Abstract: A method embodiment serves to manage entity names for virtualized entities in a computing system comprising two or more computing nodes that host virtual machines and other virtual entities. The method commences upon receiving a request for identifiers. The request includes an identifier key that is used by a name generator. The name generator implements a deterministic algorithm that will always return the same outputs given the same inputs. The name generator generates a user- or program-specified number of virtualized entity identifiers based on the identifier key. The generated virtualized entity identifiers and corresponding identifier keys are stored in an identifier mapping table that is accessible by the two or more computing nodes. The identifier mapping table describes relationships between the virtualized entity identifiers and corresponding identifier keys. The virtualized entity identifiers are used to create respective virtualized entities.

Abstract: High-performance web service communication techniques. Embodiments manage communications between a client and web services that are accessible over a network. Communications between the client and web services comprise web service calls. A client forms a batch message comprising a plurality of target web service calls directed to target web services that are identifiable by the target web service calls. A middleware component or batch processor intercepts the batch message and generates a set of individual web service calls that are derived from the contents of the batch message. Each of the set of individual service calls that are derived from the batch message are dispatched to the target web services in accordance with a set of web service call prioritization and formatting rules. Batch formation and decomposition into individual service messages is performed such that neither the target web services nor their respective invoking call formats require modification.

Abstract: Systems for managing a distributed computing system. A method embodiment commences upon receiving user-provided specification parameters that describe a target state of a computing entity. After generating a set of resource management commands to achieve the specified target state of a computing entity, the resource management commands are scheduled for execution. As execution of the resource management commands is being carried out, the execution status of the resource management commands is continuously monitored. If performance of the resource management commands raises an error and/or the resource entity state is different than predicted, a set of remediation actions are determined, and an additional set of processing operations are invoked to accomplish the remediation actions. When all resource management commands and/or any remediation actions have completed successfully, the target resource entity state has been achieved.

Abstract: A method embodiment serves to manage entity names for virtualized entities in a computing system comprising two or more computing nodes that host virtual machines and other virtual entities. The method commences upon receiving a request for identifiers. The request includes an identifier key that is used by a name generator. The name generator implements a deterministic algorithm that will always return the same outputs given the same inputs. The name generator generates a user- or program-specified number of virtualized entity identifiers based on the identifier key. The generated virtualized entity identifiers and corresponding identifier keys are stored in an identifier mapping table that is accessible by the two or more computing nodes. The identifier mapping table describes relationships between the virtualized entity identifiers and corresponding identifier keys. The virtualized entity identifiers are used to create respective virtualized entities.

Abstract: High-performance web service communication techniques. Embodiments manage communications between a client and web services that are accessible over a network. Communications between the client and web services comprise web service calls. A client forms a batch message comprising a plurality of target web service calls directed to target web services that are identifiable by the target web service calls. A middleware component or batch processor intercepts the batch message and generates a set of individual web service calls that are derived from the contents of the batch message. Each of the set of individual service calls that are derived from the batch message are dispatched to the target web services in accordance with a set of web service call prioritization and formatting rules. Batch formation and decomposition into individual service messages is performed such that neither the target web services nor their respective invoking call formats require modification.

Abstract: Systems for migrating from an application running in a virtual machine to a containerized version of the application. A method commences by identifying a computing system comprising virtual machines (VMs) that execute applications. A user or processing entity identifies a subject application to be migrated to an application container that is run in place of the VM subject application. A processing entity analyzes the subject application to determine application profile attributes and then matches at least some of the application profile attributes to one or more candidate application containers. Based on administrative rules, a particular application container image corresponding to one of the matched candidate application containers is selected and invoked so as to run in the computing system in place of the application in the virtual machine(s). The application in VMs are quiesced before the virtual machine assets are migrated. The invoked application container image uses the migrated assets.

Abstract: Computing cluster system management. Embodiments implement fine-grained rule-based approaches to error recovery. A service dispatches tasks to components of the computing cluster. At the time of task dispatching, entries are made into a write-ahead log. The write-ahead log entries serve for recording task and component attributes. A monitor detects a failure event raised by one or more of the components of the computing cluster. Responses to the failure event include determining a set of conditions that are present in the computing cluster at the time of the detection, and then using the failure event and the determined conditions in combination with a set of fine-grained failure processing rules to determine one or more recovery actions to take. Recovery actions include redistributing the failed task to a different node or to different service. Certain conditions and rules initiate actions that rollback the state of a component to a previous success points.

Abstract: Systems and methods for computer security in computer clusters. Techniques provide secure user access to applications that run in shared resource computing environments. A method embodiment commences upon identifying an application digital certificate corresponding to a subject application. The subject application is stored for access by a reverse proxy authorization service that also runs in the shared computing environment. Individual user processes are uniquely identified by corresponding user credentials. The reverse proxy authorization service processes a request to access the subject application, whereupon a generated subject application instance specific to the requestor is installed. Installation includes authentication using the application digital certificate for the subject application and authorization using the requestor's credentials.

Abstract: A system and method include receiving, by an object store virtual machine of a virtual object storage system, a user request for updating an element of an object store. The user request includes a first compare and swap value. The system and method also include updating the first compare and swap value from the second user request for obtaining an updated compare and swap value, comparing the updated compare and swap value with a current compare and swap value of the element, and updating the element upon determining that the updated compare and swap value is greater than the current swap and compare value. Updating the element comprises one of creating a new version of the element and overwriting a previous version of the element. The system and method further include replacing the current compare and swap value with the updated compare and swap value.

Abstract: Systems and methods for aggregating policies to enforce on computing entities of a computing system. A method embodiment commences upon administrative definition of a set of named policy associations that are applicable to various types of such computing entities. The occurrence of two or more named policy associations that are associated with a particular computing entity cause the policies to be processed to detect and reconcile possible conflicts. Reconciliation is accomplished by applying a set of conflict resolution rules. The result of detection and reconciliation of conflicts is a policy aggregate that comprises two or more non-conflicting policy subcomponents. During ongoing uses of the computing entities, policy actions are taken so as to enforce the semantics of the policy subcomponents onto the computing entity.

Abstract: Entries in individual portions of a network map serve to establish inter-cluster routes that are formed from routing data structures at individual clusters, which routing data structures store connection parameters pertaining to access point nodes in a multi-cluster computing environment. Upon receiving a resource management request at one of the access points, the request parameters are used in combination with the network map to identify at least one target access point having a virtual machine for responding to the resource management request. The resource management request is routed to a next hop access point node on route(s) to target access points. If the next hop access point node is not the node to respond to the resource management request, then processing at the next hop node serves to route the resource management request to a further next hop access point node on a route to the target access point.

Abstract: Systems and methods commence upon detecting certain computing system specification change events. Changes are recorded in resource usage intent specification records that characterize desired states associated with respective resources of the computing system. The change event causes generation of a data state snapshot of data stored in the computing system. A state tuple is constructed to associate the desired state with the data state. The state tuple is committed to a version control system. At any time, a user or process can select a selected system state tuple from committed tuples stored in the version control system. The tuple is analyzed to determine its associated desired state and its data state. Actions are taken to restore the data state of the tuple to the computing system, and then bringing the computing system to the state of the tuple so as to reproduce the desired system state in the computing system.

Abstract: Systems and methods for providing generic access web service entry points for virtualized entities in a computing system. A method embodiment commences by identifying a code base comprising one or more arbitrarily-named entity management functions. A set of generically-named entry points are defined and exposed. A data structure that comprises mappings between generically-named entry points and respective arbitrarily-named entity management functions is defined. When a call to one of the generically-named entry points is received, characteristics of the call itself and/or the call parameters are examined. The data structure comprising the mappings is accessed to determine a corresponding set of one or more arbitrarily-named entity management functions. The corresponding set of arbitrarily-named entity management functions is executed on behalf of the caller.

Abstract: Computer-aided computer system configuration techniques for adding new computing resources to an existing set of computing resources. A method embodiment commences upon identifying an existing computing system having a first set of configuration parameters. A second computing system having a second set of configuration parameters is deployed. A user interface is provided to accept user input comprising a location and protocol to access the existing computing system. Syntactical and semantic differences between the configuration parameters of the existing computing system and those of the newly added set are identified. The identified differences are analyzed to generate a parameter map that relates the existing set of configuration parameters to the second set of configuration parameters and vice-versa. Relationships that are codified in the parameter map are validated through user interactions.

Abstract: Systems for computer security. A proxy service implements methods for substituting callback uniform resource locators (URLs) when using an OAuth protocol exchange to authenticate an application. A proxy service is established at a first uniform resource locator to carry out communications between one or more identity access management servers and a plurality of application hosting sites. At least one of the plurality of application hosting sites has a second uniform resource locator that is different from the first uniform resource locator. An identity access management server will register the application and the first uniform resource locator. From any hosting site, the application is invoked, upon which invocation, the application carries out at least a portion of the OAuth protocol exchange with the IAM. The proxy service at the first uniform resource locator receives an authentication message from the IAM and then redirects the authentication message to the application hosting site.

Abstract: Synchronization techniques for computing systems that interface with external service providers. A method for accessing status and other attributes of an external service provider commences upon identifying an external service such as a firewall appliance or backup repository that provides computing-related functions to computing entities of the computing system. One or more access mechanisms such as an application programming interface is exposed to the external service. The external service is registered with the computing system to use the access mechanism. When the external service detects a change of its state, the external service can communicate that change to the computing system through a “push” operation. The computing system processes the “pushed” data from the external service by verifying the status of the registration and authorization permissions, and then modifies one or more entity attributes of the computing resource entity.

Abstract: Systems for dynamically generating user interfaces. A method embodiment commences upon receiving one or more requests for a user interface view corresponding to a particular type of computing resource entity. A set of resource property templates are examined to identifying one or more resource properties that correspond to the particular type of computing resource entity. Processing is invoked to determine the then-current resource state(s) of the computing resource entity. Based on the then-current resource state(s) of the particular type of computing resource entity, user interface code is dynamically generated. The dynamically generated user interface code is used to render a user interface view on the requester's display. The rendered user interface view comprises one or more of the resource properties and at least one aspect of the dynamically-determined then-current resource state(s) that correspond to the one or more resource properties.

Abstract: Systems for rule-based data protection of virtualized computing entities. A method embodiment commences upon receiving specification parameters that correspond to one or more data protection schemes or data protection configurations such as schemes for making backups or snapshots. Based on the specification parameters and the data protection configurations, one or more resource entities associated with the data protection configurations are identified. Each of the resource entities are accessed and one or more applicable data protection administration rules that correspond to the respective resource entities are applied. The resource entities might be organized hierarchically. Determination of which data protection administration rules are applicable to the resource entities is based on the type of resource entity being considered. The combination of the resource entity type and respective applicable rules is used to generate entity-specific data protection commands.

Abstract: A method and apparatus for data driven and cluster specific version/update control. The apparatus includes an automated multi-clusters management apparatus that interfaces with a plurality of remote clusters to provide data driven version/update control on a cluster by cluster basis. Generally, operation includes collection/identification of cluster specific data pertaining to software, hardware, and cluster requirements. The cluster specific data is later compared/analyzed against multi-cluster data pertaining to software releases, hardware characteristics, and known bugs/issues for each. The results of the comparison/analysis can then be ranked according to various metrics to different possible solutions and to differentiate the less desirable results from the more desirable results. Thus, the automated multi-cluster management apparatus provides for selection of versions/updates that is dependent on the cluster specific data.