Abstract: Techniques are provided for deploying virtual machines to a virtualization management environment using an agent component to obtain remote virtual machine templates. One method comprises receiving, by an agent component executing in a virtualization management server, a request to deploy a virtual machine and a storage location of a template for the virtual machine; obtaining the template for the virtual machine from one or more of an orchestration engine and a remote data source identified by the storage location; and replicating the obtained template for the virtual machine to create the virtual machine. The request to deploy the virtual machine may also comprise deployment information used to configure the virtual machine. The agent component may monitor an execution of the created virtual machine and evaluate one or more policies provided by the orchestration engine with respect to security controls and/or network requirements associated with the created virtual machine.

Abstract: An apparatus comprises a processing device comprising a processor coupled to a memory. The processing device is configured to receive, over a first communication channel from an orchestrator entity, at least one command specifying one or more actions to take involving an endpoint device, the one or more actions comprising at least one of writing data to a tag of a tag bridge device and reading data from the tag of the tag bridge device. The processing device is further configured to relay the at least one command to the tag of the tag bridge device over a second communication channel, the second communication channel being established between a tag interface of the processing device and the tag bridge device, wherein the tag bridge device, 10 when plugged in to a port of the endpoint device, relays the at least one command from the tag to the endpoint device.

Abstract: A voucher management system receives, from a computing device manufacturer system, an ownership voucher that transfers ownership of a computing device from the computing device manufacturer system to the voucher management system, and a hardware attestation certificate for the computing device, and associates them with the computing device in a voucher management database. When the voucher management system determines that the ownership of the computing device should be transferred to an end user system, it automatically generates second ownership transfer data by signing an end user system public key with a voucher management system private key, provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the end user system, and provides the ownership voucher and the hardware attestation certificate to the end user system.

Abstract: Methods and systems for managing distributed systems are disclosed. The distributed systems may include endpoint devices that provide computer implemented services. The configuration of the endpoint devices may impact the provided computer implemented services. To manage the configuration of the endpoint devices, a communication architecture may be used that includes tags used to relay commands between orchestration and endpoint devices, and data from the endpoint devices to the orchestration devices and/or other devices.

Abstract: A method, computer program product, and computer system for dividing a physical Ethernet port is provided. The method may include dividing, by a computing device, a first physical Ethernet port of a plurality of physical Ethernet ports into a plurality of partitions. A first partition of the plurality of partitions for the first Ethernet port may be assigned to a N-virtual distributed switch. A second partition of the plurality of partitions for the first Ethernet port may be assigned with a plurality of functions. Ethernet packets may be switched between the plurality of functions in the second partition.

Abstract: A disclosed method provides a structured definition for a distributed application comprising two or more component applications. The definition may identify each component and a component type, e.g. VM or container, collocation information indicative of collocation requirements for one or more of the components, and external dependency information indicating constraints the alternative environment must comply with. The distributed application may be deployed to one or more endpoints. Responsive to detecting a triggering event for evaluation of component relocation alternatives, disclosed methods may invoke a resource balancing engine to identify a viable alternative endpoint for one or more component applications. Responsive to identifying a viable alternative endpoint for a particular component application, disclosed methods may relocate the particular component application to the alternative endpoint.

Abstract: Techniques for providing effective utilization of different drive capacities in storage appliances. The techniques include providing a storage drive array that has a first set of storage drives and a second set of storage drives. Each storage drive in the first set has a first drive capacity and each storage drive in the second set has a second drive capacity. The first drive capacity is higher than the second drive capacity. The techniques include allocating, within the first drive capacity, at least a first sub-capacity and a second sub-capacity. The first sub-capacity is equal to the second drive capacity. The techniques include placing blocks of hot data in the first sub-capacities of the storage drives in the first set and/or the second drive capacities of the storage drives in the second set, and placing blocks of cold data in the second sub-capacities of the storage drives in the first set.

Abstract: A disclosed method provides a structured definition for a distributed application comprising two or more component applications. The definition may identify each component and a component type, e.g. VM or container, collocation information indicative of collocation requirements for one or more of the components, and external dependency information indicating constraints the alternative environment must comply with. The distributed application may be deployed to one or more endpoints. Responsive to detecting a triggering event for evaluation of component relocation alternatives, disclosed methods may invoke a resource balancing engine to identify a viable alternative endpoint for one or more component applications. Responsive to identifying a viable alternative endpoint for a particular component application, disclosed methods may relocate the particular component application to the alternative endpoint.

Abstract: A disclosed method for providing a non-credentialed user (NCU) with secure access to a remote endpoint of an edge computing platform, generates a support voucher for the NCU wherein the support voucher comprises a temporary ownership voucher including one or more digital signatures establishing a chain of trust from a root of trust to the NCU. The method provides a private key associated with the support voucher to the NCU. Responsive to detecting the NCU, using the private key to log into an edge platform resource and determining that the support voucher is recognized by the edge platform resource, the NCU is authenticated and the support voucher is validated to establish the NCU as a designated owner of the remote endpoint. Responsive to establishing the NCU as a designated owner, the NCU may access the edge platform resource and from there access the platform endpoint.

Abstract: A method for managing remote Kubernetes clusters employs a central orchestrator with cluster integration interfaces for one or more managed Kubernetes platforms. A cluster of interest is selected via one of the interfaces and a connection with the applicable platform is registered. The registered connection may include platform account credentials and cluster admin role information to an authenticated cluster-admin role defined for the platform. A platform-specific microservice (PSM), provisioned with platform-specific logic and tooling, is instantiated. The PSM retrieves an administrative manifest including one or more administrative pods enabling the central orchestrator to communicate securely with the platform and deploy and manage application workloads on the cluster.

Abstract: A disclosed edge computing platform includes an edge orchestrator (EO) and one or more distributed endpoints. The EO includes an edge proxy, an edge control plane resource, and a service mesh. The service mesh includes a plurality of services, each of which is paired with a corresponding Envoy proxy. The edge proxy communicatively couples the service mesh to a mesh communication tunnel. The edge control plane resource is configured to enable secure routing based on edge estate data maintained in an external store and ownership authorization data in accordance with a suitable authentication technology (e.g. FDO). Each distributed endpoint includes a downstream connectivity module (DCM) including a DCM proxy coupling the distributed endpoint to the mesh communication tunnel. The distributed endpoints may include edge compute endpoints and external compute fabrics. Disclosed teachings enable secure service-to-service communication across the entire edge estate irrespective of types and location of services.

Abstract: Techniques are provided for deploying virtual machines to a virtualization management environment using an agent component to obtain remote virtual machine templates. One method comprises receiving, by an agent component executing in a virtualization management server, a request to deploy a virtual machine and a storage location of a template for the virtual machine; obtaining the template for the virtual machine from one or more of an orchestration engine and a remote data source identified by the storage location; and replicating the obtained template for the virtual machine to create the virtual machine. The request to deploy the virtual machine may also comprise deployment information used to configure the virtual machine. The agent component may monitor an execution of the created virtual machine and evaluate one or more policies provided by the orchestration engine with respect to security controls and/or network requirements associated with the created virtual machine.

Abstract: Techniques are provided for resource scheduling of multiple application types in a heterogeneous endpoint device. One method comprises monitoring an execution of applications on a heterogeneous endpoint device, wherein the applications are of different application types and the heterogeneous endpoint device comprises multiple application runtime systems each supporting a different one of the different application types; and initiating an adjustment of an allocation of resources, provided by the heterogeneous endpoint device, assigned to at least one of the applications based on: (i) a current resource utilization of one or more of the applications, (ii) a priority assigned to one or more of the applications and/or (iii) a resource threshold value assigned to one or more of the applications. A global scheduling engine may: (i) monitor multiple endpoint devices and/or (ii) deploy one or more applications to at least one endpoint device based on resource consumption information from the endpoint devices.

Abstract: A voucher management system receives, from a computing device manufacturer system, an ownership voucher that transfers ownership of a computing device from the computing device manufacturer system to the voucher management system, and a hardware attestation certificate for the computing device, and associates them with the computing device in a voucher management database. When the voucher management system determines that the ownership of the computing device should be transferred to an end user system, it automatically generates second ownership transfer data by signing an end user system public key with a voucher management system private key, provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the end user system, and provides the ownership voucher and the hardware attestation certificate to the end user system.

Abstract: A networked system includes a first owner system and a second owner system coupled to a voucher management system. The voucher management system receives, from the first owner system, an ownership voucher having first ownership transfer data including a voucher management system public key that has been signed by a first owner system private key in order to transfer ownership of a computing device from the first owner system to the voucher management system. The voucher management system determines that the ownership of the computing device should be transferred to the second owner system and, in response, automatically generates second ownership transfer data by signing a second owner system public key with a voucher management system private key, and provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the second owner system.

Abstract: A FDO protocol computing device ordering/manufacturing system includes a computing device manufacturer system coupled to a voucher management system. The computing device manufacturer system identifies, as part of an ordering process for a computing device being ordered by a subsequent owner, rendezvous system reachability information for a rendezvous system. The computing device manufacturer system provides the rendezvous system reachability information in the computing device prior to its transfer to the subsequent owner.

Abstract: Techniques are provided for deploying services to multiple public clouds using cloud-specific encapsulated communication logic. One method comprises performing, in response to a request associated with a given public cloud of multiple public clouds having corresponding encapsulated communication logic for communicating with the respective public cloud: obtaining an image for the encapsulated communication logic for the given public cloud; instantiating an orchestration service for the given public cloud using the image for the encapsulated communication logic for the given public cloud, wherein the instantiated orchestration service for the given public cloud makes a connection to an endpoint of the given public cloud using the encapsulated communication logic for the given public cloud; and processing a request to create a service in the given public cloud using the instantiated orchestration service for the given public cloud as a connection gateway to the given public cloud.

Abstract: A data storage system in which data storage space for storing data storage metadata is selectively allocated from non-volatile data storage devices contained in a first storage enclosure. The first storage enclosure is directly connected to at least one storage processor of the data storage system, and the data storage system further includes at least one secondary storage enclosure that is indirectly connected to the storage processor. Data storage metadata is generated within the data storage system, and the data storage metadata generated within the data storage system is stored into the data storage space that was selectively allocated for storing data storage metadata from the non-volatile data storage devices contained in the first storage enclosure.

Abstract: Techniques for providing effective utilization of different drive capacities in storage appliances. The techniques include providing a storage drive array that has a first set of storage drives and a second set of storage drives. Each storage drive in the first set has a first drive capacity and each storage drive in the second set has a second drive capacity. The first drive capacity is higher than the second drive capacity. The techniques include allocating, within the first drive capacity, at least a first sub-capacity and a second sub-capacity. The first sub-capacity is equal to the second drive capacity. The techniques include placing blocks of hot data in the first sub-capacities of the storage drives in the first set and/or the second drive capacities of the storage drives in the second set, and placing blocks of cold data in the second sub-capacities of the storage drives in the first set.

Abstract: Host data stored in one or more source physical extents of non-volatile data storage is identified as valid and determined to be infrequently written by host I/O requests, and is therefore compressed to generate a highly compressed version of the valid host data. The highly compressed version is then stored into at least one target physical extent. The valid host data may be initially compressed before it is stored in the source physical extent(s), and may be re-compressed to generate the highly compressed version. If the valid host data is also infrequently read, it may be recompressed using larger blocks of host data than were used to perform the initial compression. The performance tier of the target physical extent may be different from (e.g. lower than) the performance tier of the source physical extent. The technology may be embodied in a background process such as a garbage collector.