Abstract: Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (I) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane.

Abstract: Some embodiments provide a method of performing load balancing for a group of machines that are distributed across several physical sites. The method of some embodiments iteratively computes (1) first and second sets of load values respectively for first and second sets of machines that are respectively located at first and second physical sites, and (2) uses the computed first and second sets of load values to distribute received data messages that the group of machines needs to process, among the machines in the first and second physical sites. The iterative computations entail repeated calculations of first and second sets of weight values that are respectively used to combine first and second load metric values for the first and second sets of machines to repeatedly produce the first and second sets of load values for the first and second sets of machines.

Abstract: The present disclosure is directed to a leader-based partially synchronous BFT SMR protocol that improves upon existing protocols by exhibiting two rounds of communication latency, linear authenticator complexity, and optimistic responsiveness. This is achieved through the novel use of an aggregate signature scheme as part of the protocol's view-change procedure.

Abstract: Disclosed are various embodiments for rate proportional scheduling to reduce packet loss in virtualized network function chains. A congestion monitor executed by a first virtual machine executed by a host computing device can detect congestion in a receive queue associated with a first virtualized network function implemented by a first virtual machine. The congestion monitor can send a pause signal to a rate controller executed by a second virtual machine executed by the host computing device. The rate controller can receive the pause signal. In response, the rate controller can pause the processing of packets by a second virtualized network function implemented by the second virtual machine to reduce congestion in the receive queue of the first virtualized network function.

Abstract: Solutions for discovering and onboarding edge devices at scale include: receiving, by a device aggregator, edge device state information including state information for a first edge device; based on at least the state information for the first edge device, configuring the first edge device to perform as a software-defined wide area network (SD-WAN) node; based on at least the edge device state information, determining a first device profile for the first edge device; and transmitting the first device profile to a workload manager. In some examples, the edge device state information includes state information for a second edge device; the second edge device is configured to perform as an SD-WAN node; and a second device profile is determined for the second edge device and transmitted to the workload manager. The workload manager allocates an SD-WAN workload among the first edge device and the second edge device.

Abstract: Some embodiments of the invention provide novel methods for facilitating a distributed SNAT (dSNAT) middlebox service operation for a first network at a host computer in the first network on which the dSNAT middlebox service operation is performed and a gateway device between the first network and a second network. The novel methods enable dSNAT that provides stateful SNAT at multiple host computers, thus avoiding the bottleneck problem associated with providing stateful SNAT at gateways and also significantly reduces the need to redirect packets received at the wrong host by using a capacity of off-the-shelf gateway devices to perform IPV6 encapsulation for IPv4 packets and assigning locally unique IPv6 addresses to each host executing a dSNAT middlebox service instance that are used by the gateway device.

Abstract: An example method of managing guest time for a virtual machine (VM) supported by a hypervisor of a virtualized host computer includes: configuring, by the hypervisor, a central processing unit (CPU) of the host computer to trap, to the hypervisor, access by guest code in the VM to a physical counter and timer of the CPU; configuring, by the hypervisor, the guest code in the VM to use the physical counter and timer of the CPU rather than a virtual counter and timer of the CPU; trapping, at the hypervisor, an access to the physical counter and timer by the guest code; and executing, by the hypervisor, the access to the physical counter and timer on behalf of the guest code while compensating for an adjustment of a system count of the physical counter and timer to maintain the guest time as scaled with respect to frequency of the physical counter and timer.

Abstract: Linked clone read performance when retrieving data from a clone is improved at least by aggregating block mapping metadata efficiently. Primary metadata for a child clone maps a logical block address (LBA) for data in a data region of the child clone to a physical sector address (PSA) for data in the data region of the child clone. At least a portion of primary metadata for a parent clone of the child clone is copied into archival metadata for the child clone. In response to a read request, data is returned from the child clone, parent clone, or another ancestor of the child clone based on whether or not a read request LBA is within the primary metadata for the child clone, or within the archival metadata.

Abstract: The current document is directed to an infrastructure-as-code (“IaC”) cloud-infrastructure-management service or system that automatically generates parameterized cloud templates that represent already deployed cloud-based infrastructure, including virtual networks, virtual machines, load balancers, and connection topologies. The IaC cloud-infrastructure manager provides an infrastructure-discovery service that accesses a cloud-computing facility to obtain information about already deployed cloud infrastructure and that generates a textual description of the deployed infrastructure, which the IaC cloud-infrastructure-manager then transforms into a set of parameterized cloud-infrastructure-specification-and-configuration files, a resource_ids file, and a parameters file that together comprise a parameterized cloud template.

Abstract: Some embodiments of the invention provide a method of deploying a tenant deployable element to one public cloud. The method identifies first and second candidate resource elements respectively of first and second resource element sub-types to deploy in a public cloud to implement the tenant deployable element. The method identifies, for the first and second candidate resource elements respectively first and second sets of performance metric values to evaluate. The method evaluates the identified first and second sets of metrics to select one candidate resource element to implement the tenant deployable element in the public cloud. The method uses the selected resource element to implement the tenant deployable element in the public cloud.

Abstract: The disclosure provides an approach for upgrading a virtual machine (VM) using an instant clone. A method includes initiating updating of the VM on a host in a datacenter; creating a clone of the VM on the host, in response to initiating the update; receiving a first write input/output (I/O) request for a first data block; checking a first disk bitmap associated with a first delta disk for whether a first bit associated with the first data block is set; based on the first bit being set, checking a scanner bitmap for whether a second bit associated with the first data block is set; and based on the second bit being set: waiting until the first data block is merged into a second disk; and performing the first write I/O to the first data block in the second disk after the first data block is merged into the second disk.

Abstract: The current document is directed to a cloud-infrastructure-management service that allows users and upstream management systems to define and deploy infrastructure, such as virtual networks, virtual machines, load balancers, and connection topologies, within cloud-computing systems. The cloud-infrastructure-management service includes a describe state module that includes a describe function that generates a configuration file that specifies the current state of a target server running a server-side cloud-infrastructure-management service.

Abstract: To provide a low latency near RT RIC, some embodiments separate the RIC's functions into several different components that operate on different machines (e.g., execute on VMs or Pods) operating on the same host computer or different host computers. Some embodiments also provide high speed interfaces between these machines. Some or all of these interfaces operate in non-blocking, lockless manner in order to ensure that critical near RT RIC operations (e.g., datapath processes) are not delayed due to multiple requests causing one or more components to stall. In addition, each of these RIC components also has an internal architecture that is designed to operate in a non-blocking manner so that no one process of a component can block the operation of another process of the component. All of these low latency features allow the near RT RIC to serve as a high speed IO between the E2 nodes and the xApps.

Abstract: An example virtualized computing system includes: a host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts, the virtualization layer supporting execution of virtual machines (VMs); an orchestration control plane integrated with the virtualization layer, the orchestration control plane including a master server executing in a first VM of the VMs; guest cluster infrastructure software (GCIS) executing in the master server, the GCIS configured to create a set of objects defining a container orchestration cluster, and manage lifecycles of second VMs of the VMs based on state of the set of objects; and guest software executing in the second VMs to implement the container orchestration cluster as a guest cluster of the host cluster, the guest software having components that interface with the GCIS.

Abstract: Some embodiments of the invention provide a method for performing congestion control for a particular packet flow associated with a source first host computer operating in a network. The method is performed at the first source host computer. The method determines a bandwidth threshold specified for the particular packet flow. Based on the bandwidth threshold, the method allocates an amount of bandwidth to the particular packet flow. The method periodically receives sets of contextual data associated with the particular packet flow. For the received sets of contextual data, the method iteratively (1) computes a current bandwidth consumption by the particular packet flow and (2) based on the sets of contextual data and the current bandwidth consumption, adjusts the amount of bandwidth allocated to the particular packet flow.

Abstract: An example method of input/output (IO) between system software executing in a computer and a storage device includes: sending, from the system software, IO commands to the storage device; handling, by the system software, IO completion messages from the storage device in an interrupt mode; determining, while processing the IO commands, a first value for a measure of IO operations per second (IOPs) of the storage device; determining, by a device driver of the system software, that a first condition is met, the first condition being that the measure of IOPs satisfies a threshold for enabling a polling mode; determining, by the device driver, that a second condition is met, the second condition being that a timer started in an interrupt mode has not expired; and maintaining, by the device driver, the interrupt mode in response to the second condition despite the first condition.

Abstract: Some embodiments provide a novel method for configuring components of a software-defined network (SDN) to automatically deploy and monitor a logical edge router for a user. The method configures a policy parser to parse an intent-based Application Programming Interface (API) request to identify a set of attributes for the logical edge router. The method also configures a set of multi-cloud edge orchestrators (1) to use the set of attributes to derive an edge deployment plan specifying a set of two or more edge instances to implement the logical edge router, and (2) to deploy the set of edge instances in a set of two or more clouds based on the edge deployment plan.

Abstract: Some embodiments provide a method for configuring a gateway router of a virtual datacenter. The method is performed at a network management component of a virtual datacenter that is defined in a public cloud and comprises a set of network management components and a set of network endpoints connected by a logical network managed by the network management components of the virtual datacenter. The method receives a set of network addresses of the network endpoints. The method aggregates at least a subset of the network addresses into a single subnet address that encompasses all of the aggregated network addresses. The method provides an aggregated route for the subset of network addresses to a gateway router that connects the virtual datacenter to a public cloud underlay network in order for the router to route data messages directed to the network endpoints to the logical network of the virtual datacenter.

Abstract: Some embodiments provide a method for dynamically deploying a managed forwarding element (MFE) in a software-defined wide-area network (SD-WAN) for a particular geographic region across which multiple SaaS applications is distributed. The method determines, based on flow patterns for multiple flows destined for the multiple SaaS applications distributed across the particular geographic region, that an additional MFE is needed for the particular geographic region. The method configures the additional MFE to deploy at a particular location in the particular geographic region for forwarding the multiple flows to the multiple SaaS applications. The method provides, to a particular set of MFEs that connect a set of branch sites to the SD-WAN, a set of forwarding rules to direct the particular set of MFEs to use the additional MFE for forwarding subsequent data messages belonging to the multiple flows to the multiple SaaS applications.

Abstract: Some embodiments provide a hierarchical data service (HDS) that manages many resource clusters that are in a resource cluster hierarchy. In some embodiments, each resource cluster has its own cluster manager, and the cluster managers are in a cluster manager hierarchy that mimics the hierarchy of the resource clusters. In some embodiments, both the resource cluster hierarchy and the cluster manager hierarchy are tree structures, e.g., a directed acyclic graph (DAG) structure that has one root node with multiple other nodes in a hierarchy, with each other node having only one parent node and one or more possible child nodes.