Abstract: Systems, methods and computer program products are described herein that can be used to help achieve a safe rollout of software in a production datacenter environment. In accordance with certain embodiments, cloud services requests from certain users of a cloud services system (e.g., users that are authorized to receive cloud services via computing devices running test versions of infrastructure software) are dynamically matched to clusters (groups of commonly-managed computing devices called nodes) that are capable of providing the requested services on nodes running test versions of infrastructure software. Within such clusters, the requested services are provided to the users on a subset of cluster nodes that run a test version of an infrastructure software component, while the remaining cluster nodes are not running the particular test version.

Abstract: Methods, systems, apparatuses, and computer program products are provided that enable the automated deployment of microservices to a network-accessible server set. The automated deployment may be based on constraint(s) that are specified by a declarative deployment model that is associated with the microservice to be deployed. For example, a centralized deployment orchestrator may receive microservice(s) and their associated declarative deployment model(s). The deployment orchestrator analyzes the declarative deployment model(s) and determines which microservice(s) are to be deployed based on the constraint(s) specified by the declarative deployment model(s). The foregoing techniques advantageously determine when to deploy microservice(s), while also minimizing human intervention typically required to deploy microservice(s).

Abstract: Software updates within one or more regions of a multi-tenant cloud are coordinated. Tenant vs. tenant conflicts, tenant vs. infrastructure provider conflicts, and conflicts between security and another priority are identified and resolved using a shared update coordinator, update priority specifications, and availability specifications. An infrastructure update request may be presented to tenants for approval. Postponed infrastructure updates may be prioritized higher. Preventing exploits of zero-day vulnerabilities may be prioritized over meeting availability targets. Updates may be merged to reduce downtime, even when the updates originate from independently controlled entities. Maximum downtime, minimum fault domains, minimum virtual machines, permitted update start times, and other availability criteria may be specified. Updates may be preempted, or allowed to complete, based on their relative priorities.

Abstract: Methods, systems, and apparatuses manage rolling out of updates in a network-accessible server infrastructure which operates a plurality of instances of a supporting service. The supporting service is comprised by a plurality of service portions. The instances of the supporting service each include of the service portions. The instances of the supporting service are partitioned into a plurality of slices. Each instance is partitioned to include one or more of the slices, and each slice of an instance includes one or more of the service portions. A software update is deployed to the instances by applying the software update to the slices in a sequence such that the software update is applied to a same slice in parallel across the instances containing that same slice before being applied to a next slice, and waiting a wait time before applying the software domain to a next slice in the sequencing.

Abstract: Methods, systems, and apparatuses manage rolling out of updates in a network-accessible server infrastructure which operates a plurality of instances of a supporting service. The supporting service is comprised by a plurality of service portions. The instances of the supporting service each include of the service portions. The instances of the supporting service are partitioned into a plurality of slices. Each instance is partitioned to include one or more of the slices, and each slice of an instance includes one or more of the service portions. A software update is deployed to the instances by applying the software update to the slices in a sequence such that the software update is applied to a same slice in parallel across the instances containing that same slice before being applied to a next slice, and waiting a wait time before applying the software domain to a next slice in the sequencing.

Abstract: Methods, systems, and apparatuses manage rolling out of updates in a network-accessible server infrastructure which operates a plurality of instances of a supporting service. The supporting service is comprised by a plurality of service portions. The instances of the supporting service each include of the service portions. The instances of the supporting service are partitioned into a plurality of slices. Each instance is partitioned to include one or more of the slices, and each slice of an instance includes one or more of the service portions. A software update is deployed to the instances by applying the software update to the slices in a sequence such that the software update is applied to a same slice in parallel across the instances containing that same slice before being applied to a next slice, and waiting a wait time before applying the software domain to a next slice in the sequencing.

Abstract: Methods, systems, and apparatuses manage rolling out of updates in a network-accessible server infrastructure which operates a plurality of instances of a supporting service. The supporting service is comprised by a plurality of service portions. The instances of the supporting service each include of the service portions. The instances of the supporting service are partitioned into a plurality of slices. Each instance is partitioned to include one or more of the slices, and each slice of an instance includes one or more of the service portions. A software update is deployed to the instances by applying the software update to the slices in a sequence such that the software update is applied to a same slice in parallel across the instances containing that same slice before being applied to a next slice, and waiting a wait time before applying the software domain to a next slice in the sequencing.

Abstract: Methods, systems, apparatuses, and computer program products are provided that enable the automated deployment of microservices to a network-accessible server set. The automated deployment may be based on constraint(s) that are specified by a declarative deployment model that is associated with the microservice to be deployed. For example, a centralized deployment orchestrator may receive microservice(s) and their associated declarative deployment model(s). The deployment orchestrator analyzes the declarative deployment model(s) and determines which microservice(s) are to be deployed based on the constraint(s) specified by the declarative deployment model(s). The foregoing techniques advantageously determine when to deploy microservice(s), while also minimizing human intervention typically required to deploy microservice(s).

Abstract: Systems, methods and computer program products are described herein that can be used to help achieve a safe rollout of software in a production datacenter environment. In accordance with certain embodiments, cloud services requests from certain users of a cloud services system (e.g., users that are authorized to receive cloud services via computing devices running test versions of infrastructure software) are dynamically matched to clusters (groups of commonly-managed computing devices called nodes) that are capable of providing the requested services on nodes running test versions of infrastructure software. Within such clusters, the requested services are provided to the users on a subset of cluster nodes that run a test version of an infrastructure software component, while the remaining cluster nodes are not running the particular test version.

Abstract: In one embodiment, to determine what tasks may be offloaded to a peripheral hardware device (e.g., to be performed in hardware on the peripheral device, rather than on the CPU(s) of the host computer), an indication from the at least one peripheral hardware device may be provided, without the peripheral hardware device first being queried to determine the task offload capabilities provided by the peripheral hardware device. In one embodiment, a large packet that includes a plurality of extension headers may be offloaded to the peripheral hardware device for segmentation. An indication of the offset where the extension headers end may be provided in connection with the large packet. In another embodiment, a packet with extension headers that come before an encryption header in the packet are not offloaded to peripheral hardware device for encryption, while packets with no extension headers before the encryption header may be offloaded.

Abstract: Software updates within one or more regions of a multi-tenant cloud are coordinated. Tenant vs. tenant conflicts, tenant vs. infrastructure provider conflicts, and conflicts between security and another priority are identified and resolved using a shared update coordinator, update priority specifications, and availability specifications. An infrastructure update request may be presented to tenants for approval. Postponed infrastructure updates may be prioritized higher. Preventing exploits of zero-day vulnerabilities may be prioritized over meeting availability targets. Updates may be merged to reduce downtime, even when the updates originate from independently controlled entities. Maximum downtime, minimum fault domains, minimum virtual machines, permitted update start times, and other availability criteria may be specified. Updates may be preempted, or allowed to complete, based on their relative priorities.

Abstract: A method and system are provided for adding, removing, and managing a plurality of network policy filters in a network device. Filters are installed in a framework and designated as active or disabled. Each filter has a priority. When a new filter is to be installed into the framework, it is compared to installed filters to determine if a conflict exists. If no conflict exists, the new filter is added as an active filter. If a conflict exists, a higher priority conflicting filter is added as active and a lower priority filter is added as inactive.

Abstract: In one embodiment, to determine what tasks may be offloaded to a peripheral hardware device (e.g., to be performed in hardware on the peripheral device, rather than on the CPU(s) of the host computer), an indication from the at least one peripheral hardware device may be provided, without the peripheral hardware device first being queried to determine the task offload capabilities provided by the peripheral hardware device. In one embodiment, a large packet that includes a plurality of extension headers may be offloaded to the peripheral hardware device for segmentation. An indication of the offset where the extension headers end may be provided in connection with the large packet. In another embodiment, a packet with extension headers that come before an encryption header in the packet are not offloaded to peripheral hardware device for encryption, while packets with no extension headers before the encryption header may be offloaded.

Abstract: In one embodiment, to determine what tasks may be offloaded to a peripheral hardware device (e.g., to be performed in hardware on the peripheral device, rather than on the CPU(s) of the host computer), an indication from the at least one peripheral hardware device may be provided, without the peripheral hardware device first being queried to determine the task offload capabilities provided by the peripheral hardware device. In one embodiment, a large packet that includes a plurality of extension headers may be offloaded to the peripheral hardware device for segmentation. An indication of the offset where the extension headers end may be provided in connection with the large packet. In another embodiment, a packet with extension headers that come before an encryption header in the packet are not offloaded to peripheral hardware device for encryption, while packets with no extension headers before the encryption header may be offloaded.

Abstract: A method and system are provided for adding, removing, and managing a plurality of network policy filters in a network device. Filters are installed in a framework and designated as active or disabled. Each filter has a priority. When a new filter is to be installed into the framework, it is compared to installed filters to determine if a conflict exists. If no conflict exists, the new filter is added as an active filter. If a conflict exists, a higher priority conflicting filter is added as active and a lower priority filter is added as inactive.

Abstract: A method and system are provided for adding, removing, and managing a plurality of network policy filters in a network device. Filters are installed in a framework and designated as active or disabled. Each filter has a priority. When a new filter is to be installed into the framework, it is compared to installed filters to determine if a conflict exists. If no conflict exists, the new filter is added as an active filter. If a conflict exists, a higher priority conflicting filter is added as active and a lower priority filter is added as inactive.

Abstract: A method and system are provided for adding, removing, and managing a plurality of network policy filters in a network device. Filters are installed in a framework and designated as active or disabled. Each filter has a priority. When a new filter is to be installed into the framework, it is compared to installed filters to determine if a conflict exists. If no conflict exists, the new filter is added as an active filter. If a conflict exists, a higher priority conflicting filter is added as active and a lower priority filter is added as inactive.