Abstract: Some embodiments provide a method of managing policy for a logical network spanning multiple datacenters, including at least first and second datacenters. The method is performed by a network management service operating in a public cloud to manage the datacenters. The method receives (i) a first policy configuration specifying logical network policy at the first datacenter from a first local network manager at the first datacenter and (ii) a second policy configuration specifying logical network policy at the second datacenter from a second local network manager at the second datacenter. The method consolidates the first and second policy configurations into a global policy configuration that also includes policy configuration defined at the network management service. The method uses the global policy configuration to manage the policy configurations for the logical network.

Abstract: Some embodiments provide a method for deploying network management services for a plurality of tenants. The method is performed at a multi-tenant service executing in a container cluster implemented in a public cloud. For a first tenant, the method deploys a first set of network management services in the container cluster for managing a first group of datacenters of the first tenant. For a second tenant, the method deploys a second set of network management services in the container cluster for managing a second group of datacenters of the second tenant.

Abstract: Some embodiments provide a method for network management and control system that manages one or more logical networks. From a first user, the method receives a definition of one or more security zones for a logical network. Each security zone definition includes a set of security rules for data compute nodes (DCNs) assigned to the security zone. From a second user, the method receives a definition of an application to be deployed in the logical network. The application definition specifies a set of requirements. Based on the specified set of requirements, the method assigns DCNs implementing the application to one or more of the security zones for the logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a plurality of sites. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifying a first set of the sites at which to deploy the application. Based on the definition of the application, the method assigns the application to a set of security zones defined for the virtual infrastructure. Each respective security zone is restricted to a respective set of the sites. The method deploys the application in a second set of sites based on the first set of sites and the sets of sites to which the set of security zones are restricted.

Abstract: The disclosure provides an approach for collecting system state data relating to whether certain system states overload a processor assigned to a controller of the system. The approach further involves using the collected data to train a regression machine learning algorithm to predict whether indented or desired system states will result in processor overload. Depending on the prediction, the approach takes one of several steps to efficiently change system state.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifies (i) a set of tiers of the application and (ii) a set of requirements for deploying the application. Based on the application definition, the method automatically defines a logical network architecture for connecting data compute nodes (DCNs) that implement the application tiers in the set of datacenters. The method configures a set of forwarding elements in the set of datacenters to implement the logical network architecture.

Abstract: Some embodiments provide a method for network management and control system that manages one or more logical networks. From a first user, the method receives a definition of one or more security zones for a logical network. Each security zone definition includes a set of security rules for data compute nodes (DCNs) assigned to the security zone. From a second user, the method receives a definition of an application to be deployed in the logical network. The application definition specifies a set of requirements. Based on the specified set of requirements, the method assigns DCNs implementing the application to one or more of the security zones for the logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a plurality of sites. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifying a first set of the sites at which to deploy the application. Based on the definition of the application, the method assigns the application to a set of security zones defined for the virtual infrastructure. Each respective security zone is restricted to a respective set of the sites. The method deploys the application in a second set of sites based on the first set of sites and the sets of sites to which the set of security zones are restricted.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: The disclosure provides an approach for collecting system state data relating to whether certain system states overload a processor assigned to a controller of the system. The approach further involves using the collected data to train a regression machine learning algorithm to predict whether indented or desired system states will result in processor overload. Depending on the prediction, the approach takes one of several steps to efficiently change system state.