Abstract: Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

Abstract: Some embodiments of the invention provide, for a RAN (radio access network), a method of rapidly upgrading multiple machines distributed across multiple cell sites, each particular machine of the multiple machines executing one or more base station applications. The method downloads a second boot disk for each of the multiple machines at each of the multiple cell sites, the second boot disk including an upgraded version of a first boot disk currently used by each of the multiple machines. For each particular machine, the method (1) powers off the particular machine, (2) creates a copy of data stored by a data disk of the particular machine to preserve data stored currently on the data disk, (3) replaces the first boot disk of the particular machine with the second boot disk that is the upgraded version of the first boot disk, and (4) powers on the particular machine.

Abstract: Example methods and systems for cloud native network function deployment are described. One example may involve a computer system obtaining cluster configuration information associated with multiple single node clusters (SNCs). Based on the cluster configuration information, the computer system may configure (a) a first SNC on a first node and (b) a second SNC on a second node. The computer system may configure (a) a first virtual agent associated with the first SNC, and (b) a second virtual agent associated with the second SNC. In response to receiving a deployment request to deploy a first pod and a second pod, the computer system may process the deployment request by (a) deploying, using the first virtual agent, the first pod on the first SNC, and (b) deploying, using the second virtual agent, the second pod on the second SNC.

Abstract: The disclosure provides a method for diagnosing remote sites of a distributed container orchestration system. The method generally includes receiving a test suite custom resource defining an image to be used for a diagnosis of components of a workload cluster deployed at the remote sites, wherein the image comprises a diagnosis module and/or a user-provided plugin to be used for the diagnosis; identifying a failed component in the workload cluster; obtaining infrastructure information about the workload cluster; identifying the components of the workload cluster for diagnosis based on the failed component, the infrastructure information, and the test suite custom resource; identifying at least one diagnosis site of the remote sites where the components are running using the infrastructure information; and deploying a first pod at the at least one diagnosis site to execute the diagnosis of the one or more components.

Abstract: An example method of propagating fault domain topology information in a distributed container orchestration system includes: receiving, at control plane software executing in a data center, the fault domain topology, which includes tags for a protection group and fault domains for remote sites in communication with the data center; deploying, by a master server of the distributed container orchestration system that executes in the data center, a node pool comprising virtual machines (VMs) executing in servers of the remote sites, the VMs being nodes of the distributed container orchestration system in which containers execute; determining, by a controller of the master server, relationships among the VMs, the servers, the protection group, and the fault domains based on state of resources maintained by the master server; and providing, by the controller, labels to the servers for associating the tags of the protection group and the fault domains to the VMs.

Abstract: An example method of diagnosing remote sites of a distributed container orchestration system includes: receiving, at a management cluster, definition of a test suite custom resource; detecting, by a test controller agent in a cluster of the remote sites, a diagnosis object in the management cluster created in response to the test suite custom resource; deploying, by the test controller agent in response to the diagnosis object, a first pod in the cluster; deploying, by the first pod, a second pod in a server of a first remote site of the remote sites; checking, by the second pod, configuration of the server that includes an additional pod executing alongside the second pod, at least one virtual machine (VM) in which the second pod and the additional pod execute, a hypervisor configured to support the at least one VM, and a hardware platform on which the hypervisor executes; and returning test data from the second pod to the first pod, the test data including results of the step of checking the configuration o

Abstract: A method for selecting between a plurality of paths for sending an encrypted packet from a source endpoint to a destination endpoint is provided. The method selects a first path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, each of the plurality of paths associated with a different one of a plurality of source ports, the encrypted packet being encrypted based on a security association established between the source endpoint and the destination endpoint in accordance with an IPSec protocol. The method further encapsulates, based on the SA having NAT-T enabled, the encrypted packet with a UDP header having a first source port associated with the first path. The method then transmits the encapsulated encrypted packet from the source endpoint to the destination endpoint via the first path.

Abstract: An example method of propagating fault domain topology information in a distributed container orchestration system includes: receiving, at control plane software executing in a data center, the fault domain topology, which includes tags for a protection group and fault domains for remote sites in communication with the data center; deploying, by a master server of the distributed container orchestration system that executes in the data center, a node pool comprising virtual machines (VMs) executing in servers of the remote sites, the VMs being nodes of the distributed container orchestration system in which containers execute; determining, by a controller of the master server, relationships among the VMs, the servers, the protection group, and the fault domains based on state of resources maintained by the master server; and providing, by the controller, labels to the servers for associating the tags of the protection group and the fault domains to the VMs.

Abstract: An example method of diagnosing remote sites of a distributed container orchestration system includes: receiving, at a management cluster, definition of a test suite custom resource; deploying, in response to the test suite custom resource, a first pod in the management cluster; deploying, by the first pod, a second pod in a server of a first remote site of the remote sites; checking, by the second pod, configuration of the server that includes an additional pod executing alongside the second pod, at least one virtual machine (VM) in which the second pod and the additional pod execute, a hypervisor configured to support the at least one VM, and a hardware platform on which the hypervisor executes; and returning test data from the second pod to the first pod, the test data including results of the step of checking the configuration of the server.

Abstract: The disclosure provides an approach for simulating a virtual environment. A method includes simulating, using a virtualization simulator, a plurality of hosts; simulating, using the virtualization simulator, a plurality of virtual computing instances (VCIs) associated with the plurality of simulated hosts, based on information obtained from a cluster application programming interface (API) provider; creating, using a virtualization simulator operator, one or more node simulator schedulers; creating, using the one or more node schedulers, a node simulator; simulating, using the node simulator, a plurality of guest operating systems (OSs) associated with the plurality of simulated VCIs; and joining the plurality of simulated guest OSs to one or more node clusters in a data center via an API server.

Abstract: An example method of updating device firmware in a distributed container orchestration system includes: receiving, at a master server executing in a data center, a definition for a firmware custom resource; obtaining, by an operator of the master server in response to the firmware custom resource, a firmware file set; providing, from the operator to a plurality of remote sites in communication with the data center, the firmware file set; and executing, by servers at the plurality of remote sites, updates of firmware for devices of the servers.

Abstract: Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

Abstract: Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

Abstract: A computer-implemented method, medium, and system for implementing a pluggable diagnostic tool for Telco radio access network (RAN) troubleshooting are disclosed. In one computer-implemented method, one or more containerized network function (CNF) instances are generated in a container orchestration platform by a test system and by using a telecommunication cloud automation (TCA) platform executed in the container orchestration platform, where the test system is onboarded to the TCA platform, and the one or more CNF instances are associated with 5G RAN. A customer resources (CR) file is received by the test system, where the CR file defines multiple test cases associated with validation of the TCA platform. The CR file is transmitted to a cluster of nodes in the container orchestration platform. The validation of the TCA platform is executed at the cluster of nodes based on the one or more CNF instances and the CR file.

Abstract: For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel virtualization architecture for utilizing a firewall service virtual machine (SVM) on the host to check the packets sent by and/or received for the GVMs. In some embodiments, the GVMs connect to a software forwarding element (e.g., a software switch) that executes on the host to connect to each other and to other devices operating outside of the host. Instead of connecting the firewall SVM to the host's software forwarding element that connects its GVMs, the virtualization architecture of some embodiments provides an SVM interface (SVMI) through which the firewall SVM can be accessed to check the packets sent by and/or received for the GVMs.

Abstract: A method for selecting between a plurality of paths for sending an encrypted packet from a source endpoint to a destination endpoint is provided. The method selects a first path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, each of the plurality of paths associated with a different one of a plurality of source ports, the encrypted packet being encrypted based on a security association established between the source endpoint and the destination endpoint in accordance with an IPSec protocol. The method further encapsulates, based on the SA having NAT-T enabled, the encrypted packet with a UDP header having a first source port associated with the first path. The method then transmits the encapsulated encrypted packet from the source endpoint to the destination endpoint via the first path.

Abstract: System and computer-implemented method in a cloud architecture including a mixed network having local objects in a local network and external objects in an external network, wherein the external objects are accessed through proxy communications, uses a proxy inventory to determine whether a connection from a first computing object to a second computing object should be excluded from a proxy. The connection from the first computing object to the second computing object is performed based on the determination.

Abstract: Techniques leveraging CPU flow affinity to increase throughput of a layer 2 (L2) extension network are disclosed. In one embodiment, an L2 concentrator appliance, which bridges a local area network (LAN) and a wide area network (WAN) in a stretched network, is configured such that multiple Internet Protocol Security (IPsec) tunnels are pinned to respective CPUs or cores, which each process traffic flows for one of the IPsec tunnels. Such parallelism can increase the throughput of the stretched network. Further, an L2 concentrator appliance that receives FOU packets is configured to distribute the received FOU packets across receive queues based a deeper inspection of inner headers of such packets.

Abstract: Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

Abstract: The disclosure provides an approach for diagnosing a data plane of a network, wherein the network spans a first data center and a second data center, and wherein the second data center is remote to the first, the method comprising: accessing a secure connection between the first data center and the second data center; modifying, by the first performance controller, firewall settings of the first data center from a first setting to a second setting; opening on the second data center an instance of a performance tool; opening on the first data center a client of the instance of the performance tool; sending data packets over the data plane of the network; receiving the data packets; generating metrics associated with the data packets; and modifying firewall settings of the first data center from the second setting to the first setting.