Abstract: An example virtualized computing system includes: a host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts, the virtualization layer supporting execution of virtual machines (VMs); an orchestration control plane integrated with the virtualization layer, the orchestration control plane including a master server executing in a first VM of the VMs; guest cluster infrastructure software (GCIS) executing in the master server, the GCIS configured to create a set of objects defining a container orchestration cluster, and manage lifecycles of second VMs of the VMs based on state of the set of objects; and guest software executing in the second VMs to implement the container orchestration cluster as a guest cluster of the host cluster, the guest software having components that interface with the GCIS.

Abstract: Some embodiments of the invention provide a method for performing congestion control for a particular packet flow associated with a source first host computer operating in a network. The method is performed at the first source host computer. The method determines a bandwidth threshold specified for the particular packet flow. Based on the bandwidth threshold, the method allocates an amount of bandwidth to the particular packet flow. The method periodically receives sets of contextual data associated with the particular packet flow. For the received sets of contextual data, the method iteratively (1) computes a current bandwidth consumption by the particular packet flow and (2) based on the sets of contextual data and the current bandwidth consumption, adjusts the amount of bandwidth allocated to the particular packet flow.

Abstract: To provide a low latency near RT RIC, some embodiments separate the RIC's functions into several different components that operate on different machines (e.g., execute on VMs or Pods) operating on the same host computer or different host computers. Some embodiments also provide high speed interfaces between these machines. Some or all of these interfaces operate in non-blocking, lockless manner in order to ensure that critical near RT RIC operations (e.g., datapath processes) are not delayed due to multiple requests causing one or more components to stall. In addition, each of these RIC components also has an internal architecture that is designed to operate in a non-blocking manner so that no one process of a component can block the operation of another process of the component. All of these low latency features allow the near RT RIC to serve as a high speed IO between the E2 nodes and the xApps.

Abstract: An example method of input/output (IO) between system software executing in a computer and a storage device includes: sending, from the system software, IO commands to the storage device; handling, by the system software, IO completion messages from the storage device in an interrupt mode; determining, while processing the IO commands, a first value for a measure of IO operations per second (IOPs) of the storage device; determining, by a device driver of the system software, that a first condition is met, the first condition being that the measure of IOPs satisfies a threshold for enabling a polling mode; determining, by the device driver, that a second condition is met, the second condition being that a timer started in an interrupt mode has not expired; and maintaining, by the device driver, the interrupt mode in response to the second condition despite the first condition.

Abstract: Some embodiments provide a novel method for configuring components of a software-defined network (SDN) to automatically deploy and monitor a logical edge router for a user. The method configures a policy parser to parse an intent-based Application Programming Interface (API) request to identify a set of attributes for the logical edge router. The method also configures a set of multi-cloud edge orchestrators (1) to use the set of attributes to derive an edge deployment plan specifying a set of two or more edge instances to implement the logical edge router, and (2) to deploy the set of edge instances in a set of two or more clouds based on the edge deployment plan.

Abstract: Example methods and systems for receive side scaling (RSS) are described. In one example, a computer system may generate and send instruction(s) to the programmable physical network interface controller (PNIC) to configure a first flow entry that associates a first packet flow with a first queue and a second flow entry that associates a second packet flow with a second queue. In response to receiving a first packet that is associated with the first packet flow, the programmable PNIC may match the first packet with the first flow entry and steer the first packet towards the first queue for processing by a first processing thread. In response to receiving a second packet that is associated with the second packet flow, the programmable PNIC may match the second packet with the second flow entry and steer the second packet towards the second queue for processing by a second processing thread.

Abstract: Some embodiments provide a method for configuring a gateway router of a virtual datacenter. The method is performed at a network management component of a virtual datacenter that is defined in a public cloud and comprises a set of network management components and a set of network endpoints connected by a logical network managed by the network management components of the virtual datacenter. The method receives a set of network addresses of the network endpoints. The method aggregates at least a subset of the network addresses into a single subnet address that encompasses all of the aggregated network addresses. The method provides an aggregated route for the subset of network addresses to a gateway router that connects the virtual datacenter to a public cloud underlay network in order for the router to route data messages directed to the network endpoints to the logical network of the virtual datacenter.

Abstract: Some embodiments provide a hierarchical data service (HDS) that manages many resource clusters that are in a resource cluster hierarchy. In some embodiments, each resource cluster has its own cluster manager, and the cluster managers are in a cluster manager hierarchy that mimics the hierarchy of the resource clusters. In some embodiments, both the resource cluster hierarchy and the cluster manager hierarchy are tree structures, e.g., a directed acyclic graph (DAG) structure that has one root node with multiple other nodes in a hierarchy, with each other node having only one parent node and one or more possible child nodes.

Abstract: Some embodiments provide a method for dynamically deploying a managed forwarding element (MFE) in a software-defined wide-area network (SD-WAN) for a particular geographic region across which multiple SaaS applications is distributed. The method determines, based on flow patterns for multiple flows destined for the multiple SaaS applications distributed across the particular geographic region, that an additional MFE is needed for the particular geographic region. The method configures the additional MFE to deploy at a particular location in the particular geographic region for forwarding the multiple flows to the multiple SaaS applications. The method provides, to a particular set of MFEs that connect a set of branch sites to the SD-WAN, a set of forwarding rules to direct the particular set of MFEs to use the additional MFE for forwarding subsequent data messages belonging to the multiple flows to the multiple SaaS applications.

Abstract: Some embodiments of the invention provide a method for providing asymmetric route resolutions in an SD-WAN. The method is performed at a first edge router at a first site in a first region connected by the SD-WAN. From a first hub router of a first cluster, the method receives a flow sent by a second edge router at a second site in a second region via a first route that points to a next-hop second hub router of a second cluster. The method identifies a default second route from the first edge router to the second edge router pointing to a next-hop third hub router of the second cluster. When the first route includes secure overlay tunnels, and source addresses of the first packet flow and the first route match, the method uses the first route to send a return flow to the second edge router to ensure symmetric routing.

Abstract: Example methods and systems for virtual tunnel endpoint (VTEP) mapping for overlay networking are described. One example may involve a computer system monitoring multiple VTEPs that are configured for overlay networking. In response to detecting a state transition associated with a first VTEP from a healthy state to an unhealthy state, the computer system may identify mapping information that associates a virtualized computing instance with the first VTEP in the unhealthy state; and update the mapping information to associate the virtualized computing instance with a second VTEP in the healthy state. In response to detecting an egress packet from the virtualized computing instance to a destination, an encapsulated packet may be generated and sent towards the destination based on the updated mapping information. The encapsulated packet may include the egress packet and an outer header identifying the second VTEP to be a source VTEP.

Abstract: Disclosed are aspects of memory-aware placement in systems that include graphics processing units (GPUs) that are virtual GPU (vGPU) enabled. In some examples, graphics processing units (GPU) are identified in a computing environment. Graphics processing requests are received. A graphics processing request includes a GPU memory requirement. The graphics processing requests are processed using a graphics processing request placement model that minimizes a number of utilized GPUs that are utilized to accommodate the requests. Virtual GPUs (vGPUs) are created to accommodate the graphics processing requests according to the graphics processing request placement model. The utilized GPUs divide their GPU memories to provide a subset of the plurality of vGPUs.

Abstract: Some embodiments of the invention provide a method of sending data in a network that includes multiple worker nodes, each worker node executing at least one set of containers, a gateway interface, and a virtual local area network (VLAN) tunnel interface. The method configures the gateway interface of each worker node to associate the gateway interface with multiple subnets. Each subnet is associated with a namespace, a first worker node executes a first set of containers of a first namespace, and a second worker node executes a second set of containers of the first namespace and a third set of containers of a second namespace. The method sends data between the first set of containers and the second set of containers through a VLAN tunnel between the first and second worker nodes.

Abstract: Some embodiments provide a method for a first smart NIC of multiple smart NICs of a host computer. Each of the smart NICs executes a smart NIC operating system that performs virtual networking operations for a set of data compute machines executing on the host computer. The method receives a data message sent by one of the data compute machines executing on the host computer. The method performs virtual networking operations on the data message to determine that the data message is to be transmitted from a port of a second smart NIC of the multiple smart NICs. The method passes the data message to the second smart NIC via a private communication channel connecting the plurality of smart NICs.

Abstract: The present disclosure is directed to a novel reconfiguration framework for a BFT SMR system. With this framework, the configuration of both the system itself and the clients of the system can be modified in a live manner (i.e., without taking the system offline) while preserving correct system operation.

Abstract: Some embodiments of the invention provide novel methods for providing transparent services for multicast data messages traversing a network edge device operating at a boundary between two networks. The method analyzes data messages received at the network edge device to determine whether they require a service provided at the boundary and whether they are unicast or multicast (including broadcast). The method modifies a multicast destination media access control (MAC) address of a multicast data message requiring a service to be a unicast destination MAC address and provides, without processing by a standard routing function, the modified data message directly to an interface associated with a service node that provides the particular service required by the data message. The method receives the serviced data message, restores the multicast destination MAC address, and forwards the serviced data message to a set of destinations associated with the multicast destination address.

Abstract: The disclosure provides an approach for logical switch level load balancing of Layer 2 virtual private network (L2VPN) traffic. A method of securing communications with a peer gateway generally includes establishing, at a virtual tunnel interface of a local gateway, a plurality of security tunnels with the peer gateway. Each of the plurality of security tunnels is associated with a different set of one or more layer 2 segments and with one or more security associations (SAs) with the peer gateway. The method generally includes receiving a packet, at the local gateway, via a first L2 segment. The method generally includes selecting one of the plurality of security tunnels and an SA associated with the selected security tunnel based on the L2 segment via which the packet was received. The method generally includes encrypting and encapsulating the packet based on the selected security tunnel and SA.

Abstract: An example method of deploying a logical network platform in a virtualized computing system, the virtualized computing system including a host cluster and a virtualization management server connected to a physical network, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts is described. The method includes receiving, at the virtualization management server, a declarative specification describing a proposed state of the logical network platform; deploying, by the virtualization management server, a network manager of the logical network platform in response to the proposed state in the declarative specification; and deploying, by the virtualization management server in cooperation with the network manager, binaries to the hosts in the host cluster.

Abstract: This disclosure is directed to automated computer-implemented methods and systems for detecting and correcting a trending problem with an application executing in a data center. The methods receive a new support request entered via a graphical user interface. The methods perform trend discovery of the new support request over recent time windows using a pre-trained and fine-tuned model bidirectional encoder representation from transformer. In response to detecting a trending problem described in the new support request, the method discovers recommended remedial measures for the new support request based on similar support requests previously recorded in a support request data store or on similar knowledge base articles previously recorded in a knowledge base data store. The recommended remedial measures for correcting the trending problem are executed using an operations manager of the data center.

Abstract: A method of synchronously executing input/output operations (IOs) for a plurality of applications using a storage device with a file system includes the steps of: receiving a first write IO including an instruction to write first data at a first address of the file system; determining that, within a first range of the file system comprising the first address, there are no pending unmap IOs for deallocating storage space of the storage device from files of the plurality of applications; after determining that there are no pending unmap IOs within the first range, locking the first range to prevent incoming unmap IOs from deallocating storage space within the first range from the files of the plurality of applications; after locking the first range, writing the first data to the storage device at the first address; and after writing the first data, unlocking the first range.