CONTROL AND MANAGEMENT OF VIRTUAL SYSTEMS

• US 20080134178A1
• Filed: 11/27/2007
• Published: 06/05/2008
• Est. Priority Date: 10/17/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: ManageIQ, Inc. (International Business Machines Corporation)
• Inventors: Barenboim, Oleg, Fitzgerald, Joseph
• Granted Patent: US 8,949,826 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45562 Creating, deleting, cloning virtual machine instances
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105

Abstract

Techniques are disclosed for controlling and managing virtual machines and other such virtual systems. VM execution approval is based on compliance with policies controlling various aspects of VM. The techniques can be employed to benefit all virtual environments, such as virtual machines, virtual appliances, and virtual applications. For ease of discussion herein, assume that a virtual machine (VM) represents each of these environments. In one particular embodiment, a systems management partition (SMP) is created inside the VM to provide a persistent and resilient storage for management information (e.g., logical and physical VM metadata). The SMP can also be used as a staging area for installing additional content or agentry on the VM when the VM is executed. Remote storage of management information can also be used. The VM management information can then be made available for pre-execution processing, including policy-based compliance testing.

Claims

1. A method for managing and controlling virtual machines, comprising:

accessing a virtual machine (VM) for use in a managed system;

prior to executing the VM, applying one or more compliance policies to the VM to determine if the VM is compliant with a VM compliance scheme associated with the managed system;

in response to the VM being non-compliant, adapting the VM into compliance pre-execution; and

analyzing adaptations made to the VM, and deriving an optimized variant of the VM based on the analysis.

2. The method of claim 1 wherein the VM is accessed from a repository included in the managed system, the method further comprising the preliminary steps of:

registering one or more VMs for use in the managed system; and

storing the registered VMs in the repository.

3. The method of claim 2 wherein registering one or more virtual machines comprises:

generating a unique ID for each VM;

extracting at least one of logical and physical metadata about each VM; and

storing the unique ID and metadata for use in a VM management and control scheme.

4. The method of claim 2 wherein registering one or more virtual machines comprises:

creating a management partition in each VM for storing management data for use in a VM management and control scheme, including the unique ID and metadata associated with the corresponding VM.

5. The method of claim 2 wherein registering one or more virtual machines comprises:

generating one or more signatures using at least one of logical and physical metadata extracted from at least one of the VM and its execution platform; and

storing the one or more signatures;

wherein at least some of the one or more compliance policies are signature-based policies thereby allowing the applying step to be carried out using signature comparisons.

6. The method of claim 5 further comprising:

generating a system signature based on the one or more signatures.

7. The method of claim 5 wherein registering one or more virtual machines comprises:

creating a management partition in each VM for storing management data for use in a VM management and control scheme, including the unique ID, metadata, and one or more signatures.

8. The method of claim 1 wherein accessing the VM for use in a managed system comprises:

requesting the VM via logical name, which is resolved into an explicit name;

looking-up the explicit named VM to a find source location where the VM is stored; and

transferring the VM or a copy of the VM to a target execution platform.

9. The method of claim 1 wherein accessing the VM for use in a managed system further comprises at least one of:

decompressing the VM;

decrypting the VM; and

translating the VM to a target execution platform format.

10. The method of claim 1 further comprising the preliminary step of receiving a request to use the VM, thereby initiating the accessing step.

11. The method of claim 1 further comprising:

applying one or more compliance policies to an execution platform of the VM to determine if the execution platform is compliant with the VM compliance scheme associated with the managed system;

in response to the execution platform being non-compliant, adapting the execution platform into compliance prior to executing the VM; and

in response to an execution platform adaptation being desirable for permanent use, suggesting and/or deriving a variant of the execution platform that permanently includes the desired adaptation.

12. The method of claim 1 wherein deriving an optimized variant of the VM includes permanently committing a compliance-based adaptation to the VM, in response to learning that the adaptation is consistently made to the VM.

13. The method of claim 1 wherein in response to adaptation analysis indicating an undesirable adaptation has occurred, discarding that adaptation.

14. The method of claim 1 further comprising:

in response to the VM being compliant with the VM compliance scheme, executing the VM in an execution platform.

15. The method of claim 14 further including execution analysis, comprising:

periodically examining the VM during execution; and

in response to a detected non-compliancy, taking remedial action.

16. The method of claim 14 further including post-execution analysis, comprising:

in response to post-execution VM content being non-compliant with the VM compliance scheme, taking remedial action including preventing non-compliant changes from being committed.

17. The method of claim 1 wherein applying one or more compliance policies to the VM comprises:

getting content metadata of the VM;

getting compliance policies regarding content of the VM; and

applying the compliance policies against the content metadata prior to executing the VM.

18. The method of claim 17 wherein at least one or more compliance policies with which the VM must comply to execute are signature-based policies, and applying one or more compliance policies to the VM comprises:

comparing at least one signature of the content metadata against at least one signature-based policy;

wherein the comparison generates a result upon which a compliancy determination is made.

19. The method of claim 17 wherein at least one or more compliance policies with which the VM must comply to execute are signature-based policies, and applying one or more compliance policies to the VM comprises:

comparing a system signature against at least one signature-based policy, wherein the system signature is based on the one or more signatures;

wherein the comparison generates a result upon which a compliancy determination is made.

20. The method of claim 1 further comprising:

in response to the VM being non-compliant with the VM compliance scheme, taking remedial action.

21. The method of claim 1 wherein adapting the VM into compliance pre-execution comprises at least one of direct manipulation of VM content, direct manipulation of settings associated with at least one of the VM and an execution platform of the VM, and insertion of data into the VM.

22. The method of claim 1 wherein applying one or more compliance policies to the VM occurs after a VM start request is received and prior to executing the VM in response to that VM start request.

23. The method of claim 1 wherein the VM is a virtual application or a virtual appliance.

24. A system for managing and controlling virtual machines, comprising:

an access module for accessing a virtual machine (VM) for use in a managed system;

an enforce module for, prior to execution of the VM, applying one or more compliance policies to the VM to determine if the VM is compliant with a VM compliance scheme associated with the managed system;

an adapt module for, in response to the VM being non-compliant, adapting the VM into compliance pre-execution; and

an optimization module for analyzing adaptations made to the VM, and deriving an optimized variant of the VM based on the analysis.

25. One or more machine-readable mediums encoded with instructions, that when executed by one or more processors, cause the processor to carry out a process for managing and controlling virtual machines, the process comprising:

accessing a virtual machine (VM) for use in a managed system;

prior to executing the VM, applying one or more compliance policies to the VM to determine if the VM is compliant with a VM compliance scheme associated with the managed system;

in response to the VM being non-compliant, adapting the VM into compliance pre-execution; and

analyzing adaptations made to the VM, and deriving an optimized variant of the VM based on the analysis.