Abstract: Example methods are provided for a first node to perform identifier (ID) allocation in a virtualized computing environment that includes a cluster formed by the first node and at least one second node. The method may comprise retrieving, from a pool of IDs associated with the cluster, a batch of IDs to a cache associated with the first node. The pool of IDs may be shared within the cluster and the batch of IDs retrieved for subsequent ID allocation by the first node. The method may also comprise, in response to receiving a request for ID allocation from an ID consumer, allocating one or more IDs from the batch of IDs in the cache to respective one or more objects for unique identification of the one or more objects across the cluster; and sending, to the ID consumer, a response that includes the allocated one or more IDs.

Abstract: Some embodiments provide a method for distributing a group definition for a group of machines. The method receives the group definition, which includes (i) a span of the group that specifies a set of sites at which the group is to be used and (ii) a set of criteria for machines to be included in the group. The set of criteria includes at least a location criteria specifying one or more sites. The method distributes the group definition to each site in the set of sites. At each site in the set of sites, a local network control system of the site determines a set of machines in the group based on the set of criteria. Only machines in the one or more sites specified by the location criteria are determined to be in the group.

Abstract: An approach for a software defined networking manager to perform a predictive analysis of proposed modifications to a software defined network (SDN) is presented. A method comprises receiving entity logical associations that are captured in a set of rules implemented in a SDN. Once a proposed modification to the entity logical associations is received, without implementing the proposed modification and without modifying the set of rules, impacted entity associations, from the entity logical associations, are identified. Upon receiving input indicating that the proposed modification is to be accepted, an updated set of rules for the SDN is generated by updating the set of rules based on the proposed modification, and the updated set of rules is implemented in the SDN.

Abstract: The disclosure provides an approach for managing group membership in a multi-site networking environment. Embodiments include receiving, at a local management component on a networking site of a plurality of networking sites, from a global management component associated with the plurality of networking sites, a definition of a group. Embodiments include determining, by the local management component on the networking site, based on the definition, that the group comprises a networking object with a span that does not include the networking site. Embodiments include storing, by the local management component on the networking site, in a data structure, a reference to the networking object in association with the group, wherein the networking object is excluded from a determination of local membership of the group on the networking site.

Abstract: An approach for a software defined networking manager to perform a predictive analysis of proposed modifications to a software defined network (SDN) is presented. A method comprises receiving entity logical associations that are captured in a set of rules implemented in a SDN. Once a proposed modification to the entity logical associations is received, without implementing the proposed modification and without modifying the set of rules, impacted entity associations, from the entity logical associations, are identified. Upon receiving input indicating that the proposed modification is to be accepted, an updated set of rules for the SDN is generated by updating the set of rules based on the proposed modification, and the updated set of rules is implemented in the SDN.

Abstract: Some embodiments provide a method for distributing a group definition for a group of machines. The method receives the group definition, which includes (i) a span of the group that specifies a set of sites at which the group is to be used and (ii) a set of criteria for machines to be included in the group. The set of criteria includes at least a location criteria specifying one or more sites. The method distributes the group definition to each site in the set of sites. At each site in the set of sites, a local network control system of the site determines a set of machines in the group based on the set of criteria. Only machines in the one or more sites specified by the location criteria are determined to be in the group.

Abstract: In one example, workload attributes associated with workloads running in a virtualized computing environment may be retrieved. A distance analysis may be performed using the retrieved workload attributes to generate a distance matrix that identifies a distance between each workload and each other workload. Further, a cluster analysis may be performed on the workloads based on the distance matrix to generate clusters, where each cluster may include identical workloads. Furthermore, the identical workloads in each cluster may be associated with at least one security policy to provide security services in the virtualized computing environment.

Abstract: This disclosure presents processes and systems that translate policies defined for virtual objects, such as virtual servers, applications, and databases, of a distributed computing system into identity information of services provided by virtual objects to computing devices located outside the distributed computing system. Processes and systems form object graphs of computing device identity information, virtual objects, and virtual object identify information. Processes and systems translate polices for controlling network between the computing devices and the virtual objects into identity information of the computing devices and the virtual objects. The identify information of the virtual objects and the computing devices is used to create rules for controlling network traffic between the virtual objects and the computing devices.

Abstract: An approach for a software defined networking manager to perform a predictive analysis of proposed modifications to a software defined network (SDN) is presented. A method comprises receiving entity logical associations that are captured in a set of rules implemented in a SDN. Once a proposed modification to the entity logical associations is received, without implementing the proposed modification and without modifying the set of rules, impacted entity associations, from the entity logical associations, are identified. Upon receiving input indicating that the proposed modification is to be accepted, an updated set of rules for the SDN is generated by updating the set of rules based on the proposed modification, and the updated set of rules is implemented in the SDN.

Abstract: In a computer-implemented method for managing resource allocation of a managed system, responsive to a request by a consumer node, an owner node of a plurality of owner nodes that controls resource allocations from the pool of resources is determined, where the resource is associated with a data object. A resource is allocated from a pool of resources comprising a plurality of resources by the owner node. An allocation marker corresponding to the resource is created. The resource and the allocation marker are made available for retrieval by the consumer node.

Abstract: Example methods are provided for a first node to perform identifier (ID) allocation in a virtualized computing environment that includes a cluster formed by the first node and at least one second node. The method may comprise retrieving, from a pool of IDs associated with the cluster, a batch of IDs to a cache associated with the first node. The pool of IDs may be shared within the cluster and the batch of IDs retrieved for subsequent ID allocation by the first node. The method may also comprise, in response to receiving a request for ID allocation from an ID consumer, allocating one or more IDs from the batch of IDs in the cache to respective one or more objects for unique identification of the one or more objects across the cluster; and sending, to the ID consumer, a response that includes the allocated one or more IDs.

Abstract: Techniques for grouping virtual machine (VM) objects for networking and security services in a virtualized computing system are described. In one example embodiment, VM attributes and identity attributes are obtained from a virtual center and an identity server, respectively. One or more desired security groups are then formed based on security requirements of the virtualized computing system. A user defined dynamic expression is then associated with the one or more security groups. One or more expression attributes are then determined by evaluating the user defined dynamic expression using the obtained VM attributes and identity attributes. VM objects are then grouped based on the determined one or more expression attributes. The grouped VM objects are then associated with the created one or more security groups for providing the networking and security services.

Abstract: Techniques for grouping virtual machine (VM) objects for networking and security services in a virtualized computing system are described. In one example embodiment. VM attributes and identity attributes are obtained from a virtual center and an identity server, respectively. One or more desired security groups are then formed based on security requirements of the virtualized computing system. A user defined dynamic expression is then associated with the one or more security groups. One or more expression attributes are then determined by evaluating the user defined dynamic expression using the obtained VM attributes and identity attributes. VM objects are then grouped based on the determined one or more expression attributes. The grouped VM objects are then associated with the created one or more security groups for providing the networking and security services.