Centralized networking configuration in distributed systems

• US 10,002,011 B2
• Filed: 11/04/2013
• Issued: 06/19/2018
• Est. Priority Date: 11/04/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Lissack, Avichai Mendle
• Primary Examiner(s): Roumi, Mahran Abu
• Application Number:
  US14/071,316
• Publication Number:
  US 20150127783A1
• Time in Patent Office: 1,688 Days
• Field of Search: 709221
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/5022 by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components

Abstract

Methods and apparatus for centralized networking configuration in distributed systems are disclosed. Networking related metrics from a plurality of sources within a distributed system are obtained at a networking configuration server. A set of rules to be used to apply a network configuration option to a particular category of traffic associated with a node of the distributed system is determined based on the collected metrics and on networking management policies. A representation of the set of rules is transmitted to the node of the distributed system to schedule network transmissions in accordance with the networking configuration option.

Claims

1. A system, comprising:

a plurality of computing devices comprising one or more hardware processors and memory and configured to;

obtain, at one or more centralized servers of a networking configuration service, metrics from a plurality of sources, including network traffic metrics collected at a set of nodes configured to implement respective instances of a network-accessible service of a provider network;

determine, at the networking configuration service, based at least in part on the network traffic metrics and at least in part on a networking management policy, particular metadata that indicates a particular procedure to be applied to a particular category of network traffic associated with one of the respective instances of the network-accessible service at a particular node of the set of nodes and different metadata that indicates a different procedure to be applied to a different category of traffic associated with a different one of the respective instances of the network-accessible service at a different node of the set of nodes, wherein the particular procedure indicates at least a bandwidth limit, a latency requirement, a packet fragmentation configuration setting, or a configuration setting dependent at least in part on packet size, and the different procedure indicates at least a different bandwidth limit, a different latency requirement, a different packet fragmentation configuration setting, or a different configuration setting dependent at least in part on packet size;

transmit, from the networking configuration service;

a representation of the particular metadata to a control module at the particular node of the set of nodes; and

a representation of the different metadata to another control module at the different node of the set of nodes;

schedule one or more network transmissions at the particular node of the set of nodes according to the particular procedure indicated by the particular metadata determined at the networking configuration service, wherein for individual packets of the network traffic at the particular node, a corresponding category is determined at the particular node based at least in part on one or more of a corresponding packet header of the packet, a packet contents of the packet, a type of traffic, a client associated with the network traffic, or a priority associated with the traffic; and

schedule one or more network transmissions at the different node of the set of nodes according to the different procedure indicated by the different metadata determined at the network configuration service, wherein for each packet of the network traffic at the different node, a corresponding category is determined at the different node.

2. The system as recited in claim 1, wherein the plurality of sources include one or more of:

(a) a denial-of-service detector, (b) a per-network-address traffic metric aggregation service, or (c) a per-client traffic metric aggregation service.

3. The system as recited in claim 1, wherein the representation of the particular metadata is transmitted based at least in part on one of:

(a) a pre-determined schedule, (b) an occurrence of a triggering event, or (c) a request from the particular node.

4. The system as recited in claim 1, wherein the particular metadata determined at the networking configuration server comprises one or more rules to be used to classify a unit of network traffic into the particular category based at least in part on one of:

(a) a network endpoint address associated with the unit of network traffic, (b) a client on whose behalf the unit of network traffic is generated, or (c) an application on behalf of which the unit of network traffic is generated.

5. The system as recited in claim 1, wherein the plurality of computing devices are further configured to:

receive an indication of a configuration request submitted by one of;

(a) a client of the network-accessible service or (b) an administrator of the network-accessible service; and

modify one or more elements of the particular metadata in accordance with the configuration request.

6. A method, comprising:

performing, by a plurality of computing devices;

obtaining, at a networking configuration server, network traffic metrics from a plurality of sources associated with a network-accessible service of a provider network;

determining, at the networking configuration server, based at least in part on the network traffic metrics, a particular procedure to be applied to a particular category of network traffic associated with a particular instance of the network-accessible service and a different procedure to be applied to a different category of traffic associated with a different instance of the network-accessible service, wherein the particular procedure indicates at least a bandwidth limit, a latency requirement, a packet fragmentation configuration setting, or a configuration setting dependent at least in part on packet size, and the different procedure indicates at least a different bandwidth limit, a different latency requirement, a different packet fragmentation configuration setting, or a different configuration setting dependent at least in part on packet size;

transmitting, from the networking configuration server;

an indication of the particular procedure to a particular node of the provider network associated with the particular instance; and

an indication of the different procedure to a different node of the provider network; and

scheduling one or more network transmissions at the particular node according to the particular procedure determined at the networking configuration server, wherein for individual packets of the network traffic at the particular node, a corresponding category is determined at the particular node based at least in part on one or more of a corresponding packet header of the packet, a packet contents of the packet, a type of traffic, a client associated with the network traffic, or a priority associated with the traffic; and

scheduling one or more network transmissions at the different node of the set of nodes according to the different procedure determined at the network configuration service, wherein for each packet of the network traffic at the different node, a corresponding category is determined at the different node.

7. The method as recited in claim 6, wherein the plurality of sources include one or more of:

(a) the particular node, (b) a denial-of-service detector, (c) a per-network-address traffic aggregation service, or (d) a per-client traffic aggregation service.

8. The method as recited in claim 6, wherein said transmitting the indication of the particular procedure is initiated based at least in part on one of:

(a) a pre-determined schedule, (b) an occurrence of a triggering event, or (c) a request from the particular node.

9. The method as recited in claim 6, wherein the particular procedure determined at the networking configuration server comprises one or more rules to be used to classify a unit of network traffic into the particular category based at least in part on one of:

(a) a network endpoint address associated with the unit of network traffic, (b) a client on whose behalf the unit of network traffic is generated, or (c) an application on behalf of which the unit of network traffic is generated.

10. The method as recited in claim 6, wherein the provider network comprises a plurality of availability containers with respective failure profiles, further comprising performing, by the plurality of computing devices:

configuring at least one networking configuration server at each availability container of the plurality of availability containers.

11. The method as recited in claim 6, further comprising performing, by the plurality of computing devices:

determining a number of networking configuration servers to be instantiated based at least in part on a performance requirement associated with a time interval between a detection of an event that leads to transmission of the indication of the particular procedure, and an implementation of the particular procedure.

12. The method as recited in claim 6, wherein said determining the particular procedure is performed in response to a request from one of:

(a) a client of the network-accessible service or (b) an administrator of the network-accessible service.

13. The method as recited in claim 6, wherein the particular node to which the representation of the particular procedure is transmitted comprises one of:

(a) an instance host configurable to implement a service unit of the network-accessible service, (b) a switch, (c) a router, (d) a gateway (e) a load-balancer, or (f) a storage device.

14. The method as recited in claim 6, further comprising performing, by the plurality of computing devices:

providing, via one or more programmatic interfaces, a consolidated view of a networking status of a plurality of nodes configurable to support the network-accessible service.

15. The method as recited in claim 6, further comprising performing, by the plurality of computing devices:

providing, from the networking configuration server to an instance placement component associated with the network-accessible service, an indication of networking status information of a plurality of instance hosts of the network-accessible service, wherein the instance placement component is configured to utilize the indication to select a particular instance host at which a service instance of the network-accessible service is to be launched.

16. A non-transitory computer-accessible storage medium storing program instructions that when executed on one or more processors:

obtain, at a network configuration service, networking-related traffic metrics from a plurality of sources;

determine, at the network configuration service in accordance with one or more networking management policies and based at least in part on the networking-related traffic metrics, a particular set of rules to be used to apply to a particular category of traffic associated with a particular computing device and a different set of rules to be used to apply to a different category of traffic associated with a different computing device, wherein the particular procedure indicates at least a bandwidth limit, a latency requirement, a packet fragmentation configuration setting, or a configuration setting dependent at least in part on packet size, and the different procedure indicates at least a different bandwidth limit, a different latency requirement, a different packet fragmentation configuration setting, or a different configuration setting dependent at least in part on packet size;

schedule one or more network transmissions at the particular computing device according to the particular set of rules determined at the network configuration service, wherein for individual packets of the network traffic at the particular node, a corresponding category is determined at the particular node based at least in part on one or more of a corresponding packet header of the packet, a packet contents of the packet, a type of traffic, a client associated with the network traffic, or a priority associated with the traffic; and

schedule one or more network transmissions at the different node of the set of nodes according to the different set of rules determined at the network configuration service, wherein for each packet of the network traffic at the different node, a corresponding category is determined at the different node.

17. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the plurality of sources include one or more of:

(a) the particular computing device, (b) a denial-of-service detector, (c) a per-network-address traffic aggregation service, or (d) a per-client traffic aggregation service.

18. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the instructions when executed on the one or more processors:

schedule one or more network transmissions at the different computing device according to the different set of rules determined at the network configuration service.

19. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the particular set of rules comprises one or more rules to be used to classify a unit of network traffic into the particular category based at least in part on one of:

(a) a network endpoint address associated with the unit of network traffic, (b) a client on whose behalf the unit of network traffic is generated, or (c) an application on behalf of which the unit of network traffic is generated.

20. The non-transitory computer-accessible storage medium as recited in claim 16, wherein the particular computing device is configured to implement a service instance of a network-accessible service comprising one of:

(a) a virtualized computing service, (b) a storage service, or (c) a database service.