Barefoot Networks, Inc.

Vmware, Inc.

Antonin Mathieu Bas

Changhoon Kim

Anurag Agrawal

Quan Tian

Wenying Dong

Jianjun Shen

Srikar Tati

Ran Gu

Some embodiments provide a method for an agent executing on a Kubernetes node in a cluster. The method instructs a forwarding element that also executes on the node to process a flow tracing packet. From the forwarding element, the method receives a message indicating a set of flow entries matched by the flow tracing packet as the forwarding element processes the flow tracing packet. For each flow entry of at least a subset of the flow entries matched by the flow tracing packet, the method generates mapping data that maps elements of the flow entry to Kubernetes concepts implemented in the cluster. The method reports data regarding the set of flow entries along with the generated mapping data.

Flow tracing operation in container cluster

Some embodiments provide a method for a module executing on a Kubernetes node in a cluster. The method retrieves data regarding ongoing connections processed by a forwarding element executing on the node. The method maps the retrieved data to Kubernetes concepts implemented in the cluster. The method exports the retrieved data along with the Kubernetes concepts to an aggregator that receives data regarding ongoing connections from a plurality of nodes in the cluster.

Connection tracking for container cluster

Some embodiments provide novel circuits for augmenting the functionality of a data plane circuit of a forwarding element with one or more field programmable circuits and external memory circuits. The external memories in some embodiments serve as deep buffers that receive through one or more FPGAs a set of data messages from the data plane (DP) circuit to store temporarily. In some of these embodiments, one or more of the FPGAs implement schedulers that specify when data messages should be retrieved from the external memories and provided back to the data plane circuit for forwarding through the network. For instance, in some embodiments, a particular FPGA can perform a scheduling operation for a first set of data messages stored in its associated external memory, and can direct another FPGA to perform the scheduling operation for a second set of data messages stored in the particular FPGA's associated external memory. Specifically, in these embodiments, the particular FPGA determines when the first subset of data messages stored in its associated external memory should be forwarded back to the data plane circuit to forward to data messages in the network, while directing another FPGA to determine when a second subset of data messages stored in the particular FPGA's external memory should be forwarded back to the data plane circuit.

Augmenting data plane functionality with field programmable integrated circuits

Some embodiments provide novel circuits for recording data messages received by a data plane circuit of a forwarding element in an external memory outside of the data plane circuit. The external memory in some embodiments is outside of the forwarding element. In some embodiments, the data plane circuit encapsulates the received data messages that should be recorded with encapsulation headers, inserts into these headers addresses that identify locations for storing these data messages in a memory external to the data plane circuit, and forwards these encapsulated data messages so that these messages can be stored in the external memory by another circuit. Instead of encapsulating received data messages for storage, the data plane circuit in some embodiments encapsulates copies of the received data messages for storage. Accordingly, in these embodiments, the data plane circuit makes copies of the data messages that it needs to record.

Recording in an external memory data messages processed by a data plane circuit

Some embodiments provide a method that receives a request for flow entries associated with a particular Kubernetes concept. The method identifies flow entries that match the request. For each flow entry that matches the request, the method generates mapping data that maps elements of the flow entry to additional Kubernetes concepts. The method provides the flow entries with the mapping data in response to the request.

Monitoring container clusters

Some embodiments use one or more FPGAs and external memories associated with the FPGAs to implement large, hash-addressable tables for a data plane circuit. These embodiments configure at least one message processing stage of the DP circuit to store (1) a first plurality of records for matching with a set of data messages received by the DP circuit, and (2) a redirection record redirecting data messages that do not match the first plurality of records to a DP egress port associated with the memory circuit. These embodiments configure an external memory circuit to store a larger, second set of records for matching with redirected data messages received through the DP egress port associated with the memory circuit. This external memory circuit is a hash-addressable memory in some embodiments. To determine whether a redirected data message matches a record in the second set of record, the method of some embodiments configures an FPGA associated with the hash-addressable external memory to use a collision free hash process to generate a collision-free, hash address value from a set of attributes of the data message. This hash address value specifies an address in the external memory for the record in the second set of records to compare with the redirected data message.

Growing community of inventors

Palo Alto, CA, United States of America

Antonin Mathieu Bas