Abstract: Techniques for providing effective utilization of different drive capacities in storage appliances. The techniques include providing a storage drive array that has a first set of storage drives and a second set of storage drives. Each storage drive in the first set has a first drive capacity and each storage drive in the second set has a second drive capacity. The first drive capacity is higher than the second drive capacity. The techniques include allocating, within the first drive capacity, at least a first sub-capacity and a second sub-capacity. The first sub-capacity is equal to the second drive capacity. The techniques include placing blocks of hot data in the first sub-capacities of the storage drives in the first set and/or the second drive capacities of the storage drives in the second set, and placing blocks of cold data in the second sub-capacities of the storage drives in the first set.

Abstract: A disclosed method provides a structured definition for a distributed application comprising two or more component applications. The definition may identify each component and a component type, e.g. VM or container, collocation information indicative of collocation requirements for one or more of the components, and external dependency information indicating constraints the alternative environment must comply with. The distributed application may be deployed to one or more endpoints. Responsive to detecting a triggering event for evaluation of component relocation alternatives, disclosed methods may invoke a resource balancing engine to identify a viable alternative endpoint for one or more component applications. Responsive to identifying a viable alternative endpoint for a particular component application, disclosed methods may relocate the particular component application to the alternative endpoint.

Abstract: A disclosed method for providing a non-credentialed user (NCU) with secure access to a remote endpoint of an edge computing platform, generates a support voucher for the NCU wherein the support voucher comprises a temporary ownership voucher including one or more digital signatures establishing a chain of trust from a root of trust to the NCU. The method provides a private key associated with the support voucher to the NCU. Responsive to detecting the NCU, using the private key to log into an edge platform resource and determining that the support voucher is recognized by the edge platform resource, the NCU is authenticated and the support voucher is validated to establish the NCU as a designated owner of the remote endpoint. Responsive to establishing the NCU as a designated owner, the NCU may access the edge platform resource and from there access the platform endpoint.

Abstract: A disclosed edge computing platform includes an edge orchestrator (EO) and one or more distributed endpoints. The EO includes an edge proxy, an edge control plane resource, and a service mesh. The service mesh includes a plurality of services, each of which is paired with a corresponding Envoy proxy. The edge proxy communicatively couples the service mesh to a mesh communication tunnel. The edge control plane resource is configured to enable secure routing based on edge estate data maintained in an external store and ownership authorization data in accordance with a suitable authentication technology (e.g. FDO). Each distributed endpoint includes a downstream connectivity module (DCM) including a DCM proxy coupling the distributed endpoint to the mesh communication tunnel. The distributed endpoints may include edge compute endpoints and external compute fabrics. Disclosed teachings enable secure service-to-service communication across the entire edge estate irrespective of types and location of services.

Abstract: A method for managing remote Kubernetes clusters employs a central orchestrator with cluster integration interfaces for one or more managed Kubernetes platforms. A cluster of interest is selected via one of the interfaces and a connection with the applicable platform is registered. The registered connection may include platform account credentials and cluster admin role information to an authenticated cluster-admin role defined for the platform. A platform-specific microservice (PSM), provisioned with platform-specific logic and tooling, is instantiated. The PSM retrieves an administrative manifest including one or more administrative pods enabling the central orchestrator to communicate securely with the platform and deploy and manage application workloads on the cluster.

Abstract: Techniques are provided for deploying virtual machines to a virtualization management environment using an agent component to obtain remote virtual machine templates. One method comprises receiving, by an agent component executing in a virtualization management server, a request to deploy a virtual machine and a storage location of a template for the virtual machine; obtaining the template for the virtual machine from one or more of an orchestration engine and a remote data source identified by the storage location; and replicating the obtained template for the virtual machine to create the virtual machine. The request to deploy the virtual machine may also comprise deployment information used to configure the virtual machine. The agent component may monitor an execution of the created virtual machine and evaluate one or more policies provided by the orchestration engine with respect to security controls and/or network requirements associated with the created virtual machine.

Abstract: Techniques are provided for resource scheduling of multiple application types in a heterogeneous endpoint device. One method comprises monitoring an execution of applications on a heterogeneous endpoint device, wherein the applications are of different application types and the heterogeneous endpoint device comprises multiple application runtime systems each supporting a different one of the different application types; and initiating an adjustment of an allocation of resources, provided by the heterogeneous endpoint device, assigned to at least one of the applications based on: (i) a current resource utilization of one or more of the applications, (ii) a priority assigned to one or more of the applications and/or (iii) a resource threshold value assigned to one or more of the applications. A global scheduling engine may: (i) monitor multiple endpoint devices and/or (ii) deploy one or more applications to at least one endpoint device based on resource consumption information from the endpoint devices.

Abstract: A voucher management system receives, from a computing device manufacturer system, an ownership voucher that transfers ownership of a computing device from the computing device manufacturer system to the voucher management system, and a hardware attestation certificate for the computing device, and associates them with the computing device in a voucher management database. When the voucher management system determines that the ownership of the computing device should be transferred to an end user system, it automatically generates second ownership transfer data by signing an end user system public key with a voucher management system private key, provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the end user system, and provides the ownership voucher and the hardware attestation certificate to the end user system.

Abstract: A networked system includes a first owner system and a second owner system coupled to a voucher management system. The voucher management system receives, from the first owner system, an ownership voucher having first ownership transfer data including a voucher management system public key that has been signed by a first owner system private key in order to transfer ownership of a computing device from the first owner system to the voucher management system. The voucher management system determines that the ownership of the computing device should be transferred to the second owner system and, in response, automatically generates second ownership transfer data by signing a second owner system public key with a voucher management system private key, and provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the second owner system.

Abstract: A FDO protocol computing device ordering/manufacturing system includes a computing device manufacturer system coupled to a voucher management system. The computing device manufacturer system identifies, as part of an ordering process for a computing device being ordered by a subsequent owner, rendezvous system reachability information for a rendezvous system. The computing device manufacturer system provides the rendezvous system reachability information in the computing device prior to its transfer to the subsequent owner.

Abstract: Techniques are provided for deploying services to multiple public clouds using cloud-specific encapsulated communication logic. One method comprises performing, in response to a request associated with a given public cloud of multiple public clouds having corresponding encapsulated communication logic for communicating with the respective public cloud: obtaining an image for the encapsulated communication logic for the given public cloud; instantiating an orchestration service for the given public cloud using the image for the encapsulated communication logic for the given public cloud, wherein the instantiated orchestration service for the given public cloud makes a connection to an endpoint of the given public cloud using the encapsulated communication logic for the given public cloud; and processing a request to create a service in the given public cloud using the instantiated orchestration service for the given public cloud as a connection gateway to the given public cloud.

Abstract: A data storage system in which data storage space for storing data storage metadata is selectively allocated from non-volatile data storage devices contained in a first storage enclosure. The first storage enclosure is directly connected to at least one storage processor of the data storage system, and the data storage system further includes at least one secondary storage enclosure that is indirectly connected to the storage processor. Data storage metadata is generated within the data storage system, and the data storage metadata generated within the data storage system is stored into the data storage space that was selectively allocated for storing data storage metadata from the non-volatile data storage devices contained in the first storage enclosure.

Abstract: Techniques for providing effective utilization of different drive capacities in storage appliances. The techniques include providing a storage drive array that has a first set of storage drives and a second set of storage drives. Each storage drive in the first set has a first drive capacity and each storage drive in the second set has a second drive capacity. The first drive capacity is higher than the second drive capacity. The techniques include allocating, within the first drive capacity, at least a first sub-capacity and a second sub-capacity. The first sub-capacity is equal to the second drive capacity. The techniques include placing blocks of hot data in the first sub-capacities of the storage drives in the first set and/or the second drive capacities of the storage drives in the second set, and placing blocks of cold data in the second sub-capacities of the storage drives in the first set.

Abstract: Host data stored in one or more source physical extents of non-volatile data storage is identified as valid and determined to be infrequently written by host I/O requests, and is therefore compressed to generate a highly compressed version of the valid host data. The highly compressed version is then stored into at least one target physical extent. The valid host data may be initially compressed before it is stored in the source physical extent(s), and may be re-compressed to generate the highly compressed version. If the valid host data is also infrequently read, it may be recompressed using larger blocks of host data than were used to perform the initial compression. The performance tier of the target physical extent may be different from (e.g. lower than) the performance tier of the source physical extent. The technology may be embodied in a background process such as a garbage collector.

Abstract: A data storage system (DSS) in a cluster provides virtual-volume data storage to virtual-computing (VC) hosts using NVMe-oF storage interconnect. A DSS creates protocol endpoints (PEs) and corresponding namespace groups, each being a grouping of namespaces corresponding to virtual volumes (vVols) to be bound for access by a respective VC host, and each namespace being mapped to corresponding underlying physical storage. Each namespace group is initially created with a corresponding in-band discoverable dummy namespace. In response to in-band storage discovery commands from the VC hosts, and based on the existence of the dummy namespaces, the DSS responds with responses identifying the namespace groups. Then in response to subsequent vVol creation commands from the VC hosts, the DSS creates new namespaces in respective namespace groups and provides namespace identifiers for the new namespaces to the VC hosts for use in accessing data of the vVols.

Abstract: A method, computer program product, and computer system for dividing, by a computing device, a first physical Ethernet port of a plurality of physical Ethernet ports into a plurality of partitions. A first partition of the plurality of partitions for the first Ethernet port may be assigned to a N-virtual distributed switch. A second partition of the plurality of partitions for the first Ethernet port may be assigned with a plurality of functions. Ethernet packets may be switched between the plurality of functions in the second partition.

Abstract: A method of managing storage space for a metadata consistency checking procedure (MCCP) is provided. The method includes (a) tracking an amount of metadata and an amount of user data organized by the metadata; (b) provisioning a quantity of storage dedicated to the MCCP based, at least in part, on a ratio of the amount of metadata to the amount of user data; and (c) upon initiation of the MCCP, building tracking structures within the provisioned storage dedicated to the MCCP. An apparatus, system, and computer program product for performing a similar method are also provided.

Abstract: A method of managing storage space for a metadata consistency checking procedure (MCCP) is provided. The method includes (a) tracking an amount of metadata and an amount of user data organized by the metadata; (b) provisioning a quantity of storage dedicated to the MCCP based, at least in part, on a ratio of the amount of metadata to the amount of user data; and (c) upon initiation of the MCCP, building tracking structures within the provisioned storage dedicated to the MCCP. An apparatus, system, and computer program product for performing a similar method are also provided.

Abstract: A data storage system (DSS) in a cluster provides virtual-volume data storage to virtual-computing (VC) hosts using NVMe-oF storage interconnect. A DSS creates protocol endpoints (PEs) and corresponding namespace groups, each being a grouping of namespaces corresponding to virtual volumes (vVols) to be bound for access by a respective VC host, and each namespace being mapped to corresponding underlying physical storage. Each namespace group is initially created with a corresponding in-band discoverable dummy namespace. In response to in-band storage discovery commands from the VC hosts, and based on the existence of the dummy namespaces, the DSS responds with responses identifying the namespace groups. Then in response to subsequent vVol creation commands from the VC hosts, the DSS creates new namespaces in respective namespace groups and provides namespace identifiers for the new namespaces to the VC hosts for use in accessing data of the vVols.

Abstract: A data storage system in which data storage space for storing data storage metadata is selectively allocated from non-volatile data storage devices contained in a first storage enclosure. The first storage enclosure is directly connected to at least one storage processor of the data storage system, and the data storage system further includes at least one secondary storage enclosure that is indirectly connected to the storage processor. Data storage metadata is generated within the data storage system, and the data storage metadata generated within the data storage system is stored into the data storage space that was selectively allocated for storing data storage metadata from the non-volatile data storage devices contained in the first storage enclosure.