Abstract: Computer-implemented methods, media, and systems for automating secured deployment of containerized workloads on edge devices are disclosed. One example computer-implemented method includes receiving, by a software defined wide area network (SD-WAN) edge device and from a remote manager, resource quotas for a compute service to be enabled at the SD-WAN edge device. Pre-deployment sanity checks are performed by confirming availability of resources satisfying the resource quotas, where the resources are at the SD-WAN edge device. In response to the confirmation of the availability of resources satisfying the resource quotas, one or more security constructs are set up to isolate SD-WAN network functions at the SD-WAN edge device from the compute service at the SD-WAN edge device. The compute service is attached to a SD-WAN network by the SD-WAN edge device. An acknowledgement that the compute service is enabled at the SD-WAN edge device is sent to the remote manager.

Abstract: Aspects of providing an excess capacity grid for artificial intelligence, machine learning, and lower-priority processes are described. A grid orchestration client is installed on a virtual machine or a physical device that performs a production workload for an enterprise. The grid orchestration client communicates with a grid orchestration server as part of an excess capacity grid that performs grid workloads. A request to execute a grid workload is received. The grid orchestration client causes the grid workload to be executed.

Abstract: The present disclosure relates to workload placement responsive to fault. One embodiment includes instructions to remove a first host from a first cluster of a software-defined datacenter (SDDC) responsive to a determination of a fault in a hypervisor of the first host, place the first host into a second cluster of the SDDC, wherein the second cluster is designated to run stateless workloads, and add a second host to the first cluster.

Abstract: Systems and methods for setting virtual machines (“VMs”) to desired configurations while the virtual machines are running. In some systems, a user can select a VM and a desired configuration. An agent can then set an attribute of the virtual machine to indicate that on guest operation system (“OS”) reboot of the VM, the VM will enter BIOS mode. The agent can also store the desired configuration in the database based on authenticating the user. When the VM reboots at a future time, the attribute can cause the VM to enter BIOS setup. The agent can be notified and can retrieve the desired configuration from a database using an identifier for the VM. Then the agent can apply the desired configuration to the VM during BIOS setup with a system process that does not require further user authentication.

Abstract: Disclosed are examples of a system that publishes metadata to a blockchain network. The metadata can contain properties of data generated by a system. The metadata can allow for other entities to validate or trust the data generated by the system. The metadata can include data attributes that profile the data.

Abstract: Disclosed are various embodiments for binding the configuration state of client devices to the blockchain and utilizing the binding for managing compliance. A management agent can send a request to a smart contract hosted by a blockchain network for a configuration state for a computing device, the state including data sovereignty and governance policies of the computing device. The management agent can update the configuration of the computing device based upon the configuration state obtained from the blockchain network.

Abstract: The present disclosure relates to workload placement responsive to fault. One embodiment includes instructions to remove a first host from a first cluster of a software-defined datacenter (SDDC) responsive to a determination of a fault in a hypervisor of the first host, place the first host into a second cluster of the SDDC, wherein the second cluster is designated to run stateless workloads, and add a second host to the first cluster.

Abstract: Aspects of providing an excess capacity grid for artificial intelligence, machine learning, and lower-priority processes are described. A grid orchestration client is installed on a virtual machine or a physical device that performs a production workload for an enterprise. The grid orchestration client communicates with a grid orchestration server as part of an excess capacity grid that performs grid workloads. A request to execute a grid workload is received. The grid orchestration client causes the grid workload to be executed.

Abstract: Disclosed are various embodiments for binding the configuration state of client devices to the blockchain and utilizing the binding for managing cryptographic compliance. A management agent can send a request to a smart contract hosted by a blockchain network for a zero-knowledge proof (ZKP) of a configuration state for a computing device, the state including cryptographic policies. Cryptographic operations performed by the client device can be performed by complying with the policies stored on the blockchain network.

Abstract: Disclosed are various embodiments for binding the configuration state of client devices to the blockchain. A management agent can send a request to a smart contract hosted by a blockchain network for a configuration state for the computing device, the request comprising a device identifier for the computing device. The management agent can then receive the configuration state from the smart contract and apply the configuration state to the computing device.

Abstract: Computer-implemented methods, media, and systems for inter-cluster automated failover and migration of containerized workloads across edges devices are disclosed. One example method includes monitoring telemetry data received from a first software defined wide area network (SD-WAN) edge device that has a workload scheduled, where the telemetry data includes at least one of a health status of the workload or multiple runtime context elements at the first SD-WAN edge device. It is determined that a failure associated with either the first SD-WAN edge device or the workload occurs. A mode of the failure is determined. A remediation process based on the determined mode of the failure and a current state of the workload is performed.

Abstract: Computer-implemented methods, media, and systems for remediation of containerized workloads based on context breach at edge devices are disclosed. One example computer-implemented method includes monitoring telemetry data from a first software defined wide area network (SD-WAN) edge device, where the telemetry data includes multiple context elements at the first SD-WAN edge device. It is determined that a context change occurs for at least one of the context elements at the first SD-WAN edge device. It is determined that due to the context change, the first SD-WAN edge device does not satisfy one or more requirements for running one or more workloads scheduled to run. In response to the determination that the first SD-WAN edge device does not satisfy the one or more requirements, the at least one of the one or more workloads is offloaded from the first SD-WAN edge device to a second SD-WAN edge device.

Abstract: Computer-implemented methods, media, and systems for inter-cluster automated failover and migration of containerized workloads across edges devices are disclosed. One example method includes monitoring telemetry data received from a first software defined wide area network (SD-WAN) edge device that has a workload scheduled, where the telemetry data includes at least one of a health status of the workload or multiple runtime context elements at the first SD-WAN edge device. It is determined that a failure associated with either the first SD-WAN edge device or the workload occurs. A mode of the failure is determined. A remediation process based on the determined mode of the failure and a current state of the workload is performed.

Abstract: Computer-implemented methods, media, and systems for automating secured deployment of containerized workloads on edge devices are disclosed. One example computer-implemented method includes receiving, by a software defined wide area network (SD-WAN) edge device and from a remote manager, resource quotas for a compute service to be enabled at the SD-WAN edge device. Pre-deployment sanity checks are performed by confirming availability of resources satisfying the resource quotas, where the resources are at the SD-WAN edge device. In response to the confirmation of the availability of resources satisfying the resource quotas, one or more security constructs are set up to isolate SD-WAN network functions at the SD-WAN edge device from the compute service at the SD-WAN edge device. The compute service is attached to a SD-WAN network by the SD-WAN edge device. An acknowledgement that the compute service is enabled at the SD-WAN edge device is sent to the remote manager.

Abstract: Computer-implemented methods, media, and systems for context based meta scheduling of containerized workloads across edge devices are disclosed. One example computer-implemented method includes receiving a manifest file that includes multiple context requirements of a workload, where the multiple context requirements include multiple runtime service level agreement (SLA) requirements of the workload. Telemetry data is received from multiple software defined wide area network (SD-WAN) edge devices, where the telemetry data includes respective context data of each of the multiple SD-WAN edge devices. A SD-WAN edge device is selected, based on the telemetry data and the multiple context requirements of the workload, from the multiple SD-WAN edge devices for placing the workload on the selected SD-WAN edge device, where the context data of the selected SD-WAN edge device meets the multiple context requirements of the workload. The workload is run on the selected SD-WAN edge device.

Abstract: In one set of embodiments, a computer system can determine that one or more attacks have been or are in the process of being perpetrated against an anomaly detection system, where the anomaly detection system comprises a set of machine learning (ML) models trained to detect anomalous application programming interface (API) call behavior in a microservice-based application based on API call traces collected from the application. In response to this determination, the computer system can initiate one or more actions for securing the anomaly detection system against the one or more attacks.

Abstract: Computer-implemented methods, media, and systems for remediation of containerized workloads based on context breach at edge devices are disclosed. One example computer-implemented method includes monitoring telemetry data from a first software defined wide area network (SD-WAN) edge device, where the telemetry data includes multiple context elements at the first SD-WAN edge device. It is determined that a context change occurs for at least one of the context elements at the first SD-WAN edge device. It is determined that due to the context change, the first SD-WAN edge device does not satisfy one or more requirements for running one or more workloads scheduled to run. In response to the determination that the first SD-WAN edge device does not satisfy the one or more requirements, the at least one of the one or more workloads is offloaded from the first SD-WAN edge device to a second SD-WAN edge device.

Abstract: The current document is directed to a resource-exchange system that facilitates resource exchange and sharing among computing facilities. The currently disclosed methods and systems employ efficient, distributed-search methods and subsystems within distributed computer systems that include large numbers of geographically distributed data centers to locate resource-provider computing facilities that match the resource needs of resource-consumer computing-facilities based on attribute values associated with the needed resources, the resource providers, and the resource consumers. The resource-exchange system organizes and tracks operations related to a resource exchange using a resource-exchange context.

Abstract: The current document is directed a resource-exchange system that facilitates resource exchange and sharing among computing facilities. The currently disclosed methods and systems employ efficient, distributed-search-based auction methods and subsystems within distributed computer systems that include large numbers of geographically distributed data centers to locate resource-provider computing facilities that match the resource needs of resource-consumer computing facilities. In one implementation, resource-provider computing facilities automatically generate hosting fees for hosting computational-resources-consuming entities on behalf of resource-consumer computing facilities that are included in bid-response messages returned by the resource-provider computing facilities in response to receiving bid-request messages. In another implementation, a cloud-exchange system automatically generates hosting fees on behalf of resource-provider computing facilities.

Abstract: Examples described herein include systems and methods for setting virtual machines (“VMs”) to desired configurations while the virtual machines are running. In one example, a user can select a VM and a desired configuration. An agent can then set an attribute of the virtual machine to indicate that on guest operation system (“OS”) reboot of the VM, the VM will enter BIOS mode. The agent can also store the desired configuration in the database based on authenticating the user. When the VM reboots at a future time, the attribute can cause the VM to enter BIOS setup. The agent can be notified and can retrieve the desired configuration from a database using an identifier for the VM. Then the agent can apply the desired configuration to the VM during BIOS setup with a system process that does not require further user authentication.