Abstract: The disclosure provides an approach for backward compatibility of federated data centers. A method includes of synchronizing an object configuration includes creating an object at a global network manager, where the object is associated with one or more properties, and where each of the one or more properties is associated with a minimum virtualized networking version. The method includes determining at the global network manager a minimum compatibility version of the object that is a largest minimum virtualized networking version associated with the one or more properties. The method includes determining a span associated with the object, where the span includes one or more local network managers. The method includes, based on the minimum compatibility version and the span, synchronizing the object at each of the one or more local network managers or determining not to synchronize the object at each of the one or more local network managers.

Abstract: Some embodiments provide a method for one of multiple shared API processing services in a container cluster that implements a network policy manager shared between multiple tenants. The method receives a configuration request from a particular tenant to modify a logical network configuration for the particular tenant. Configuration requests from the plurality of tenants are balanced across the plurality of shared API processing services. Based on the received configuration request, the method posts a logical network configuration change to a configuration queue in the cluster. The configuration queue is dedicated to the logical network of the particular tenant. Services are instantiated separately in the container cluster for each tenant to distribute configuration changes from the respective configuration queues for the tenants to datacenters that implement the tenant logical networks such that configuration changes for one tenant do not slow down processing of configuration changes for other tenants.

Abstract: Some embodiments of the invention provide a method for deploying software-implemented resources in a software defined datacenter (SDDC). The method initially receives a hierarchical API command that, in a declarative format, specifies several operation requests for several software-defined (SD) resources at several resource levels of a resource hierarchy in the SDDC. The method parses the API command to identify the SD resources at the plurality of resource levels. Based on the parsed API command, the method deploys the SD resources by using a deployment process that ensures that any first SD resource on which a second SD resource depends is deployed before the second resource. In some embodiments, a second SD resource depends on a first SD resource when the second SD resource is a child of the first SD resource. Alternatively, or conjunctively, a second SD resource can also depend on a first SD resource in some embodiments when the second SD resource has some operational dependency on the first SD resource.

Abstract: Some embodiments provide a method for a management service executing within a container cluster to manage logical networks for multiple tenants. Each tenant logical network is distributed across a respective set of datacenters. The method determines that a particular datacenter of a particular tenant requires a complete synchronization of the logical network for the particular tenant. Based on the determination, the method instantiates an on-demand service to manage streaming logical network configuration data for the particular datacenter from a database in the container cluster that stores logical network configurations for each of the multiple tenants.

Abstract: Some embodiments provide a network management system for managing a logical network that spans multiple physical sites. The network management system includes a global network manager for receiving global logical network configuration data for the multiple physical sites. The network management system includes, at each of the physical sites, (i) a local network manager for receiving a logical network configuration for the physical site from the global network manager and (ii) a set of central controllers for distributing logical network configuration data to computing devices that implement the logical network at the physical site.

Abstract: Some embodiments provide a method for distributing a service rule that is to be enforced across a first set of sites and that is defined by reference to a group identifier that identifies a group of machines. The method distributes the service rule to each site in the first set of sites. The method identifies at least one site in the first set of sites that is not in a second set of sites that has already received a definition of the group. The method distributes the group definition to each identified site in the first set of sites that has not already received the definition of the group.

Abstract: Some embodiments of the invention provide a method for processing requests for performing operations on resources in a software defined datacenter (SDDC). The resources are software-defined (SD) resources in some embodiments. The method initially receives a request to perform an operation with respect to a first resource in the SDDC. The method identifies a policy that matches (i.e., is applicable to) the received request for the first resource by comparing a set of attributes of the request with sets of attributes of a set of policies that place constraints on operations specified for resources. In some embodiments, several sets of attributes for several policies can be expressed for resources at different hierarchal resource levels of the SDDC. The method rejects the received request when the identified policy specifies that the requested operation violates a constraint on operations specified for the first resource.

Abstract: Some embodiments of the invention provide a method for processing requests for performing operations on resources in a software defined datacenter (SDDC). The resources are software-defined (SD) resources in some embodiments. The method initially receives a request to perform an operation with respect to a first resource in the SDDC. The method identifies a policy that matches (i.e., is applicable to) the received request for the first resource by comparing a set of attributes of the request with sets of attributes of a set of policies that place constraints on operations specified for resources. In some embodiments, several sets of attributes for several policies can be expressed for resources at different hierarchal resource levels of the SDDC. The method rejects the received request when the identified policy specifies that the requested operation violates a constraint on operations specified for the first resource.

Abstract: Some embodiments of the invention provide a method for deploying software-implemented resources in a software defined datacenter (SDDC). The method initially receives a hierarchical API command that, in a declarative format, specifies several operation requests for several software-defined (SD) resources at several resource levels of a resource hierarchy in the SDDC. The method parses the API command to identify the SD resources at the plurality of resource levels. Based on the parsed API command, the method deploys the SD resources by using a deployment process that ensures that any first SD resource on which a second SD resource depends is deployed before the second resource. In some embodiments, a second SD resource depends on a first SD resource when the second SD resource is a child of the first SD resource. Alternatively, or conjunctively, a second SD resource can also depend on a first SD resource in some embodiments when the second SD resource has some operational dependency on the first SD resource.

Abstract: Some embodiments provide a method for providing a user interface (UI) for a network management application. The method provides a first UI for accessing a global network manager through the network management application to configure a global logical network spanning multiple physical sites. For each respective site, the method provides an additional UI for accessing a respective local network manager for the site (i) to modify the global logical network at the respective site and (ii) to configure a local logical network at the respective site. The method provides a UI item for toggling between the first UI and the additional UIs. Multiple UI items available in the first UI are also available in the additional UIs.

Abstract: Some embodiments provide a method for distributing rules associated with a particular logical network element that is implemented across one or more physical sites. The method uses a set of attributes of a set of elements associated with the particular logical network element to identify a particular set of physical sites spanned by the particular logical network element. The method identifies a set of rules associated with the particular logical network element. The method distributes the identified set of rules to each site of the identified set of physical sites.

Abstract: Some embodiments of the invention provide a method for deploying software-implemented resources in a software defined datacenter (SDDC). The method initially receives a hierarchical API command that, in a declarative format, specifies several operation requests for several software-defined (SD) resources at several resource levels of a resource hierarchy in the SDDC. The method parses the API command to identify the SD resources at the plurality of resource levels. Based on the parsed API command, the method deploys the SD resources by using a deployment process that ensures that any first SD resource on which a second SD resource depends is deployed before the second resource. In some embodiments, a second SD resource depends on a first SD resource when the second SD resource is a child of the first SD resource. Alternatively, or conjunctively, a second SD resource can also depend on a first SD resource in some embodiments when the second SD resource has some operational dependency on the first SD resource.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifies (i) a set of tiers of the application and (ii) a set of requirements for deploying the application. Based on the application definition, the method automatically defines a logical network architecture for connecting data compute nodes (DCNs) that implement the application tiers in the set of datacenters. The method configures a set of forwarding elements in the set of datacenters to implement the logical network architecture.

Abstract: Some embodiments of the invention provide a method for deploying software-implemented resources in a software defined datacenter (SDDC). The method initially receives a hierarchical API command that, in a declarative format, specifies several operation requests for several software-defined (SD) resources at several resource levels of a resource hierarchy in the SDDC. The method parses the API command to identify the SD resources at the plurality of resource levels. Based on the parsed API command, the method deploys the SD resources by using a deployment process that ensures that any first SD resource on which a second SD resource depends is deployed before the second resource. In some embodiments, a second SD resource depends on a first SD resource when the second SD resource is a child of the first SD resource. Alternatively, or conjunctively, a second SD resource can also depend on a first SD resource in some embodiments when the second SD resource has some operational dependency on the first SD resource.

Abstract: Some embodiments provide a network management system for managing a logical network that spans multiple physical sites. The network management system includes a global network manager for receiving global logical network configuration data for the multiple physical sites. The network management system includes, at each of the physical sites, (i) a local network manager for receiving a logical network configuration for the physical site from the global network manager and (ii) a set of central controllers for distributing logical network configuration data to computing devices that implement the logical network at the physical site.

Abstract: Some embodiments provide a method for providing a user interface (UI) for a network management application. The method provides a first UI for accessing a global network manager through the network management application to configure a global logical network spanning multiple physical sites. For each respective site, the method provides an additional UI for accessing a respective local network manager for the site (i) to modify the global logical network at the respective site and (ii) to configure a local logical network at the respective site. The method provides a UI item for toggling between the first UI and the additional UIs. Multiple UI items available in the first UI are also available in the additional UIs.

Abstract: Some embodiments provide a method for distributing rules associated with a particular logical network element that is implemented across one or more physical sites. The method uses a set of attributes of a set of elements associated with the particular logical network element to identify a particular set of physical sites spanned by the particular logical network element. The method identifies a set of rules associated with the particular logical network element. The method distributes the identified set of rules to each site of the identified set of physical sites.

Abstract: Some embodiments provide a method for collecting data regarding realized state associated with a logical network spanning multiple physical sites. At a global manager that manages a logical network, the method receives a request to collect realized state for a set of one or more logical network elements, each of which spans a set of two or more physical sites. Each physical site is managed by a local manager. For each of the logical network elements, the method identifies the set of physical sites spanned by the logical network element. For each of the logical network elements, the method sends requests for realized state of the logical network element to the local manager of each identified physical site spanned by the logical network element. The method generates a report for presentation from the realized states received from the local managers.