

Abstract: Disclosed are various embodiments for a unified boot image that can be used to install an operating system onto a host machine and a respective operating system onto a data processing units (DPU) installed on a host machine. The unified boot image contains installation files for installing an operating system on the host machine and an installation depot that can be used to create a boot image for installing the same or different operating system on the DPU. During installation of an operating system on a host machine the installation workflow can also require installation of an additional operating system or other configuration of a DPU installed in a host machine. In response to determining that an operating system is to be installed on the DPU, the installation depot can be obtained and reformatted into a downloadable format that is compatible with the DPU.

Abstract: Systems, apparatus, articles of manufacture, and methods are disclosed for converting enforcement policy information into provisioning template information by instantiating or executing machine-readable instructions to determine a type of a first placeholder of a provisioning template with a plurality of placeholders, copy enforcement policy data corresponding to the determined type of the first placeholder, fill the first placeholder of the provisioning template with the copied enforcement policy data, and save the provisioning template.

Abstract: Example methods and systems for multi-engine intrusion detection are described. In one example, a computer system may configure a set of multiple intrusion detection system (IDS) engines that include at least a first IDS engine and a second IDS engine. In response to detecting establishment of a first packet flow and a second packet flow, the computer system may assign the first packet flow to the first IDS engine and second packet flow to the second engine based on an assignment policy. This way, first packet flow inspection may be performed using the first IDS engine to determine whether first packet(s) associated with the first packet flow are potentially malicious. Second packet flow inspection may be performed using the second IDS engine to determine whether second packet(s) associated with the second packet flow are potentially malicious.

Abstract: Some embodiments provide a novel method for efficiently assigning replication-multicast network addresses to overlay-multicast groups of machines executing on host computers of a software-defined network (SDN). For a source machine that is a source of one or more multicast flows, an SDN controller receives from the source machine an overlay-multicast group network address of an overlay-multicast group for which the source machine is the source, and an overlay-multicast source network address associated with the source machine. The SDN controller uses the overlay-multicast group and source network addresses to determine a replication-multicast network address for the overlay-multicast group. The replication-multicast group network address is determined using both the overlay-multicast group and source network address to avoid different overlay-multicast groups being assigned a same replication-multicast network address.

Abstract: Some embodiments provide a method for establishing secure connections between several services operating in an on-premises network and external devices operating in an external network. The method configures each service to communicate with a reverse proxy operating in the on-premises network. The reverse proxy establishes a secure connection with each service. The method programs the reverse proxy to communicate with a forward proxy that establishes communications with the external devices. In some embodiments, the forward proxy is part of the on-premises network, while in other embodiments the forward proxy is a cloud-based service. Through the reverse and forward proxies, the on-premises services communicate with the external devices securely. For instance, in some embodiments, the forward proxy hides internal network addresses (e.g., IP addresses) and domain names of on-premises services and allows administrators to configure network monitoring to monitor and block malicious activities.

Abstract: A method of deploying virtual infrastructure on hardware infrastructure to support execution of software on the virtual infrastructure, includes the steps of: retrieving a hardware bill of materials (BOM) separately for each of a plurality of hardware devices of a group of hardware devices by using identifying information of each of the plurality of hardware devices, wherein the retrieved hardware BOMs include details about hardware components of different hardware device models corresponding to the plurality of hardware devices; determining, based on the details from the retrieved hardware BOMs, policies to apply to a deployment of the virtual infrastructure on the plurality of hardware devices; and deploying the virtual infrastructure on the plurality of hardware devices according to the determined policies.

Abstract: Some embodiments provide an elastic architecture for providing a service in a computing system. To perform a service on the data messages, the service architecture uses a service node (SN) group that includes one primary service node (PSN) and zero or more secondary service nodes (SSNs). The service can be performed on a data message by either the PSN or one of the SSN. However, in addition to performing the service, the PSN also performs a load balancing operation that assesses the load on each service node (i.e., on the PSN or each SSN), and based on this assessment, has the data messages distributed to the service node(s) in its SN group. Based on the assessed load, the PSN in some embodiments also has one or more SSNs added to or removed from its SN group. To add or remove an SSN to or from the service node group, the PSN in some embodiments directs a set of controllers to add (e.g., instantiate or allocate) or remove the SSN to or from the SN group.

Abstract: Example methods and systems for connectivity service provisioning for a software-defined data center (SDDC) group are described. In one example, a computer system may detect an event that affects a first connectivity service connecting multiple members of the SDDC group. The computer system may obtain first routing information that is applicable in a first SDDC; and second routing information that is applicable in a second SDDC. In response to the event, the computer system may generate and send a first instruction towards the first SDDC and a second instruction towards the second SDDC to cause: (a) the first SDDC and second SDDC to establish a second connectivity service; (b) the first SDDC to update the first routing information to associate a first flow with the second connectivity service; and (c) the second SDDC to update the second routing information to associate a second flow with the second connectivity service.