Abstract: Techniques for transferring data to a secure computing region that is isolated from any public networks is disclosed. In some embodiments, one or more artifacts for the secure computing region are packaged. As part of the packaging, one or more data packets and metadata for the one or more artifacts can be generated. The metadata indicates corresponding destination components for the one or more artifacts within the secure computing region. The data packet(s) are received and transmitted by a first data diode endpoint device. The first data diode endpoint device is configured to transmit data to the secure computing region via a second data diode endpoint device, the second data diode endpoint device being configured to restrict data from being transmitted to a destination outside of the secure computing region. The transmission of the one or more data packets may be monitored by the system.

Abstract: Techniques are disclosed for managing dependencies in an orchestration service. A computer-implemented method can include operations performed by a declarative infrastructure provisioner (DIP). In some embodiments, the DIP parses configuration data associated with a computing system and generates a directed acyclic graph (DAG) for booting a first resource. The DAG may specify a dependency of the first resource on a capability of a second resource. The DIP may traverse the DAG and determine, based at least in part on the traversal, that the dependency has been reached. The DIP may publish, to a scheduling process, an indication that the first resource is awaiting availability of the capability of the second resource. In some embodiments, the DIP receives a subsequent indication that the capability is available, regenerates the DAG, and recommences traversal of the DAG. Additional operations for booting the first resource may be performed in accordance with the recommenced traversal.

Abstract: Techniques for transferring data to a secure computing region that is isolated from any public networks is disclosed. In some embodiments, one or more artifacts for the secure computing region are packaged. As part of the packaging, one or more data packets and metadata for the one or more artifacts can be generated. The metadata indicates corresponding destination components for the one or more artifacts within the secure computing region. The data packet(s) are received and transmitted by a first data diode endpoint device. The first data diode endpoint device is configured to transmit data to the secure computing region via a second data diode endpoint device, the second data diode endpoint device being configured to restrict data from being transmitted to a destination outside of the secure computing region. The transmission of the one or more data packets may be monitored by the system.

Abstract: Techniques described herein are directed toward a counter hash generation scheme. One embodiment includes a method for counter hash generation. The method includes a device receiving an instruction to transmit an artifact from a source system to a target system, the artifact comprising a plurality of blocks. The device receives a block from the source system. The device generates an initialization vector based at least in part on the artifact. The device generates a nonce based at least in part on the initialization vector and a block value, each block being assigned a respective block value by a counter. The device generates a combined data instance based at least in part on a combination of the nonce, data of the block, and a length of the block. The device generates a hash of the combined data instance. The device transmits the hash and the block to the target system.

Abstract: Techniques are disclosed for managing dependencies in an orchestration service. A computer-implemented method can include operations performed by a declarative infrastructure provisioner (DIP). In some embodiments, the DIP parses configuration data associated with a computing system and generates a directed acyclic graph (DAG) for booting a first resource. The DAG may specify a dependency of the first resource on a capability of a second resource. The DIP may traverse the DAG and determine, based at least in part on the traversal, that the dependency has been reached. The DIP may publish, to a scheduling process, an indication that the first resource is awaiting availability of the capability of the second resource. In some embodiments, the DIP receives a subsequent indication that the capability is available, regenerates the DAG, and recommences traversal of the DAG. Additional operations for booting the first resource may be performed in accordance with the recommenced traversal.

Abstract: Techniques are described for performing an automated region build. An orchestration service (e.g., a Multi-Flock Orchestrator) may managing bootstrapping efforts for any suitable number of services within a region corresponding to one or more data centers. Each service can be associated with a respective set of resources (e.g., infrastructure components, software artifacts, etc.). The orchestration service can identify dependencies between services based on corresponding configuration files associated with the services. The orchestration service can determine, based on the identified dependencies, an order by which operations for bootstrapping the services are to be performed. The orchestration service can incrementally instruct other system components (e.g., a provisioning and deployment manager) to perform operations for bootstrapping the plurality of services in accordance with determined order.

Abstract: Techniques are disclosed for managing dependencies in an orchestration service. A computer-implemented method can include operations performed by a declarative infrastructure provisioner (DIP). In some embodiments, the DIP parses configuration data associated with a computing system and generates a directed acyclic graph (DAG) for booting a first resource. The DAG may specify a dependency of the first resource on a capability of a second resource. The DIP may traverse the DAG and determine, based at least in part on the traversal, that the dependency has been reached. The DIP may publish, to a scheduling process, an indication that the first resource is awaiting availability of the capability of the second resource. In some embodiments, the DIP receives a subsequent indication that the capability is available, regenerates the DAG, and recommences traversal of the DAG. Additional operations for booting the first resource may be performed in accordance with the recommenced traversal.

Abstract: Techniques are described for automating the creating, provisioning, and deployment of resources and infrastructure for building a data center that is configured to provide a set of services. Techniques are described for scheduling and executing multiple releases for a service. For a service for which a first release has been previously scheduled and executed, a second release may be scheduled for the service in response to an optional capability dependency for the service being published in a data center. The second release for the flock is then executed. As a result of the execution of the second release, additional enhanced capabilities may be added to the service.

Abstract: Techniques for implementing an infrastructure orchestration service are described. In some examples, a declarative provisioner of the infrastructure orchestration service receives instructions for deployment of a resource. The declarative provisioner identifies that the deployment of the resource is a long-running task stores state information corresponding to the deployment of the resource. In certain embodiments, upon identifying that the deployment of the resource is a long-running task, the declarative provisioner pauses its execution of the long-running task. Responsive to a trigger received from the infrastructure orchestration service, the declarative provisioner resumes execution of the deployment of the resource using the state information and transmits deployment information corresponding to the deployment of the resource to the infrastructure orchestration service.

Abstract: Techniques are described for identifying resources within a region of a cloud-computing environment. A Resource Identification Service (RIS) may be configured to obtain a flock configuration file comprising resource discovery data associated with a service. The resource discovery data may indicate a set of parameters with which a previously existing resource of the cloud-computing environment is to be identified. RIS may execute operations to identify the previously existing resource based at least in part on matching attributes associated with previously existing resource to the set of parameters of the resource discovery data. The RIS may identify, from the flock configuration file, a set of import operations to perform to obtain an identifier corresponding to the previously existing resource. The identifier may be provided to cause the previously existing resource to be utilized in a region build.

Abstract: Techniques are described for performing an automated region build. An orchestration service (e.g., a Multi-Flock Orchestrator (MFO)) may be configured to bootstrap any suitable number of services within a region corresponding to one or more data centers. Each service can be associated with a respective set of resources (e.g., infrastructure components to be provisioned, software artifacts to be deployed, etc.). The WO can obtain configuration files corresponding to the services to be bootstrapped and perform a static analysis the configuration files to identify one or more dependencies between the services. Circular dependencies can be identified and resolved before region build. A graph may be generated that maintains the dependencies identified and indicates a corresponding order with which bootstrapping tasks are to be performed. The WO may traverse the graph to incrementally instruct, according to the identified dependencies, a provisioning and deployment manager to bootstrap services in the region.

Abstract: A test environment is provided for testing of a flock configuration. A configuration file of a service is parsed to identify one or more capabilities for executing a release of the configuration file of the service. The one or more capabilities correspond to operations performed with respect to one or more resource types. A capability-aware-proxy server included in the test environment is configured based on the one or more capabilities identified from the configuration file of the service. The release of the configuration file of the service is executed in the test environment in accordance with the configured capability aware-proxy server. The capability aware-proxy server generates a response message corresponding to an execution result of the release of the configuration file of the service.

Abstract: Techniques are described for identifying resources within a region of a cloud-computing environment. A Resource Identification Service (RIS) may be configured to obtain a flock configuration file comprising resource discovery data associated with a service. The resource discovery data may indicate a set of parameters with which a previously existing resource of the cloud-computing environment is to be identified. RIS may execute operations to identify the previously existing resource based at least in part on matching attributes associated with previously existing resource to the set of parameters of the resource discovery data. The RIS may identify, from the flock configuration file, a set of import operations to perform to obtain an identifier corresponding to the previously existing resource. The identifier may be provided to cause the previously existing resource to be utilized in a region build.

Abstract: Techniques are described for performing an automated region build using a version set that identifies versions of configuration files and/or artifacts with which the region build is to be performed. A Multi-Flock Orchestrator (MFO) may be configured to maintain multiple version sets identifying a respective set of configuration files associated with various services to be bootstrapped. The MFO may execute a validation process using one version set. A second version set may be identified from the first based on identifying configuration files that successfully passed the validation process. The automated region build can be performed using the second version set.

Abstract: Techniques are described for identifying resources within a region of a cloud computing environment that may be leveraged during a region build. A Multi-Flock Orchestrator (MFO) may be configured to obtain configuration files corresponding to services to be bootstrapped within the region during a region build process. MFO may determine an order by which the services are to be bootstrapped and transmits a first request in accordance with the order. Planning data may be received (e.g., indicating an intent to create a new resource). MFO may obtain (e.g., via a Resource Identification Service) an identifier corresponding to a previously created resource. MFO can modify the planning data with the identifier and transmits a second request comprising the modified planning data. Transmitting the second request can cause resource corresponding to the flock configuration file to be bootstrapped within the region using the resource corresponding to the identifier.

Abstract: Techniques for implementing an infrastructure orchestration service are described. In some examples, a declarative provisioner of the infrastructure orchestration service receives instructions for deployment of a resource. The declarative provisioner identifies that the deployment of the resource is a long-running task stores state information corresponding to the deployment of the resource. In certain embodiments, upon identifying that the deployment of the resource is a long-running task, the declarative provisioner pauses its execution of the long-running task. Responsive to a trigger received from the infrastructure orchestration service, the declarative provisioner resumes execution of the deployment of the resource using the state information and transmits deployment information corresponding to the deployment of the resource to the infrastructure orchestration service.

Abstract: Techniques for implementing an infrastructure orchestration service are described. In some examples, a declarative provisioner of the infrastructure orchestration service receives instructions for deployment of a resource. The declarative provisioner identifies that the deployment of the resource is a long-running task stores state information corresponding to the deployment of the resource. In certain embodiments, upon identifying that the deployment of the resource is a long-running task, the declarative provisioner pauses its execution of the long-running task. Responsive to a trigger received from the infrastructure orchestration service, the declarative provisioner resumes execution of the deployment of the resource using the state information and transmits deployment information corresponding to the deployment of the resource to the infrastructure orchestration service.

Abstract: Techniques are disclosed for managing dependencies in an orchestration service. A computer-implemented method can include operations performed by a declarative infrastructure provisioner (DIP). In some embodiments, the DIP parses configuration data associated with a computing system and generates a directed acyclic graph (DAG) for booting a first resource. The DAG may specify a dependency of the first resource on a capability of a second resource. The DIP may traverse the DAG and determine, based at least in part on the traversal, that the dependency has been reached. The DIP may publish, to a scheduling process, an indication that the first resource is awaiting availability of the capability of the second resource. In some embodiments, the DIP receives a subsequent indication that the capability is available, regenerates the DAG, and recommences traversal of the DAG. Additional operations for booting the first resource may be performed in accordance with the recommenced traversal.

Abstract: Techniques for implementing an infrastructure orchestration service are described. In some examples, a declarative provisioner of the infrastructure orchestration service receives instructions for deployment of a resource. The declarative provisioner identifies that the deployment of the resource is a long-running task stores state information corresponding to the deployment of the resource. In certain embodiments, upon identifying that the deployment of the resource is a long-running task, the declarative provisioner pauses its execution of the long-running task. Responsive to a trigger received from the infrastructure orchestration service, the declarative provisioner resumes execution of the deployment of the resource using the state information and transmits deployment information corresponding to the deployment of the resource to the infrastructure orchestration service.

Abstract: Techniques for transferring data to a secure computing region that is isolated from any public networks is disclosed. In some embodiments, one or more artifacts for the secure computing region are packaged. As part of the packaging, one or more data packets and metadata for the one or more artifacts can be generated. The metadata indicates corresponding destination components for the one or more artifacts within the secure computing region. The data packet(s) are received and transmitted by a first data diode endpoint device. The first data diode endpoint device is configured to transmit data to the secure computing region via a second data diode endpoint device, the second data diode endpoint device being configured to restrict data from being transmitted to a destination outside of the secure computing region. The transmission of the one or more data packets may be monitored by the system.