# US 12,120,088 B2 · Defining services for virtual interfaces of workloads

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,120,088 B2
- Document ID: US12120088B2
- Status: Granted
- Kind: B2
- Application number: 16/897,666
- Filed: 2020-06-10
- Published: 2021-10-07
- Granted: 2024-10-15
- Earliest claimed: 2020-04-01
- Assignees: VMware, Inc.
- Applicants: VMware LLC
- Inventors: Zhengsheng Zhou; Kai Su; Jackie Lan; Danting Liu; Qian Sun; Donghai Han
- Web page: https://patentgrep.com/patent/US12120088B2

## CPC

- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 9/5083: {Techniques for rebalancing the load in a distributed system}
- G06F 9/54: Interprogram communication
- G06F 9/547: {Remote procedure calls [RPC]; Web services}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
- H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play
- H04L 41/0883: {Semiautomatic configuration, e.g. proposals from system}
- H04L 41/0893: Assignment of logical groups to network elements
- H04L 41/0894: Policy-based network configuration management
- H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
- H04L 41/18: Delegation of network management function, e.g. customer network management [CNM]
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L 41/5048: {Automatic or semi-automatic definitions, e.g. definition templates}
- H04L 41/5077: {wherein the managed service relates to simple transport services, i.e. providing only network infrastructure}
- H04L 45/42: Centralised routing
- H04L 45/586: of virtual routers
- H04L 49/70: {Virtual switches}
- H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
- H04L 61/50: Address allocation
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0218: {Distributed architectures, e.g. distributed firewalls}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0263: {Rule management}
- H04L 63/0272: {Virtual private networks}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/1001: for accessing one among a plurality of replicated servers
- G06F 8/60: Software deployment
- G06F 9/5077: {Logical partitioning of resources; Management or configuration of virtualized resources (specific details on emulation or internal functioning of virtual machines G06F9/455)}
- G06F 2009/45562: {Creating, deleting, cloning virtual machine instances}
- G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L 47/125: by balancing the load, e.g. traffic engineering
- H04L 61/2503: Translation of Internet protocol [IP] addresses
- H04L 61/2514: between local and global IP addresses
- H04L 61/5038: for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
- H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses
- H04L 2101/668: Internet protocol [IP] address subnets
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Some embodiments of the invention provide a method for deploying network elements for a set of machines in a set of one or more datacenters. The datacenter set is part of one availability zone in some embodiments. The method receives intent-based API (Application Programming Interface) requests, and parses these API requests to identify a set of network elements to connect and/or perform services for the set of machines. In some embodiments, the API is a hierarchical document that can specify multiple different compute and/or network elements at different levels of compute and/or network element hierarchy. The method performs automated processes to define a virtual private cloud (VPC) to connect the set of machines to a logical network that segregates the set of machines from other machines in the datacenter set. In some embodiments, the set of machines include virtual machines and containers, the VPC is defined with a supervisor cluster namespace, and the API requests are provided as YAML files.

## Claims

### Claim 1

A method of deploying network elements for a set of machines in a set of one or more datacenters automatically and without user intervention, the method comprising:
defining, by a network controller plug-in (NCP), a different virtual interface (VIF) for each of a plurality of virtual machines (VMs) and a plurality of Pods executing on a plurality of host computers along with a plurality of software switches, wherein each pod comprises a set of containers;
allocating, by the NCP, a different network address for each VIF;
assigning, by the NCP, each network address to the VIF for which the network address was allocated; and
associating, by the NCP, each VIF with a different port of a software switch executing on a host computer of the plurality of host computers that executes the VIF's associated virtual machine or Pod, wherein at least one particular virtual machine of the plurality of virtual machines and at least one particular Pod of the plurality of Pods execute on one particular host computer of the plurality of host computers and have their respective VIFs associated with two ports of a same software switch that executes on the particular host computer along with the particular virtual machine and the particular Pod.

### Claim 2 (depends on 1)

The method of claim 1, wherein the plurality of software switches implements a logical network and the allocated network addresses belong to a subnet of the logical network, the logical network segregating the plurality of VMs from other machines in the datacenter set that are not part of the logical network.

### Claim 3 (depends on 2)

The method of claim 2, wherein the software switches implement the logical network by implementing at least one logical switch of the logical network, the logical switch spanning two or more host computers.

### Claim 4 (depends on 1)

The method of claim 1 further comprising associating each of a set of two or more VIFs with a distributed middlebox service operation that is to be performed by a middlebox service engine on the host computer that executes the associated VM of the VIF.

### Claim 5 (depends on 4)

The method of claim 4, wherein the distributed middlebox service operation is a distributed firewall operation, and the service engines on two or more host computers of the set of two or more VIFs implements a distributed firewall.

### Claim 6 (depends on 4)

The method of claim 4, wherein the distributed middlebox service operation is a distributed load balancing operation, and the service engines on two or more host computers of the set of two or more VIFs implements a distributed load balancer.

### Claim 7

A method of deploying network elements for a set of machines in a set of one or more datacenters automatically and without user intervention, the method comprising:
defining, by a network controller plug-in (NCP), a different virtual interface (VIF) for each of a plurality of virtual machines and a plurality of Pods executing on a plurality of host computers along with a plurality of physical forwarding elements (PFEs), wherein each pod comprises a set of containers;
allocating, by the NCP, a different network address for each VIF;
assigning, by the NCP, each network address to the VIF for which the network address was allocated; and
associating, by the NCP, each VIF with a different one PFE of the plurality of PFEs executing on a host computer of the plurality of host computers that executes the VIF's associated virtual machine or Pod, wherein:
the set of machines comprises Kubernetes Pods and non-Kubernetes Pods such that the plurality of pods includes the non-Kubernetes Pods,
the VIFs are defined by the NCP for non-Kubernetes Pods but are not defined for Kubernetes Pods, and
the VIFs of non-Kubernetes Pods are associated by the NCP with a first set of PFEs of the plurality of PFEs while predefined interfaces of the Kubernetes Pods are associated by the NCP with a second set of PFEs of the plurality of PFEs such that the non-Kubernetes Pods are accessed via an associated PFE of the first set of PFEs and the Kubernetes Pods are accessed via an associated PFE of the second set of PFEs.

### Claim 8 (depends on 1)

The method of claim 1, wherein defining the VIFs comprises processing a Custom Resource Definition (CRD) that specifies a VIF as a resource in the datacenter.

### Claim 9

A method of deploying network elements in a set of one or more datacenters automatically and without user intervention, the method comprising:
defining, by a network controller plug-in (NCP), a different virtual interface (VIF) for each of a plurality of virtual machines and a plurality of Pods executing on a plurality of host computers along with a plurality of physical forwarding elements (PFEs), wherein each pod comprises a set of containers, wherein defining the VIFs comprises (i) receiving intent-based API (Application Programming Interface) requests to define a plurality of VIFs for the plurality of Pods, (ii) using a custom resource definition (CRD) defined for VIFs to parse and process the API request to define the VIFs for the Pods;
allocating, by the NCP, a different network address for each VIF;
assigning, by the NCP, each network address to the VIF for which the network address was allocated; and
associating, by the NCP, each VIF with one different PFE executing on a host computer of the plurality of host computers that executes the VIF's associated virtual machine or Pod.

### Claim 10 (depends on 9)

The method of claim 9 further comprising:
receiving an intent-based API request that specifies a service operation provided by a plurality of machines; and
using a CRD defined for service operations to perform an automated process that parses and processes a service-operation API to associate each of a set of two or more VIFs with a distributed load balancing operation that is to be performed by a load balancing engine on the host computer that executes the associated VM or Pod of the VIF,
the load balancing engine performs the distributed load balancing operation to implement the service for the plurality of machines, in order to distribute the load from the VMs and Pods of the set of VIFs across the plurality of machines.

### Claim 11 (depends on 2)

The method of claim 2, wherein the logical network is a network defined for a virtual private cloud (VPC), and the network addresses allocated to the logical network are addresses allocated to the VPC.

### Claim 12 (depends on 1)

The method of claim 1, wherein the datacenter set comprises one or more datacenters that are associated with an availability zone identified by a software defined datacenter (SDDC) interface.

### Claim 13 (depends on 1)

The method of claim 1, wherein the allocated plurality of network addresses is from a first subnet, the method further comprising:
while defining a new VIF, determining that there are no remaining network addresses to allocate from the first subnet;
allocating a second of subnet of network addresses;
assigning a network address from the newly allocated second subnet to the new VIF;
associating the new VIF with a machine; and
associating the new VIF with a port of a software switch executing on a host computer along with the VIF's associated machine.

### Claim 14 (depends on 13)

The method of claim 13, wherein the plurality of software switches implements a logical network and the first and second subnets are first and second sub-networks of the logical network.

### Claim 15 (depends on 13)

The method of claim 13 further comprising configuring the plurality of software switches to implement first and second logical switches that establish the first and second logical sub-networks.

### Claim 16 (depends on 15)

The method of claim 15 further comprising configuring the plurality of software switches to connect the first and second logical switches to a gateway router that is deployed for the logical network.

### Claim 17 (depends on 16)

The method of claim 16, wherein the gateway router is a logical router comprising a plurality of distributed routing forwarding elements and a centralized routing forwarding element.