Abstract: A computing device may implement the techniques described in this disclosure. The computing device may include processing circuitry configured to execute an analysis framework system, and memory configured to store time series data. The analysis framework system may create, based on the time series data, a knowledge graph comprising a plurality of first nodes in the network system referenced in the time series data interconnected by edges. The analysis framework system may cause a graph analytics service of the analysis framework system to receive a graph analysis request comprising a request to determine a fault propagation path, a request to determine changes in the knowledge graph, a request to determine an impact of an emulated fault, or a request to determine an application-to-network path. The analysis framework system may also cause the graph analytics service to determine a response to the graph analysis request, and output the response.

Abstract: In general, this disclosure describes techniques that enable a network system to perform application-aware active measurement for monitoring network health. The network system includes memory that stores a topology graph for a network. The network system includes processing circuitry that may receive an identifier associated with an application utilizing the network for communications, and determine, based on the topology graph and the identifier, a subgraph of the topology graph based on a location, in the topology graph, of a node representing a compute node that is a host of the application. The processing circuitry may next determine, based on the subgraph, a probe module to measure performance metrics associated with the application, and for the probe module, generate configuration data corresponding to the probe module. The processing circuitry may output, to the probe module, the configuration data.

Abstract: An edge services controller may use a service scheduling algorithm to deploy services on Network Interface Cards (NICs) of a NIC fabric while incrementally scheduling services. The edge services controller may assign services to specific nodes depending on their available resources on these nodes. Available resources may include CPU compute, DPU compute, node bandwidth, etc. The edge services controller may also consider the distance between the services that communicate with each other (i.e., hop count between nodes if two communicating services are placed on separate nodes) and the weight of communication between the services. Two services that communicate heavily with each other may consume more bandwidth, and putting them further apart is more detrimental than keeping them closer to each other, i.e., reducing the hop count between each other depending on the bandwidth consumption due to their inter-service communications.

Abstract: An example method comprises determining, by an edge services controller, based on a respective predicted resource utilization value for each of a plurality of servers, a corresponding server weight for each of the plurality of servers; the plurality of servers comprising respective network interface cards (NICs), wherein each NIC of the plurality of NICs comprises an embedded switch and a processing unit coupled to the embedded switch; determining, by the edge services controller, based on a respective predicted resource utilization value for each of a plurality of services, a corresponding application weight for each of the plurality of services; and scheduling, by the edge services controller, based on the respective server weight for a server of the plurality of servers and the respective application weight for the service, a service of the plurality of services on the server.

Abstract: In general, techniques are described for managing a distributed application based on call paths among the multiple services of the distributed application that traverse underlying network infrastructure. In an example, a method comprises determining, by a computing system, and for a distributed application implemented with a plurality of services, a call path from an entry endpoint service of the plurality of services to a terminating endpoint service of the plurality of services; determining, by the computing system, a corresponding network path for each pair of adjacent services from a plurality of pairs of services that communicate for the call path; and based on a performance indicator for a network device of the corresponding network path meeting a threshold, performing, by the computing system, one or more of: reconfiguring the network; or redeploying one of the plurality of services to a different compute node of the compute nodes.

Abstract: An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which cause the system to obtain telemetry data, the telemetry data being associated with a plurality of applications running on a plurality of hosts. The instructions cause the system to, based on the telemetry data, determine a subset of applications of the plurality of applications that run on a first host of the plurality of hosts. The instructions cause the system to determine a subset of firewall policies of a plurality of firewall polices, each of the subset of firewall policies applying to at least one respective application of the subset of applications. The instructions cause the system to generate an indication of the subset of firewall policies and send the indication to a management plane of a distributed firewall.

Abstract: An example system may include one or more memories and one or more processors. The one or more processors are configured to determine that a first workload depends on one or more other workloads. The one or more processors are configured to determine a measure of first carbon emission associated with the first workload and determine a predicted measure of second carbon emission associated with the one or more other workloads. The one or more processors are configured to determine a combined emission, the combined emission including the measure of the first carbon emission and the predicted measure of the second carbon emission. The one or more processors are configured to determine a replica count of the first workload based on the combined emission and an emission threshold and schedule spawning of replicas of the first workload or destruction of replicas of the first workload to implement the replica count.

Abstract: Example power management devices and techniques are described. An example computing device include one or more memories and one or more processors. The one or more processors are configured to determine, based on executing of at least one machine learning model, a measure of node criticality for a node of a cluster. The one or more processors are configured to determine, based on the measure of node criticality, a power savings measure of one or more power savings measures to be applied to the node. The one or more processors are configured to apply the power savings measure to the node.

Abstract: Example systems and techniques are disclosed for power management. An example system includes one or more memories and one or more processors. The one or more processors are configured to obtain workload metrics from a plurality of nodes of a cluster. The one or more processors are configured to obtain network function metrics from the plurality of nodes of the cluster. The one or more processors are configured to execute at least one machine learning model to predict a corresponding measure of criticality of traffic of each node. The one or more processors are configured to determine, based on the corresponding measure of criticality of traffic of each node, a corresponding power mode for at least one processing core of each node. The one or more processors are configured to recommend or apply the corresponding power mode to the at least one processing core of each node.

Abstract: Example techniques and devices are described for scheduling workloads. An example computing device is configured to predict an occurrence of a scale event for a first service. The computing device is configured to determine, based on the predicted occurrence of the scale event for the first service, a predicted level of greenness for the first service, the predicted level of greenness being based on a current level of greenness for the first service and a predicted scale up factor. The computing device is configured to determine whether the predicted level of greenness for the first service satisfies a first threshold. The computing device is configured to perform, based on whether the predicted level of greenness for the first service satisfies the first threshold, a first action on a first workload of the first service.

Abstract: An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to receive connection data related to an egress connection of an application service of an application. The instructions cause the network system to analyze the connection data to determine that the egress connection is an anomalous connection. The instructions cause the network system to generate a notification indicative of the egress connection being an anomalous connection and send the notification to a computing device.

Abstract: Example systems, methods, and storage media are described. An example network system includes processing circuitry and one or more memories coupled to the processing circuitry. The one or more memories are configured to store instructions which, when executed by the processing circuitry, cause the network system to obtain telemetry data. The instructions cause the network system to determine, based on the telemetry data, that an application running on server processing circuitry does not meet at least one service level agreement (SLA) requirement, the server processing circuitry not including processing circuitry resident on a network interface card (NIC). The instructions cause the network system to, based on the application not meeting the at least one SLA requirement, determine to offload at least one component of the application from the server processing circuitry to the processing circuitry resident on the NIC.

Abstract: A computing system comprising a memory and processing circuitry may perform the techniques. The memory may store time series data comprising measurements of one or more performance indicators. The processing circuitry may determine, based on the time series data, an anomaly in the performance of the network system, and create, based on the time series data, a knowledge graph. The processing circuitry may determine, in response to detecting the anomaly, and based on the knowledge graph and a machine learning (ML) model trained with previous time series data, a causality graph. The processing circuitry may determine a weighting for each edge in the causality graph, determine, based on the edges in the causality graph, a candidate root cause associated with the anomalies, and determine a ranking of the candidate root cause based on the weighting. The analysis framework system may output at least a portion of the ranking.

Abstract: In general, techniques are described for deploying workloads of containerized services to worker nodes in a network using network telemetry-aware scheduling. In an example, a method comprises establishing, by a computing system, an application performance baseline for an application based on application performance data and network telemetry data; based on determining that application performance has degraded from the application performance baseline, identifying, by the computing system, a correlation between a placement of a workload of the application to a first worker node of a plurality of worker nodes and the application performance data; and based on identifying the correlation, re-scheduling, by the computing system, the workload to a second worker node of the plurality of worker nodes.

Abstract: A container orchestration platform manages a plurality of instances of resources including a first custom resource and a second custom resource. An API server of the container orchestration platform receives a request to delete an instance of the second custom resource; determines whether instance data associated with the instance of the second custom resource has a backreference identifying an instance of the first custom resource, the backreference indicating the instance of the first custom resource is dependent on the instance of the second custom resource; and in response to determining that the instance data has the backreference to the instance of the first custom resource, bypasses deletion of the instance of the second custom resource.

Abstract: An edge services controller may use a service scheduling algorithm to deploy services on Network Interface Cards (NICs) of a NIC fabric while incrementally scheduling services. The edge services controller may assign services to specific nodes depending on their available resources on these nodes. Available resources may include CPU compute, DPU compute, node bandwidth, etc. The edge services controller may also consider the distance between the services that communicate with each other (i.e., hop count between nodes if two communicating services are placed on separate nodes) and the weight of communication between the services. Two services that communicate heavily with each other may consume more bandwidth, and putting them further apart is more detrimental than keeping them closer to each other, i.e., reducing the hop count between each other depending on the bandwidth consumption due to their inter-service communications.

Abstract: A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.

Abstract: An example system including a first top-of-rack (ToR) switch, and a second ToR switch, the second ToR switch is to receive a network packet from a first host, the network packet to include a destination address of a second host, and after a failure of a physical network interface card (pNIC) at the second host eliminates a first link between the second host and the second ToR switch, send the network packet to the first ToR switch via an inter-switch link between the first and second ToR switches to cause the first ToR switch to forward the network packet to the second host via a second link between the first ToR switch and the second host.

Abstract: An example method comprises determining, by an edge services controller, based on a respective predicted resource utilization value for each of a plurality of servers, a corresponding server weight for each of the plurality of servers; the plurality of servers comprising respective network interface cards (NICs), wherein each NIC of the plurality of NICs comprises an embedded switch and a processing unit coupled to the embedded switch; determining, by the edge services controller, based on a respective predicted resource utilization value for each of a plurality of services, a corresponding application weight for each of the plurality of services; and scheduling, by the edge services controller, based on the respective server weight for a server of the plurality of servers and the respective application weight for the service, a service of the plurality of services on the server.

Abstract: A performance monitoring system includes a metric collector configured to receive, via metric exporters, telemetry data comprising metrics related to a network of computing devices. A metric time series database stores related metrics. An alert rule evaluator service is configured to evaluate rules using stored metrics. The performance monitoring system may include a machine learning module and is configured to determine optimized metric collection sampling intervals and rule evaluation intervals, and to automatically determine recommended alert rules.