Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: Example methods and systems for packet handling based on a multiprocessor architecture configuration are provided. One example method may comprise: in response to receiving a first ingress packet that requires processing by a first virtual central processing unit (VCPU) running on the first node, steering the first ingress packet towards a first receive (RX) queue and performing local memory access on the first node to access the first ingress packet from the first RX queue. The method may also comprise: in response to receiving a second ingress packet that requires processing by a second VCPU running on the second node, steering the second ingress packet towards a second RX queue and performing local memory access on the second node to access the second ingress packet from the second RX queue.

Abstract: Methods, apparatus and articles of manufacture for custom interface specification in a cloud management system are disclosed. An example cloud management system includes: a first interface to communicate with a second interface external to the cloud management system; and a host to manage requests from the second interface and allocate resources to the second interface as a reverse proxy for the second interface with respect to a backend. The example host is to at least: add, at the request of the second interface, an endpoint with respect to the second interface; fetch, at the request of the second interface, data for the endpoint from the backend, the backend identified for the endpoint based on metadata in a component registry; and provide the data from the backend to the second interface.

Abstract: Methods, apparatus, systems and articles of manufacture are disclosed related to policy declarations for cloud management system. An example computer readable storage device includes instructions that, when executed, cause processor circuitry to at least identify a proposed change to a state of a network. The example instructions, when executed, also cause the processor circuitry to, in response to identifying the proposed change, determine whether the proposed change will cause the state of the network to violate a policy, the policy including a query plan describing characteristics to evaluate the proposed change. In some examples, the instructions, when executed, cause the processor circuitry to, when the proposed change will cause the state of the network to violate the policy, execute an application programming interface call to a cloud service provider to cause the cloud service provider to prevent violation of the policy by executing an action associated with the proposed change.

Abstract: A disclosed example of managing a network includes a packet receiver to receive a packet at a second switch from a first switch via an inter-switch link between the first and second switches; a packet analyzer to determine whether the packet includes a load-based teaming (LBT) egress control value; a packet transmitter to handle the packet according to an LBT policy when the packet analyzer determines the packet does not include the LBT egress control value; and a packet modifier to terminate the packet at the second switch when the packet analyzer determines the packet does include the LBT egress control value.

Abstract: The present disclosure provides an approach for creating one or more firewall rules to regulate communication between containers. The approach includes calculating a trust score for each container. To generate a rule for any two containers, a difference between the trust scores is computed, and if the difference in trust levels is too large, then the more trustworthy container is not allowed to communicate with the less trustworthy container. If the difference in trust scores is not too large, then the trustworthy container is allowed to communicate with the other trustworthy container, or an untrustworthy container is allowed to communicate with another untrustworthy container.

Abstract: Disclosed are various examples for kernel level application data protection. In one example, a security label map is written to a kernel layer. The security label map includes a security label and a list of permitted applications for files originated by a protected application. A file access system call is intercepted by kernel-level management instructions. An application identity is identified for an application requesting to access a secure file. Access to the secured file is permitted or denied based on a comparison of the application identity with the list of permitted applications.

Abstract: A method and system for performing a flexible Byzantine fault tolerant (BFT) protocol. The method includes sending, from a client device, a proposed value to a plurality of replica devices and receiving, from at least one of the plurality of replica devices, a safe vote on the proposed value. The replica device sends the safe vote, based on a first quorum being reached, to the client device and each of the other replica devices of the plurality of replica devices. The method further includes determining that a number of received safe votes for the proposed value meets or exceeds a second quorum threshold, selecting the proposed value based on the determination, and setting a period of time within which to receive additional votes. The method further includes, based on the period of time elapsing without receiving the additional votes, committing the selected value for the single view.

Abstract: An example apparatus includes a deployment monitor to initiate a modification of a number of virtual machines deployed in the computing environment. The virtual machines including a first virtual machine to execute a first component of an application deployed in the computing environment. A dependents identifier is to identify an information dependency of a second virtual machine on information from the first virtual machine. The second virtual machine is to execute a second component of the application. An updater is to update the information dependency based on a scaling status of the first virtual machine. The information dependency in the configuration information including a reference to the first virtual machine.

Abstract: A method for processing virtualization of computers that are part of a group into virtual computers is provided. The method includes obtaining relationship data from the computers, where the relationship data identifies parameters used to communicate within the group. Then, the method analyzes utilization parameters for each of the computers of the group. A visual model for proposed virtualization of the group of computers is then generated. The visual model identifies hosting machines designated to define a virtual computer for each of the computers, where the visual model provides a graphical illustration of the group of computers once converted to virtual computers. The method enables adjustment of the proposed virtualization of the group of computers. Then, an execution sequence of virtualization operations to be carried out is generated, if execution of the proposed virtualization is triggered, and the execution sequence is saved to storage and accessed upon execution.

Abstract: Various examples are disclosed for hybrid alert and action solution in IoT (IoT) networks. A cloud layer decision model that generates cloud layer predictions is identified using device layer data. A quantized decision model is generated as a quantized version of the cloud layer decision model. A logical group that includes an edge device that collects a portion of the device layer data is identified. The quantized decision model is transmitted to the logical group.

Abstract: A method of creating a new page table structure after first stage boot operations has completed but before handoff to a hypervisor occurs. Firmware page tables are reused and copied to a region of memory by a first-stage bootloader while the firmware is running, processed to have an expected multi-stage page table structure and desired access rights, and copied again to another region of memory by the first-stage bootloader after the first-stage bootloader has completed its booting operations and after the firmware has been quiesced.

Abstract: Exemplary methods, apparatuses, and systems include a hypervisor receiving an error message from an agent within a first virtual machine run by the hypervisor. In response to the error message, the hypervisor determines and initiates a corrective action for the hypervisor to take in response to the error message. An exemplary corrective action includes initiating a reset of the first virtual machine or a reset of a second virtual machine.

Abstract: The disclosure herein describes mounting a shared data store, remote from a client cluster, as a remote data store on the client cluster. An abstraction interface of the remote data store on the client cluster is configured to receive data operations that are in a local data store-based format. A control path interface is established between the server cluster and the client cluster, and network location data associated with the shared data store is received by the client cluster via the established control path interface. Based on the network location data, a data path interface is established between the client cluster and the shared data store of the server cluster, whereby data operations directed to the abstraction interface of the remote data store on the client cluster are routed to the shared data store of the server cluster via the established data path interface.

Abstract: The disclosure provides an approach for high-availability admission control. Embodiments include determining a number of slots present on the cluster of hosts. Embodiments include receiving an indication of a number of host failures to tolerate. Embodiments include determining a number of slots that are assigned to existing computing instances on the cluster of hosts. Embodiments include determining an available cluster capacity based on the number of slots present on the cluster of hosts, the number of host failures to tolerate, and the number of slots that are assigned to existing computing instances on the cluster of hosts. Embodiments include determining whether to admit a given computing instance to the cluster of hosts based on the available cluster capacity.

Abstract: Disclosed herein is a system and method for checking and maintaining consistency of blocks stored in a virtual disk with a content based read cache (CBRC). When blocks are written to the cache and virtual disk, a hash is computed for the block and stored in a digest file on the virtual disk. In the background, each block is obtained from the virtual disk, its hash is recomputed, and the hash is compared to the stored hash in the digest file. If the comparison indicates a mismatch, then an error is reported.

Abstract: Disclosed are various approaches for integrating chat conversations with email messages. A user can request to view a received email message exchanged between multiple entities. If there is an established chat conversation associated with the user that is linked to the email message, the user interface including the email message can include a messaging component that can allow a user to view the corresponding chat conversation. The user interface can also include a component that allows the user to initiate a chat conversation with another party included in the email without switching to a third-party service.

Abstract: The present disclosure is related to devices, systems, and methods for persistent alert notes. An example method can include receiving an alert message via a log management server, wherein the alert message indicates a current alert instance particular to a class of alerts, retrieving, in response to receiving the alert message, a note stored in association with the class of alerts via the log management server, wherein the note includes resolution information corresponding to a previous alert instance particular to the class of alerts, and providing the retrieved note via a user interface of the log management server.

Abstract: Approaches for automatically creating device campaigns are disclosed herein. A computing device first determines that a second version of a software package assigned to an existing device campaign has been uploaded to a data store. The existing device campaign can include an existing compliance policy applicable to individual IoT endpoints assigned to the existing device campaign. The compliance policy may specify that a first version of the software package be installed on the individual IoT endpoints. In response, to the change, the computing device can create a new device campaign that includes a new compliance policy applicable to the individual IoT endpoints assigned to the new device campaign. The new compliance policy may specify that the second version of the software package be assigned to the individual IoT endpoints.

Abstract: Techniques for supporting large segments when issuing writes to an erasure coded storage object in a distributed storage system are provided. In one set of embodiments, a node of the system can pre-allocate a segment of space in a capacity object of the storage object, receive a write request for updating a logical data block of the storage object, write data/metadata for the block to a record in a data log of a metadata object of the storage object, place the block in an in-memory bank, and determine whether the in-memory bank has become full. If so, the node can compute/fill-in one or more parity blocks for each stripe of the storage object in the in-memory bank and write, based on a next sub-segment pointer pointing to a free sub-segment of the pre-allocated segment, the contents of the in-memory bank via a full stripe write to the free sub-segment.