Template driven approach to deploy a multi-segmented application in an sddc

Patent metadata

Field	Value
Publication number	US-2020065166-A1
Application number	US-201816112408-A
Country	US
Kind code	A1
Filing date	Aug 24, 2018
Priority date	Aug 24, 2018
Publication date	Feb 27, 2020
Grant date	—

Abstract

Some embodiments provide a simplified mechanism to deploy and control a multi-segmented application by using application-based manifests that express how application segments of the multi-segment application are to be defined or modified, and how the communication profiles between these segments. In some embodiments, these manifests are application specific. Also, in some embodiments, deployment managers in a software defined datacenter (SDDC) provide these manifests as templates to administrators, who can use these templates to express their intent when they are deploying multi-segment applications in the datacenter. Application-based manifests can also be used to control previously deployed multi-segmented applications in the SDDC. Using such manifests would enable the administrators to be able to manage fine grained micro-segmentation rules based on endpoint and network attributes.

First claim

1 . A method for defining a multi-segmented application in a software defined datacenter (SDDC), the method comprising:
creating a hierarchical API command that specifies a plurality of application segments and defines a plurality of rules to control data message flows associated with the application segments; storing the hierarchical API as a template for the multi-segment application; and providing an interface to allow the template to be retrieved and customized in order to define a multi-segment application manifest to process to deploy a set of machines in the SDDC to implement the set of application segments and to provide the set of rules to a set of network elements in the SDDC to control the data message flows associated with the application segments.

2 . The method of claim 1 , wherein the network elements include managed forwarding elements for forwarding data messages between the application segments and between the application segments and applications other than the multi-segment application.

3 . The method of claim 1 , wherein the network elements include middlebox service elements for performing middlebox service operations on data messages sent to or from the application segments.

4 . The method of claim 3 , wherein the middlebox service elements include middlebox service machines executing on host computers.

5 . The method of claim 3 , wherein the middlebox service elements include middlebox service filters executing on host computers.

6 . The method of claim 3 , wherein service operations include one of a firewall operation, a load balancing operation, a network address translation operation, an encryption operation, an intrusion detection operation, and an intrusion prevention operation.

7 . The method of claim 1 , wherein the middlebox service elements include firewalls machines or devices.

8 . The method of claim 1 , wherein the multi-segmented application has more at least three application segments defined in the hierarchical API command.

9 . The method of claim 1 , wherein the multi-segmented application has more than five application segments defined in the hierarchical API command.

10 . The method of claim 1 , wherein the set of deployed machines comprise virtual machines or containers.

11 . A non-transitory machine readable medium storing a program for defining a multi-segmented application in a software defined datacenter (SDDC), the program for execution by at least one processing unit, the program comprising sets of instructions for:
storing as a template a hierarchical API command that specifies a plurality of application segments and defines a plurality of rules to control data message flows associated with the application segments; providing an interface to allow the template to be retrieved and customized in order to define a multi-segment application manifest to process to deploy a set of machines in the SDDC to implement the set of application segments and to provide the set of rules to a set of network elements in the SDDC to control the data message flows associated with the application segments.

12 . The non-transitory machine readable medium of claim 11 , wherein the network elements include managed forwarding elements for forwarding data messages between the application segments and between the application segments and applications other than the multi-segment application.

13 . The non-transitory machine readable medium of claim 11 , wherein the network elements include middlebox service elements for performing middlebox service operations on data messages sent to or from the application segments.

14 . The non-transitory machine readable medium of claim 13 , wherein the middlebox service elements include middlebox service machines executing on host computers.

15 . The non-transitory machine readable medium of claim 13 , wherein the middlebox service elements include middlebox service filters executing on host computers.

16 . The non-transitory machine readable medium of claim 13 , wherein service operations include one of a firewall operation, a load balancing operation, a network address translation operation, an encryption operation, an intrusion detection operation, and an intrusion prevention operation.

17 . The non-transitory machine readable medium of claim 11 , wherein the middlebox service elements include firewalls machines or devices.

18 . The non-transitory machine readable medium of claim 11 , wherein the multi-segmented application has more at least three application segments defined in the hierarchical API command.

19 . The non-transitory machine readable medium of claim 11 , wherein the multi-segmented application has more than five application segments defined in the hierarchical API command.

20 . The non-transitory machine readable medium of claim 11 , wherein the set of deployed machines comprise virtual machines or containers.

Assignees

• Vmware Inc

Inventors

• Myneni Sirisha
• Chanda Arijit
• Gunda Laxmikant Vithal
• Poon Arnold
• Ghannadian Farzad
• Kumar Kausum

Classifications

• G06F2209/547

  Messaging middleware · CPC title

• G06F9/5061

  Partitioning or combining of resources · CPC title

• G06F9/546 Primary

  Message passing systems or structures, e.g. queues · CPC title

• H04L63/029

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• G06F8/60

  Software deployment · CPC title