Vmware, Inc.

Abhishek Srivastava

Adrian Drzewiecki

David A Dunn

Ashish Kaila

Jesse Pool

Julien Freche

Daniel Mueller

Yash Nitin Desai

Wenguang Wang

Benjamin J Corrie

Bryan Tan

Aditya Sarwade

Krishna Chaitanya Bandi

Rohith Jagannathan

Matthew Hinton

Lorenzo David

Nahim El Atmani

A log is received at a user space process of a host from a logical logging component of a virtual computing instance (VCI), the log generated by a container running on the VCI. The log is communicated from the user space process to a logical logging component of the host. The log is communicated from the logical logging component of the host to a logging process of the host. The log is configured and stored in host storage.

Host storage of container logs

An example virtualized computing system includes: a host cluster having a virtualization layer directly executing on hardware platforms of hosts, the virtualization layer supporting execution of virtual machines (VMs), the VMs including pod VMs and native VMs, the pod VMs including container engines supporting execution of containers in the pod VMs, the native VMs including applications executing on guest operating systems; an orchestration control plane integrated with the virtualization layer and including a master server and native VM controllers, the master server managing lifecycles of the pod VMs and the native VMs; and management agents, executing in the native VMs, configured to receive decoupled information from the master server through the native VM controllers and to provide the decoupled information for consumption by the applications executing in the native VMs, the decoupled information including at least one of configuration information and secret information.

Managing configuration and sensitive data for workloads in a virtualized computing system

An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes storing, in a trust authority, a pre-defined attestation report for a workload executing in a virtual machine (VM) managed by the virtualization layer, the pre-defined attestation report including a hash of at least a portion of an image of the VM; receiving, at the trust authority from a security module of a host in which the VM executes, an attestation report generated by measuring memory of the VM; comparing the attestation report with the pre-defined attestation report; and generating an indication of validity for the workload based on a result of the comparison.

Secure storage of workload attestation reports in a virtualized and clustered computer system

In one set of embodiments, confidential data needed by a workload component running within a worker VM can be placed on an encrypted virtual disk that is attached to the worker VM and hardware-based attestation can be used to validate the worker VM's software and isolate its guest memory from its hypervisor. Upon successful completion of this attestation process, a data decryption key can be delivered to the worker VM via a secure channel established via the attestation, such that the hypervisor cannot read or alter the key. The worker VM can then decrypt the contents of the encrypted virtual disk using the data decryption key, thereby granting the workload component access to the confidential data.

Leveraging hardware-based attestation to grant workloads access to confidential data

A framework is provided that assigns a digital certificate to each VM-based control plane element and computing node (i.e., worker VM) of a workload orchestration platform implemented in a virtualized environment, where the digital certificate is signed by a trusted entity and provides cryptographic proof that the control plane element/worker VM has been successfully attested by that trusted entity using hardware-based attestation. Each control plane element/worker VM is configured to verify the digital certificates of other platform components prior to communicating with those components. With these digital certificates in place, when an end-user submits to the platform's front-end control plane element a new workload for deployment, the end-user can verify the digital certificate of the front-end control plane element in order to be assured that the workload will be deployed and executed by the platform in a secure manner.

Secure end-to-end deployment of workloads in a virtualized environment using hardware-based attestation

Log information is retrieved from a log of a container running in a virtual machine in response to a request for the log information, by accessing a virtual disk of the virtual machine, reading the log of the container from the virtual disk and preparing the requested log information from the log, and transmitting the requested log information to a virtual machine (VM) management process running in a host computer of the virtual machine for the VM management process to forward to a requestor of the log information. Alternatively, log data of the container running in the virtual machine may be streamed to the VM management process over a virtual socket communication channel that is established between the virtual machine and the VM management process.

Method for accessing application logs within virtual machines based on operator-defined criteria

An example method of secure attestation of a workload deployed in a virtualized computing system is described. The virtualized computing system includes a host cluster and a virtualization management server, the host cluster having hosts and a virtualization layer executing on hardware platforms of the hosts. The method includes: launching, in cooperation with a security module of a host, a guest as a virtual machine (VM) managed by the virtualization layer, the security module generating an attestation report from at least a portion of the VM loaded into memory of the host; sending the attestation report from the security module to a trust authority; receiving, in response to verification of the attestation report by the trust authority, a secret from the trust authority at the security module; and providing the secret from the security module to the guest.

Provisioning identity certificates using hardware-based secure attestation in a virtualized and clustered computer system

A virtualized computing system includes: a host cluster including hosts executing a virtualization layer on hardware platforms thereof, the virtualization layer configured to support execution of virtual machines (VMs), the VMs including a pod VM, the pod VM including a container engine configured to support execution of containers in the pod VM, the pod VM including a first virtual disk attached thereto; and an orchestration control plane integrated with the virtualization layer, the orchestration control plane including a master server in communication with a pod VM controller, the pod VM controller configured to execute in the virtualization layer external to the VMs and cooperate with a pod VM agent in the pod VM, the pod VM agent generating root directories for the containers in the pod VM, each of the root directories comprising a union a read/write ephemeral layer stored on the first virtual disk and a read-only layer.

Ephemeral storage management for container-based virtual machines

Introspection into containers running in virtual machines (VMs) that are instantiated on a host computer is achieved. A method of processing an introspection command for a container, funning in a virtual machine, is carried out by a VM management process, and includes the steps of receiving a first request that is formulated according to a first protocol, e.g., transmission control protocol, and includes the introspection command, identifying the virtual machine from the first request, formulating a second request that includes the introspection command, according to a second protocol (e.g., virtual socket protocol), and transmitting the second request to a container management process running in the virtual machine for the container management process to execute the introspection command.

Introspection into workloads running within virtual machines

A method of probing a computer system includes steps of compiling a script that includes a call to a first function with first parameters, to generate executable code that includes a call to a second function with second parameters, wherein the second function and the second parameters are specified as values of the first parameters of the first function in the call to the first function, injecting the executable code into an executing module of the computer system, and as the executing module is running, executing the executable code to call the second function.

Calling arbitrary functions in the kernel via a probe script

The disclosure provides a technique for reducing cache misses to a cache of a computer system. The technique includes deallocating memory pages of the cache from one process and allocating those memory pages to another process based on cache misses of each process during a given time period. Repeating the technique leads the total number of cache misses to the cache to gradually decrease to an optimum or near optimum level. The repetition of the technique leads to a dynamic and flexible apportionment of cache memory pages to processes running within the computer system.

System and methods of a self-tuning cache sizing system in a cache partitioning system

Described herein are systems, methods, and software to enhance virtualization connection management for virtual remote direct memory access (RDMA) devices. In one implementation, virtual machines may register with a hypervisor for the virtual machines, wherein the registration for each virtual machine includes at least one address for the virtual machine. Once registered, the hypervisor may identify a packet placed in a queue pair from a physical RDMA interface and determine whether a destination address in the packet corresponds to a virtual machine. If the destination address corresponds to a virtual machine, then the hypervisor may provide a callback to the virtual machine, wherein the callback provides access to the packet in the virtual machine as if the packet received at a virtual RDMA interface of the virtual machine.

Growing community of inventors

Sunnyvale, CA, United States of America

Abhishek Srivastava