CN120826669A - System-selected interchangeable configurable properties of a compute instance - Google Patents

Abstract

Techniques for configuring and creating a compute instance are disclosed. A system may receive a request to launch a compute instance, where the compute instance is defined by a configurable property. The request includes one or more user-specified criteria for the configurable property, but does not include a specific value for the configurable property. The system determines a set of candidate values for the configurable property. The system selects a specific value for the configurable property from the set of candidate values for the configurable property based on the one or more user-specified criteria. The system stores the specific value in association with the configurable property; and launches the compute instance based on the system-selected specific value for the configurable property of the compute instance.

Description

System-selected interchangeable configurable attributes for computing instances

Incorporation by reference of disclaimer

Each of the following applications, application No.18/479,707 filed on day 2023, month 10, 2, application No.18/479,697 filed on day 2023, month 10, 7, application No.63/450,571 filed on day 2023, month 7, are hereby incorporated by reference. The applicant hereby removes disclaimers from the parent application(s) or any claim scope in its prosecution history and informs the U.S. patent and trademark office that the claims herein may be broader than any claim in the parent application(s).

Technical Field

The present disclosure relates to configuring computing instances in a cloud computing system. In particular, the present disclosure relates to configuring a compute instance when a requestor user specifies criteria that constrain the value(s) of the compute instance attribute, but does not specify the actual value(s) of the compute instance attribute.

Background

A user requesting creation of a computing instance from a cloud computing provider may specify values for a set of attributes that the user wishes the computing instance to have. For example, a user may specify the processor type, the region in which the computing instance is hosted, and the amount of available memory that the computing instance should have. If the cloud computing provider fails to meet one or more of the user requirements, the cloud computing service may fail to launch the requested computing instance even if a functionally equivalent computing instance is available. For example, the requested processor type may be available in a different area, or there may be equivalent processor architecture available in the requested area from a vendor other than the requested vendor.

The approaches described in this section are approaches that could be pursued, but not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.

Drawings

The embodiments are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings. It should be noted that references to "an" or "one" embodiment in this disclosure do not necessarily refer to the same embodiment, and mean at least one. In the drawings:

FIG. 1 is a block diagram illustrating one mode for implementing a cloud infrastructure as a service system in accordance with at least one embodiment;

FIG. 2 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system in accordance with at least one embodiment;

FIG. 3 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system in accordance with at least one embodiment;

FIG. 4 is a block diagram illustrating another mode for implementing a cloud infrastructure as a service system in accordance with at least one embodiment;

FIG. 5 is a block diagram illustrating an example computer system in accordance with at least one embodiment;

FIG. 6 illustrates a system in accordance with one or more embodiments;

FIG. 7 illustrates an example of a graphical user interface in accordance with one or more embodiments;

8A-8B illustrate an example set of operations for presenting a graphical user interface for configuring and launching a computing instance in accordance with one or more embodiments;

FIG. 9 illustrates an example set of operations for selecting an attribute of a configurable attribute when a user indicates that the system should select a value, in accordance with one or more embodiments;

FIG. 10 illustrates an example of a graphical user interface in accordance with one or more embodiments;

FIG. 11 illustrates an example of a graphical user interface in accordance with one or more embodiments, and

FIG. 12 illustrates an example of a graphical user interface in accordance with one or more embodiments.

Detailed Description

In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding. One or more embodiments may be practiced without these specific details. Features described in one embodiment may be combined with features described in a different embodiment. In some instances, well-known structures and devices are described with reference to block diagram form in order to avoid unnecessarily obscuring the present invention.

1. General overview

2. Infrastructure as a service

3. Computing instance configuration system architecture

4. Graphic user interface

5. Configuring computing instances

6. Example embodiment

7. Practical application, advantages and improvements

8. Computer network and cloud network

9. Other matters, expansion

A compute shape (computer shape) refers to a set of processing resources that may be allocated to a user as a compute instance within the cloud service provider's environment for performing a function or set of functions. A compute instance is a specific compute shape that is defined by a processing unit of a particular processor type, multiple cores of the processing unit, and the amount of memory available to the processing unit. The processor type may be defined by the processor architecture (e.g., x86 or ARM), the processor vendor (e.g., INTEL, AMD, or ARM), and the generation.

The compute instance may be further defined by additional configurable properties such as failure domain, availability domain, zone, and start-up time. A failure domain refers to a group of hardware components (e.g., computers and switches) that share a single point of failure. Availability domains are data centers that are physically isolated from other data centers and do not share resources such as power and cooling resources with other data centers. An area is a geographical grouping of multiple Availability Domains (ADs). ADs within an area may be interconnected by a low latency, high bandwidth network.

1. General overview

One or more embodiments configure a computing instance according to a configuration selected by a system constrained by user-specified criteria. First, the system receives a request to initiate a compute instance. The request includes one or more user-specified criteria for a particular configurable attribute of the computing instance, but does not include any particular value of the particular configurable attribute of the computing instance. The system selects a value from a set of candidate values for the particular configurable attribute of the computing instance based at least in part on one or more user-specified criteria that constrain possible values for the particular configurable attribute. The system initiates the compute instance using the values that the system selects for the particular configurable properties of the compute instance.

One or more embodiments select and launch a pool of n computing instances having the same value on at least one configurable attribute based on one or more user-specified criteria and available resources. The system receives a request to start a pool of n computing instances. The request includes one or more user-specified criteria for a particular configurable attribute. The system selects a value for the particular configurable attribute such that (a) the value meets a user-specified criteria and (b) there are sufficient resources to launch n compute instances with the same particular configurable attribute value for each of the n compute instances. The system starts the n computing instances, each of which has the same value for the particular configurable attribute.

One or more embodiments described in the specification and/or recited in the claims may not be included in this general overview section.

2. Infrastructure as a service

Infrastructure as a service (IaaS) is a specific type of cloud computing. The IaaS may be configured to provide virtualized computing resources over a public network (e.g., the internet). In the IaaS model, cloud computing providers may host infrastructure components (e.g., servers, storage devices, network nodes (e.g., hardware), deployment software, platform virtualization (e.g., hypervisor layer), etc.). In some cases, the IaaS provider may also provide various services to accompany these infrastructure components (example services include billing software, monitoring software, documenting software, load balancing software, clustering software, etc.). Thus, as these services may be policy driven, iaaS users may be able to implement policies to drive load balancing to maintain availability and performance of applications.

In some cases, the IaaS client may access resources and services through a Wide Area Network (WAN), such as the internet, and may use the cloud provider's services to install the remaining elements of the application stack. For example, a user may log onto the IaaS platform to create Virtual Machines (VMs), install an Operating System (OS) on each VM, deploy middleware such as databases, create buckets for workloads and backups, and even install enterprise software into that VM. The customer may then use the provider's services to perform various functions including balancing network traffic, solving application problems, monitoring performance, managing disaster recovery, and the like.

In most cases, the cloud computing model will require participation of the cloud provider. The cloud provider may, but need not, be a third party service that specifically provides (e.g., provisions, rents, sells) IaaS. An entity may also choose to deploy a private cloud, thereby becoming its own infrastructure service provider.

In some examples, the IaaS deployment is a process of placing a new application or a new version of an application onto a prepared application server or the like. It may also include a process of preparing a server (e.g., installation library, daemon, etc.). This is typically managed by the cloud provider, below the hypervisor layer (e.g., servers, storage, network hardware, and virtualization). Thus, the guest may be responsible for processing (OS), middleware, and/or application deployment (e.g., on a self-service virtual machine (e.g., that may be started on demand), etc.).

In some examples, iaaS provisioning may refer to obtaining computers or virtual hosts for use, even installing the required libraries or services on them. In most cases, the deployment does not include provisioning, and provisioning may need to be performed first.

In some cases, the IaaS supply presents two different challenges. First, there are initial challenges to provisioning an initial infrastructure set before anything runs. Second, once everything has been provisioned, there is a challenge to evolve the existing infrastructure (e.g., add new services, change services, remove services, etc.). In some cases, both of these challenges may be addressed by enabling the configuration of the infrastructure to be defined in a declarative manner. In other words, the infrastructure (e.g., which components are needed and how they interact) may be defined by one or more configuration files. Thus, the overall topology of the infrastructure (e.g., which resources depend on which resources, and how they work in concert) can be described in a declarative manner. In some cases, once the topology is defined, workflows may be generated that create and/or manage the different components described in the configuration file.

In some examples, an infrastructure may have many interconnected elements. For example, there may be one or more Virtual Private Clouds (VPCs) (e.g., potential on-demand pools of configurable and/or shared computing resources), also referred to as core networks. In some examples, there may also be one or more inbound/outbound traffic group rules, and one or more Virtual Machines (VMs), that are provisioned to define how inbound and/or outbound traffic of the network is to be set. Other infrastructure elements may also be supplied, such as load balancers, databases, etc. As more and more infrastructure elements are desired and/or added, the infrastructure may evolve.

In some cases, continuous deployment techniques may be employed to enable deployment of infrastructure code across various virtual computing environments. Furthermore, the described techniques may enable infrastructure management within these environments. In some examples, a service team may write code that is desired to be deployed to one or more, but typically many, different production environments (e.g., across various different geographic locations, sometimes across the entire world). In some examples, however, the infrastructure on which the code is to be deployed must first be set up. In some cases, provisioning may be done manually, resources may be provisioned with a provisioning tool, and/or code may be deployed with a deployment tool once the infrastructure is provisioned.

Fig. 1 is a block diagram 100 illustrating an example mode of the IaaS architecture in accordance with at least one embodiment. Service operator 102 may be communicatively coupled to a secure host lease 104, which may include a Virtual Cloud Network (VCN) 106 and a secure host subnet 108. In some examples, the service operator 102 may use one or more client computing devices, which may be portable handheld devices (e.g.,Cellular telephone,Computing tablet, personal Digital Assistant (PDA)) or wearable device (e.g., google)Head mounted display), such as Microsoft WindowsSuch as iOS, windows Phone, android, blackBerry, palm OS, etc., and enables internet, email, short Message Service (SMS), SMS,Or other communication protocol. Alternatively, the client computing device may be a general purpose personal computer, including, for example, microsoft running various versions of MicrosoftAppleAnd/or a personal computer and/or a laptop computer of a Linux operating system. The client computing device may be running a variety of commercial applicationsOr a workstation computer that resembles a UNIX operating system (including but not limited to any of a variety of GNU/Linux operating systems such as, for example, google Chrome OS). Alternatively, or in addition, the client computing device may be any other electronic device, such as a thin client computer, an internet-enabled gaming system (e.g., with or withoutMicrosoft Xbox game console of the gesture input device) and/or a personal messaging device that is capable of communicating over a network that has access to the VCN 106 and/or the internet.

The VCN 106 may include a local peer-to-peer gateway (LPG) 110 that may be communicatively coupled to a Secure Shell (SSH) VCN 112 via the LPG 110 contained in the SSH VCN 112. The SSH VCN 112 may include an SSH subnetwork 114, and the SSH VCN 112 may be communicatively coupled to the control plane VCN 116 via the LPG 110 contained in the control plane VCN 116. Moreover, the SSH VCN 112 may be communicatively coupled to the data plane VCN 118 via the LPG 110. The control plane VCN 116 and the data plane VCN 118 may be included in a service lease 119 that may be owned and/or operated by the IaaS provider.

The control plane VCN 116 may include a control plane demilitarized zone (DMZ) layer 120 that serves as a peripheral network (e.g., a portion of a corporate network between a corporate intranet and an external network). DMZ-based servers can assume limited responsibility and help control vulnerabilities. Further, DMZ layer 120 may include one or more Load Balancer (LB) subnets 122, a control plane application layer 124 that may include application subnet(s) 126, a control plane data layer 128 that may include Database (DB) subnets 130 (e.g., front end DB subnets and/or back end DB subnets). The LB subnet(s) 122 contained in the control plane DMZ layer 120 may be communicatively coupled to the application subnet(s) 126 contained in the control plane application layer 124 and the internet gateway 134 that may be contained in the control plane VCN 116, and the application subnet(s) 126 may be communicatively coupled to the DB subnet(s) 130 contained in the control plane data layer 128 and the service gateway 136 and Network Address Translation (NAT) gateway 138. The control plane VCN 116 may include a service gateway 136 and a NAT gateway 138.

Control plane VCN 116 may include a data plane mirror application layer 140, which may include application subnet(s) 126. The application subnet(s) 126 contained in the data plane mirror application layer 140 may include Virtual Network Interface Controllers (VNICs) 142 that may execute computing instances 144. The compute instance 144 may communicatively couple the application subnet(s) 126 of the data plane mirror application layer 140 to the application subnet(s) 126 that may be included in the data plane application layer 146.

Data plane VCN 118 may include a data plane application layer 146, a data plane DMZ layer 148, and a data plane data layer 150. The data plane DMZ layer 148 may include LB subnet(s) 122 that may be communicatively coupled to the application subnet(s) 126 of the data plane application layer 146 and the internet gateway 134 of the data plane VCN 118. Application subnet(s) 126 can be communicatively coupled to a serving gateway 136 of data plane VCN 118 and a NAT gateway 138 of data plane VCN 118. Data plane data layer 150 may also include DB subnet(s) 130 that may be communicatively coupled to application subnet(s) 126 of data plane application layer 146.

The control plane VCN 116 and the internet gateway 134 of the data plane VCN 118 may be communicatively coupled to a metadata management service 152, and the metadata management service 152 may be communicatively coupled to the public internet 154. Public internet 154 may be communicatively coupled to NAT gateway 138 of control plane VCN 116 and data plane VCN 118. The service gateway 136 of the control plane VCN 116 and the data plane VCN 118 may be communicatively coupled to the cloud service 156.

In some examples, service gateway 136 of control plane VCN 116 or data plane VCN 118 may make Application Programming Interface (API) calls to cloud services 156 without going through public internet 154. The API call from service gateway 136 to cloud service 156 may be unidirectional in that service gateway 136 may make an API call to cloud service 156 and cloud service 156 may send the requested data to service gateway 136. Cloud service 156 may not initiate an API call to service gateway 136.

In some examples, secure host lease 104 may be directly connected to service lease 119, and service lease 119 may be otherwise quarantined. The secure host subnetwork 108 may communicate with the SSH subnetwork 114 through the LPG 110, which LPG 110 may enable bi-directional communication over otherwise isolated systems. Connecting the secure host subnet 108 to the SSH subnet 114 may enable the secure host subnet 108 to access other entities within the service lease 119.

Control plane VCN 116 may allow a user of service lease 119 to set or otherwise provision desired resources. The desired resources provisioned in the control plane VCN 116 may be deployed or otherwise used in the data plane VCN 118. In some examples, control plane VCN 116 may be isolated from data plane VCN 118, and data plane mirror application layer 140 of control plane VCN 116 may communicate with data plane application layer 146 of data plane VCN 118 via VNIC 142, VNIC 142 may be included in data plane mirror application layer 140 and data plane application layer 146.

In some examples, a user or customer of the system may make a request, such as a create, read, update, or delete (CRUD) operation, through the public internet 154 that may communicate the request to the metadata management service 152. The metadata management service 152 may communicate the request to the control plane VCN 116 through the internet gateway 134. The request may be received by LB subnet(s) 122 contained in the control plane DMZ layer 120. The LB subnet(s) 122 may determine that the request is valid and, in response to the determination, the LB subnet(s) 122 may transmit the request to the application subnet(s) 126 contained in the control plane application layer 124. If the request is authenticated and calls to the public internet 154 are required, then the call to the public internet 154 may be transmitted to the NAT gateway 138 that may make the call to the public internet 154. Metadata that the request may desire to store may be stored in DB subnet(s) 130.

In some examples, data plane mirror application layer 140 may facilitate direct communication between control plane VCN 116 and data plane VCN 118. For example, it may be desirable to apply changes, updates, or other suitable modifications to the configuration to the resources contained in the data plane VCN 118. Via VNICs 142, control plane VCN 116 may communicate directly with resources contained in data plane VCN 118 and, thus, may perform changes, updates, or other suitable modifications to the configuration of resources contained in data plane VCN 118.

In some embodiments, control plane VCN 116 and data plane VCN 118 may be included in service lease 119. In this case, a user or customer of the system may not own or operate the control plane VCN 116 or the data plane VCN 118. Alternatively, the IaaS provider may own or operate the control plane VCN 116 and the data plane VCN 118, both of which may be contained in the service lease 119. This embodiment may enable isolation of networks that may prevent a user or customer from interacting with other users or other customers' resources. Moreover, this embodiment may allow users or clients of the system to store databases privately without relying on the public internet 154 for storage that may not have the desired threat prevention level.

In other embodiments, LB subnet(s) 122 contained in control plane VCN 116 may be configured to receive signals from service gateway 136. In this embodiment, control plane VCN 116 and data plane VCN 118 may be configured to be invoked by customers of the IaaS provider without invoking public internet 154. This embodiment may be desirable to customers of the IaaS provider because the database(s) used by the customers may be controlled by the IaaS provider and may be stored on the service lease 119, which service lease 119 may be isolated from the public internet 154.

Fig. 2 is a block diagram 200 illustrating another example mode of the IaaS architecture in accordance with at least one embodiment. Service operator 202 (e.g., service operator 102 of fig. 1) may be communicatively coupled to secure host lease 204 (e.g., secure host lease 104 of fig. 1), which secure host lease 204 may include Virtual Cloud Network (VCN) 206 (e.g., VCN 106 of fig. 1) and secure host subnet 208 (e.g., secure host subnet 108 of fig. 1). The VCN 206 may include a local peer-to-peer gateway (LPG) 210 (e.g., LPG 110 of fig. 1) that may be communicatively coupled to a Secure Shell (SSH) VCN 212 (e.g., SSH VCN 112 of fig. 1) via the LPG 110 contained in the SSH VCN 212. The SSH VCN 212 may include an SSH subnetwork 214 (e.g., SSH subnetwork 114 of fig. 1), and the SSH VCN 212 may be communicatively coupled to the control plane VCN 216 (e.g., control plane VCN 116 of fig. 1) via the LPG 210 contained in the control plane VCN 216. The control plane VCN 216 may be included in a service lease 219 (e.g., service lease 119 of fig. 1) and the data plane VCN 218 (e.g., data plane VCN 118 of fig. 1) may be included in a customer lease 221 that may be owned or operated by a user or customer of the system.

Control plane VCN 216 may include a control plane DMZ layer 220 (e.g., control plane DMZ layer 120 of fig. 1) that may include LB subnet(s) 222 (e.g., LB subnet(s) 122 of fig. 1), a control plane application layer 224 (e.g., control plane application layer 124 of fig. 1) that may include application subnet(s) 226 (e.g., application subnet(s) 126 of fig. 1), and a control plane data layer 228 (e.g., control plane data layer 128 of fig. 1) that may include Database (DB) subnet(s) 230 (e.g., similar to DB subnet(s) 130 of fig. 1). The LB subnet(s) 222 contained in the control plane DMZ layer 220 may be communicatively coupled to the application subnet(s) 226 contained in the control plane application layer 224 and the internet gateway 234 (e.g., the internet gateway 134 of fig. 1) that may be contained in the control plane VCN 216, and the application subnet(s) 226 may be communicatively coupled to the DB subnet(s) 230 contained in the control plane data layer 228 and the service gateway 236 (e.g., the service gateway 136 of fig. 1) and the Network Address Translation (NAT) gateway 238 (e.g., the NAT gateway 138 of fig. 1). Control plane VCN 216 may include a serving gateway 236 and a NAT gateway 238.

Control plane VCN 216 may include a data plane mirror application layer 240 (e.g., data plane mirror application layer 140 of fig. 1) that may include application subnet(s) 226. The application subnet(s) 226 included in the data plane mirror application layer 240 may include a Virtual Network Interface Controller (VNIC) 242 (e.g., a VNIC of 142) that may execute a computing instance 244 (e.g., similar to the computing instance 144 of fig. 1). The compute instance 244 may facilitate communication between application subnet(s) 226 of the data plane mirror application layer 240 and application subnet(s) 226 that may be included in a data plane application layer 246 (e.g., data plane application layer 146 of fig. 1) via VNICs 242 included in the data plane mirror application layer 240 and VNICs 242 included in the data plane application layer 246.

The internet gateway 234 included in the control plane VCN 216 may be communicatively coupled to a metadata management service 252 (e.g., the metadata management service 152 of fig. 1), and the metadata management service 252 may be communicatively coupled to a public internet 254 (e.g., the public internet 154 of fig. 1). Public internet 254 may be communicatively coupled to NAT gateway 238 included in control plane VCN 216. The service gateway 236 included in the control plane VCN 216 may be communicatively coupled to a cloud service 256 (e.g., the cloud service 156 of fig. 1).

In some examples, the data plane VCN 218 may be contained in a customer lease 221. In this case, the IaaS provider may provide the control plane VCN 216 for each customer, and the IaaS provider may set a unique computing instance 244 contained in the service lease 219 for each customer. Each computing instance 244 may allow communication between control plane VCN 216 contained in service lease 219 and data plane VCN 218 contained in customer lease 221. The compute instance 244 may allow resources provisioned in the control plane VCN 216 contained in the service lease 219 to be deployed or otherwise used in the data plane VCN 218 contained in the customer lease 221.

In other examples, the customer of the IaaS provider may have a database that exists in the customer lease 221. In this example, control plane VCN 216 may include a data plane mirror application layer 240, which may include application subnet(s) 226. The data plane mirror application layer 240 may reside in the data plane VCN 218, but the data plane mirror application layer 240 may not reside in the data plane VCN 218. That is, the data plane mirror application layer 240 may access the customer leases 221, but the data plane mirror application layer 240 may not exist in the data plane VCN 218 or be owned or operated by the customer of the IaaS provider. The data plane mirror application layer 240 may be configured to make calls to the data plane VCN 218, but may not be configured to make calls to any entity contained in the control plane VCN 216. A customer may desire to deploy or otherwise use resources provisioned in the control plane VCN 216 within the data plane VCN 218, and the data plane mirror application layer 240 may facilitate the customer's desired deployment or other use of the resources.

In some embodiments, the customer of the IaaS provider may apply the filter to the data plane VCN 218. In this embodiment, the customer may determine what the data plane VCN 218 may access, and the customer may restrict access to the public internet 254 from the data plane VCN 218. The IaaS provider may not be able to apply filters or otherwise control access of the data plane VCN 218 to any external network or database. The application of filters and controls by customers to the data plane VCN 218 contained in the customer leases 221 may help isolate the data plane VCN 218 from other customers and the public internet 254.

In some embodiments, cloud services 256 may be invoked by service gateway 236 to access services that may not exist on public internet 254, control plane VCN 216, or data plane VCN 218. The connection between cloud service 256 and control plane VCN 216 or data plane VCN 218 may not be real-time or continuous. Cloud services 256 may reside on different networks owned or operated by the IaaS provider. Cloud services 256 may be configured to receive calls from service gateway 236 and may be configured to not receive calls from public internet 254. Some cloud services 256 may be isolated from other cloud services 256, and control plane VCN 216 may be isolated from cloud services 256 that may not be in the same area as control plane VCN 216. For example, the control plane VCN 216 may be located in "zone 1" and the cloud service "deployment 1" may be located in zone 1 and "zone 2". If a service gateway 236 contained in the control plane VCN 216 located in zone 1 makes a call to deployment 1, the call may be transmitted to deployment 1 in zone 1. In this example, control plane VCN 216 or deployment 1 in region 1 may not be communicatively coupled or otherwise in communication with deployment 1 in region 2.

Fig. 3 is a block diagram 300 illustrating another example mode of the IaaS architecture in accordance with at least one embodiment. Service operator 302 (e.g., service operator 102 of fig. 1) may be communicatively coupled to secure host lease 304 (e.g., secure host lease 104 of fig. 1), which secure host lease 304 may include Virtual Cloud Network (VCN) 306 (e.g., VCN 106 of fig. 1) and secure host subnet 308 (e.g., secure host subnet 108 of fig. 1). The VCN 306 may include an LPG 310 (e.g., the LPG 110 of fig. 1) that may be communicatively coupled to an SSH VCN 312 (e.g., the SSH VCN 112 of fig. 1) via the LPG 310 contained in the SSH VCN 312. The SSH VCN 312 may include an SSH subnetwork 314 (e.g., SSH subnetwork 114 of fig. 1), and the SSH VCN 312 may be communicatively coupled to the control plane VCN 316 (e.g., control plane VCN 116 of fig. 1) via the LPG 310 contained in the control plane VCN 316 and to the data plane VCN 318 (e.g., data plane 118 of fig. 1) via the LPG 310 contained in the data plane VCN 318. The control plane VCN 316 and the data plane VCN 318 may be included in a service lease 319 (e.g., service lease 119 of fig. 1).

Control plane VCN 316 may include a control plane DMZ layer 320 (e.g., control plane DMZ layer 120 of fig. 1) that may include Load Balancer (LB) subnet(s) 322 (e.g., LB subnet(s) 122 of fig. 1), a control plane application layer 324 (e.g., control plane application layer 124 of fig. 1) that may include application subnet(s) 326 (e.g., similar to application subnet(s) 126 of fig. 1), and a control plane data layer 328 (e.g., control plane data layer 128 of fig. 1) that may include DB subnet(s) 330. The LB subnet(s) 322 contained in the control plane DMZ layer 320 may be communicatively coupled to the application subnet(s) 326 contained in the control plane application layer 324 and the internet gateway 334 (e.g., the internet gateway 134 of fig. 1) that may be contained in the control plane VCN 316, and the application subnet(s) 326 may be communicatively coupled to the DB subnet(s) 330 contained in the control plane data layer 328 and the service gateway 336 (e.g., the service gateway of fig. 1) and the Network Address Translation (NAT) gateway 338 (e.g., the NAT gateway 138 of fig. 1). The control plane VCN 316 may include a serving gateway 336 and a NAT gateway 338.

The data plane VCN 318 may include a data plane application layer 346 (e.g., the data plane application layer 146 of fig. 1), a data plane DMZ layer 348 (e.g., the data plane DMZ layer 148 of fig. 1), and a data plane data layer 350 (e.g., the data plane data layer 150 of fig. 1). The data plane DMZ layer 348 may include trusted application subnet(s) 360 and untrusted application subnet(s) 362 that may be communicatively coupled to the data plane application layer 346 and LB subnet(s) 322 of the internet gateway 334 contained in the data plane VCN 318. Trusted application subnet(s) 360 may be communicatively coupled to service gateway 336 included in data plane VCN 318, NAT gateway 338 included in data plane VCN 318, and DB subnet(s) 330 included in data plane data layer 350. The untrusted application subnet(s) 362 may be communicatively coupled to the service gateway 336 included in the data plane VCN 318 and the DB subnet(s) 330 included in the data plane data layer 350. The data plane data layer 350 may include DB subnet(s) 330 that may be communicatively coupled to service gateway 336 included in data plane VCN 318.

The untrusted application subnet(s) 362 may include one or more host VNICs 364 (1) - (N) that may be communicatively coupled to tenant Virtual Machines (VMs) 366 (1) - (N). Each tenant VM 366 (1) - (N) may be communicatively coupled to a respective application subnet 367 (1) - (N) that may be included in a respective container outlet VCN 368 (1) - (N), which respective container outlet VCN 368 (1) - (N) may be included in a respective customer lease 370 (1) - (N). The respective auxiliary VNICs 372 (1) - (N) may facilitate communications between the untrusted application subnet(s) 362 contained in the data plane VCN 318 and the application subnets contained in the container egress VCNs 368 (1) - (N). Each container egress VCN 368 (1) - (N) may include a NAT gateway 338, which NAT gateway 338 may be communicatively coupled to public internet 354 (e.g., public internet 154 of fig. 1).

The internet gateway 334 contained in the control plane VCN 316 and contained in the data plane VCN 318 may be communicatively coupled to a metadata management service 352 (e.g., the metadata management system 152 of fig. 1), which metadata management service 352 may be communicatively coupled to the public internet 354. Public internet 354 may be communicatively coupled to NAT gateway 338 contained in control plane VCN 316 and contained in data plane VCN 318. The service gateway 336 included in the control plane VCN 316 and in the data plane VCN 318 may be communicatively coupled to the cloud service 356.

In some embodiments, the data plane VCN 318 may be integrated with the customer lease 370. In some cases, such as where support may be desired while executing code, such integration may be useful or desirable to customers of the IaaS provider. The customer may provide code that may be destructive, may communicate with other customer resources, or may otherwise cause undesirable effects to operate. In response thereto, the IaaS provider may determine whether to run the code given to the IaaS provider by the customer.

In some examples, a customer of the IaaS provider may grant temporary network access to the IaaS provider and request functionality attached to the data plane application layer 346. Code that runs this function may be executed in VMs 366 (1) - (N), and the code may not be configured to run anywhere else on data plane VCN 318. Each VM 366 (1) - (N) can be connected to a customer lease 370. The respective containers 371 (1) - (N) contained in VMs 366 (1) - (N) may be configured to run code. In this case, there may be dual isolation (e.g., containers 371 (1) - (N) running code, where containers 371 (1) - (N) may be contained at least in VMs 366 (1) - (N) contained in untrusted application subnet(s) 362), which may help prevent incorrect or otherwise undesirable code from damaging the IaaS provider's network or damaging the network of a different customer. The containers 371 (1) - (N) may be communicatively coupled to the customer rental 370 and may be configured to transmit or receive data from the customer rental 370. The containers 371 (1) - (N) may not be configured to transmit or receive data from any other entity in the data plane VCN 318. After the execution of the code is complete, the IaaS provider may terminate or otherwise dispose of containers 371 (1) - (N).

In some embodiments, trusted application subnet(s) 360 may run code that may be owned or operated by the IaaS provider. In this embodiment, trusted application subnet(s) 360 may be communicatively coupled to DB subnet(s) 330 and configured to perform CRUD operations in DB subnet(s) 330. Untrusted application subnet(s) 362 may be communicatively coupled to DB subnet(s) 330, but in this embodiment, untrusted application subnet(s) may be configured to perform read operations in DB subnet(s) 330. Containers 371 (1) - (N), which may be contained in VMs 366 (1) - (N) of each customer and may run code from customers, may not be communicatively coupled to DB subnet(s) 330.

In other embodiments, control plane VCN 316 and data plane VCN 318 may not be directly communicatively coupled. In this embodiment, there may be no direct communication between the control plane VCN 316 and the data plane VCN 318. Communication may occur indirectly through at least one method. LPG 310 can be established by IaaS providers, which can facilitate communication between control plane VCN 316 and data plane VCN 318. In another example, control plane VCN 316 or data plane VCN 318 may invoke cloud service 356 via service gateway 336. For example, a call from control plane VCN 316 to cloud service 356 may include a request for a service that may communicate with data plane VCN 318.

Fig. 4 is a block diagram 400 illustrating another example mode of the IaaS architecture in accordance with at least one embodiment. Service operator 402 (e.g., service operator 102 of fig. 1) may be communicatively coupled to secure host lease 404 (e.g., secure host lease 104 of fig. 1), which secure host lease 404 may include Virtual Cloud Network (VCN) 406 (e.g., VCN 106 of fig. 1) and secure host subnet 408 (e.g., secure host subnet 108 of fig. 1). VCN 406 may include an LPG 410 (e.g., LPG 110 of fig. 1), which LPG 410 may be communicatively coupled to SSH VCN 412 via LPG 410 contained in SSH VCN 412 (e.g., SSH VCN 112 of fig. 1). The SSH VCN 412 may include an SSH subnetwork 414 (e.g., SSH subnetwork 114 of fig. 1), and the SSH VCN 412 may be communicatively coupled to the control plane VCN 416 (e.g., control plane VCN 116 of fig. 1) via the LPG 410 contained in the control plane VCN 416 and to the data plane VCN 418 (e.g., data plane 118 of fig. 1) via the LPG 410 contained in the data plane VCN 418. Control plane VCN 416 and data plane VCN 418 may be included in a service lease 419 (e.g., service lease 119 of fig. 1).

Control plane VCN 416 may include control plane DMZ layer 420 (e.g., control plane DMZ layer 120 of fig. 1) that may include LB subnet(s) 422 (e.g., LB subnet(s) 122 of fig. 1), control plane application layer 424 (e.g., control plane application layer 124 of fig. 1) that may include application subnet(s) 426 (e.g., application subnet(s) 126 of fig. 1), control plane data layer 428 (e.g., control plane data layer 128 of fig. 1) that may include DB subnet(s) 430 (e.g., DB subnet(s) 330 of fig. 3). The LB subnet(s) 422 contained in the control plane DMZ layer 420 may be communicatively coupled to the application subnet(s) 426 contained in the control plane application layer 424 and the internet gateway 434 (e.g., the internet gateway 134 of fig. 1) that may be contained in the control plane VCN 416, and the application subnet(s) 426 may be communicatively coupled to the DB subnet(s) 430 contained in the control plane data layer 428 and the service gateway 436 (e.g., the service gateway of fig. 1) and the Network Address Translation (NAT) gateway 438 (e.g., the NAT gateway 138 of fig. 1). Control plane VCN 416 may include a service gateway 436 and a NAT gateway 438.

The data plane VCN 418 may include a data plane application layer 446 (e.g., the data plane application layer 146 of fig. 1), a data plane DMZ layer 448 (e.g., the data plane DMZ layer 148 of fig. 1), and a data plane data layer 450 (e.g., the data plane data layer 150 of fig. 1). The data plane DMZ layer 448 may include trusted application subnet(s) 460 (e.g., trusted application subnet(s) 360 of fig. 3) and untrusted application subnet(s) 462 (e.g., untrusted application subnet(s) 362 of fig. 3) and LB subnet(s) 422 of the internet gateway 434 contained in the data plane VCN 418 that may be communicatively coupled to the data plane application layer 446. Trusted application subnet(s) 460 may be communicatively coupled to service gateway 436 contained in data plane VCN 418, NAT gateway 438 contained in data plane VCN 418, and DB subnet(s) 430 contained in data plane data layer 450. The untrusted application subnet(s) 462 may be communicatively coupled to the service gateway 436 contained in the data plane VCN 418 and the DB subnet(s) 430 contained in the data plane data layer 450. The data plane data layer 450 may include DB subnetwork(s) 430 that may be communicatively coupled to service gateway 436 included in the data plane VCN 418.

The untrusted application subnet(s) 462 may include a host VNIC 464 (1) - (N) that may be communicatively coupled to a tenant Virtual Machine (VM) 466 (1) - (N) residing within the untrusted application subnet(s) 462. Each tenant VM 466 (1) - (N) may run code in a respective container 467 (1) - (N) and be communicatively coupled to an application subnet 426 that may be contained in a data plane application layer 446 that may be contained in a container egress VCN 468. The respective auxiliary VNICs 472 (1) - (N) may facilitate communication between the untrusted application subnet(s) 462 contained in the data plane VCN 418 and the application subnet contained in the container egress VCN 468. The container egress VCN may include a NAT gateway 438 that may be communicatively coupled to the public internet 454 (e.g., public internet 154 of fig. 1).

The internet gateway 434 contained in the control plane VCN 416 and in the data plane VCN 418 may be communicatively coupled to a metadata management service 452 (e.g., the metadata management system 152 of fig. 1), which metadata management service 452 may be communicatively coupled to the public internet 454. Public internet 454 may be communicatively coupled to NAT gateway 438 contained in control plane VCN 416 and contained in data plane VCN 418. Service gateway 436 contained in control plane VCN 416 and contained in data plane VCN 418 may be communicatively coupled to cloud service 456.

In some examples, the pattern shown by the architecture of block 400 of fig. 4 may be considered an exception to the pattern shown by the architecture of block 300 of fig. 3, and if the IaaS provider cannot directly communicate with the customer (e.g., disconnected areas), such a pattern may be desirable to the customer of the IaaS provider. The guests may access respective containers 467 (1) - (N) contained in each guest's VM 466 (1) - (N) in real-time. The containers 467 (1) - (N) may be configured to invoke respective auxiliary VNICs 472 (1) - (N) contained in the application subnet(s) 426 of the data plane application layer 446, which may be contained in the container egress VCN 468. The auxiliary VNICs 472 (1) - (N) may transmit the call to the NAT gateway 438, and the NAT gateway 438 may transmit the call to the public internet 454. In this example, containers 467 (1) - (N), which may be accessed by clients in real-time, may be isolated from control plane VCN 416 and may be isolated from other entities contained in data plane VCN 418. Containers 467 (1) - (N) may also be isolated from resources from other clients.

In other examples, a customer may use containers 467 (1) - (N) to invoke cloud service 456. In this example, a customer may run code in containers 467 (1) - (N) that requests services from cloud service 456. The containers 467 (1) - (N) may transmit the request to the auxiliary VNICs 472 (1) - (N), and the auxiliary VNICs 472 (1) - (N) may transmit the request to a NAT gateway, which may transmit the request to the public internet 454. Public internet 454 may transmit the request to LB subnet(s) 422 contained in control plane VCN 416 via internet gateway 434. In response to determining that the request is valid, the LB subnet(s) may transmit the request to the application subnet(s) 426, which application subnet(s) 426 may transmit the request to the cloud service 456 via the service gateway 436.

It should be appreciated that the IaaS architecture 100, 200, 300, 400 depicted in the figures may have other components than those depicted. Additionally, the embodiments shown in the figures are merely some examples of cloud infrastructure systems that may incorporate embodiments of the present disclosure. In some other embodiments, the IaaS system may have more or fewer components than shown in the figures, may combine two or more components, or may have a different configuration or arrangement of components.

In certain embodiments, the IaaS system described herein may include application suites, middleware, and database service products that are delivered to customers in a self-service, subscription-based, elastically extensible, reliable, highly available, and secure manner. An example of such an IaaS system is the Oracle Cloud Infrastructure (OCI) offered by the present assignee.

FIG. 5 illustrates an example computer system 500 in which various embodiments may be implemented. System 500 may be used to implement any of the computer systems described above. As shown, computer system 500 includes a processing unit 504 that communicates with multiple peripheral subsystems via a bus subsystem 502. These peripheral subsystems may include a processing acceleration unit 506, an I/O subsystem 508, a storage subsystem 518, and a communication subsystem 524. Storage subsystem 518 includes tangible computer-readable storage media 522 and system memory 510.

Bus subsystem 502 provides a mechanism for letting the various components and subsystems of computer system 500 communicate with each other as intended. Although bus subsystem 502 is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. Bus subsystem 502 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. Such architectures can include Industry Standard Architecture (ISA) bus, micro Channel Architecture (MCA) bus, enhanced ISA (EISA) bus, video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus, which can be implemented as Mezzanine bus manufactured by the IEEE P1386.1 standard, for example.

The processing unit 504, which may be implemented as one or more integrated circuits (e.g., a conventional microprocessor or microcontroller), controls the operation of the computer system 500. One or more processors may be included in the processing unit 504. These processors may include single-core or multi-core processors. In some embodiments, processing unit 504 may be implemented as one or more separate processing units 532 and/or 534, each including a single-core or multi-core processor therein. In other embodiments, processing unit 504 may also be implemented as a four-core processing unit formed by integrating two dual-core processors into a single chip.

In various embodiments, the processing unit 504 may execute various programs in response to program code and may maintain multiple concurrently executing programs or processes. At any given time, some or all of the program code to be executed may reside within the processor(s) 504 and/or within the storage subsystem 518. The processor(s) 504 may provide the various functions described above by being suitably programmed. The computer system 500 may additionally include a processing acceleration unit 506, which may include a Digital Signal Processor (DSP), a special-purpose processor, or the like.

The I/O subsystem 508 may include user interface input devices and user interface output devices. The user interface input devices may include a keyboard, a pointing device such as a mouse or trackball, a touch pad or touch screen incorporated into a display, a scroll wheel, a click wheel, dials, buttons, switches, a keyboard, an audio input device with a voice command recognition system, a microphone, and other types of input devices. The user interface input device may include, for example, a motion sensing and/or gesture recognition device, such as Microsoft WindowsMotion sensors that enable users to control, for example, microsoft, through a natural user interface using gestures and voice commands360 To the input device of the game controller and interact therewith. The user interface input device may also include an eye gesture recognition device, such as detecting eye activity from a user (e.g., "blinking" when taking a photograph and/or making a menu selection) and converting the eye gesture to an input device (e.g., google) Google of input in (a)A blink detector. In addition, the user interface input device may include a device that enables a user to communicate with the voice recognition system via voice commands (e.g.,Navigator) interactive voice recognition sensing device.

User interface input devices may also include, but are not limited to, three-dimensional (3D) mice, joysticks or sticks, game pads and drawing tablets, as well as audio/video devices such as speakers, digital cameras, digital video cameras, portable media players, webcams, image scanners, fingerprint scanners, bar code reader 3D scanners, 3D printers, laser rangefinders and gaze tracking devices. Further, the user interface input device may include, for example, a medical imaging input device such as a computed tomography, magnetic resonance imaging, positron emission tomography, medical ultrasound device. The user interface input device may also include, for example, an audio input device such as a MIDI keyboard, digital musical instrument, or the like.

The user interface output device may include a display subsystem, an indicator light, or a non-visual display such as an audio output device, or the like. The display subsystem may be a Cathode Ray Tube (CRT), a flat panel device such as one using a Liquid Crystal Display (LCD) or a plasma display, a projection device, a touch screen, or the like. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from computer system 500 to a user or other computer. For example, user interface output devices may include, but are not limited to, various display devices that visually convey text, graphics, and audio/video information, such as monitors, printers, speakers, headphones, car navigation systems, plotters, voice output devices, and modems.

Computer system 500 may include a storage subsystem 518, which provides a tangible, non-transitory computer-readable storage medium, for storing software and data constructs that provide the functionality of the embodiments described in this disclosure. The software may include programs, code modules, instructions, scripts, etc. that when executed by one or more cores or processors of the processing unit 504 provide the functionality described above. Storage subsystem 518 may also provide a repository for storing data for use in accordance with the present disclosure.

As depicted in the example in fig. 5, storage subsystem 518 may include various components, including a system memory 510, a computer-readable storage medium 522, and a computer-readable storage medium reader 520. The system memory 510 may store program instructions that may be loaded and executed by the processing unit 504. The system memory 510 may also store data used during execution of instructions and/or data generated during execution of program instructions. Various different kinds of programs may be loaded into system memory 510, including but not limited to client applications, web browsers, middle tier applications, relational database management systems (RDBMS), virtual machines, containers, and the like.

The system memory 510 may also store an operating system 516. Examples of operating system 516 may include various versions of Microsoft WindowsAppleAnd/or Linux operating systems, various commercial applicationsOr UNIX-like operating systems (including but not limited to various GNU/Linux operating systems, googleOS, etc.) and/or mobile an operating system (such as iOS,Phone、OS、

OS and OSOS operating system). In some embodiments in which computer system 500 executes one or more virtual machines, the virtual machines, along with their Guest Operating Systems (GOSs), may be loaded into system memory 510 and executed by one or more processors or cores of processing unit 504.

The system memory 510 may take on different configurations depending on the type of computer system 500. For example, the system memory 510 may be volatile memory (such as Random Access Memory (RAM)) and/or nonvolatile memory (such as Read Only Memory (ROM), flash memory, and the like). Different types of RAM configurations may be provided, including Static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), and the like. In some implementations, the system memory 510 may include a basic input/output system (BIOS) that contains the basic routines that help to transfer information between elements within the computer system 500, such as during start-up.

Computer-readable storage media 522 may represent remote, local, fixed, and/or removable storage devices and storage media for temporarily and/or more permanently containing, storing computer-readable information for use by computer system 500, including instructions executable by processing unit 504 of computer system 500.

Computer-readable storage media 522 may include any suitable media known or used in the art, including storage media and communication media such as, but not limited to, volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage and/or transmission of information. This may include tangible computer-readable storage media such as RAM, ROM, electrically Erasable Programmable ROM (EEPROM), flash memory or other memory technology, CD-ROM, digital Versatile Disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or other tangible computer-readable media.

For example, computer-readable storage media 522 may include a hard disk drive that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive that reads from or writes to a removable, nonvolatile magnetic disk, and a removable, nonvolatile optical disk (such as a CD ROM, DVD, and a CD ROMA disk or other optical medium) to which a data signal is read or written. Computer-readable storage media 522 may include, but is not limited to,Drives, flash memory cards, universal Serial Bus (USB) flash drives, secure Digital (SD) cards, DVD discs, digital audio tape, and the like. The computer-readable storage medium 522 may also include non-volatile memory based Solid State Drives (SSDs) (such as flash memory based SSDs, enterprise flash drives, solid state ROMs, etc.), volatile memory based SSDs (such as solid state RAM, dynamic RAM, static RAM), DRAM based SSDs, magnetoresistive RAM (MRAM) SSDs, and hybrid SSDs that use a combination of DRAM and flash memory based SSDs. The disk drives and their associated computer-readable media may provide nonvolatile storage of computer readable instructions, data structures, program modules and other data for computer system 500.

Machine readable instructions executable by one or more processors or cores of processing unit 504 may be stored on a non-transitory computer readable storage medium. The non-transitory computer readable storage medium may include physically tangible memory or storage devices, including volatile memory storage devices and/or nonvolatile storage devices. Examples of non-transitory computer readable storage media include magnetic storage media (e.g., disk or tape), optical storage media (e.g., DVD, CD), various types of RAM, ROM, or flash memory, hard disk drives, floppy disk drives, detachable memory drives (e.g., USB drives), or other types of storage devices.

Communication subsystem 524 provides an interface to other computer systems and networks. Communication subsystem 524 serves as an interface for receiving data from and sending data to other systems from computer system 500. For example, communication subsystem 524 may enable computer system 500 to connect to one or more devices via the internet. In some embodiments, the communication subsystem 524 may include a Radio Frequency (RF) transceiver component for accessing a wireless voice and/or data network (e.g., advanced data network technology using cellular telephone technology such as 3G, 4G, or EDGE (enhanced data rates for global evolution), wiFi (IEEE 802.11 family standard), or other mobile communication technology, or any combination thereof), a Global Positioning System (GPS) receiver component, and/or other components. In some embodiments, communication subsystem 524 may provide a wired network connection (e.g., ethernet), in addition to or in place of the wireless interface.

In some embodiments, communication subsystem 524 may also receive input communications in the form of structured and/or unstructured data feeds 526, event streams 528, event updates 530, and the like, which may be received on behalf of one or more users of computer system 500.

For example, the communication subsystem 524 may be configured to receive data feeds 526, such as in real-time, from users of social networks and/or other communication servicesFeeding(s),Updates, web feeds such as Rich Site Summary (RSS) feeds, and/or real-time updates from one or more third-party information sources.

In addition, the communication subsystem 524 may also be configured to receive data in the form of a continuous data stream, which may include an event stream 528 and/or event updates 530 of real-time events that may be continuous or unbounded in nature without explicit termination. Examples of applications that generate continuous data may include, for example, sensor data applications, financial quoters, network performance measurement tools (e.g., network monitoring and traffic management applications), click stream analysis tools, automobile traffic monitoring, and so forth.

The communication subsystem 524 may also be configured to output structured and/or unstructured data feeds 526, event streams 528, event updates 530, and the like, to one or more databases, which may be in communication with one or more streaming data source computers coupled to the computer system 500.

The computer system 500 may be one of various types, including a handheld portable device (e.g.,Cellular telephone,A computing tablet, PDA), a wearable device (e.g.,Glass head mounted display), a PC, a workstation, a mainframe, a kiosk, a server rack, or any other data processing system.

Due to the ever-changing nature of computers and networks, the description of computer system 500 depicted in the drawings is intended only as a specific example. Many other configurations are possible with more or fewer components than the system depicted in the figures. For example, custom hardware may also be used and/or particular elements may be implemented in hardware, firmware, software (including applets), or a combination thereof. In addition, connections to other computing devices, such as network input/output devices, may also be employed. Based on the disclosure and teachings provided herein, one of ordinary skill in the art will recognize other ways and/or methods to implement various embodiments.

3. Computing instance configuration system architecture

Fig. 6 illustrates a system 600 in accordance with one or more embodiments. As shown in fig. 6, system 600 includes interface 602, computing instance configuration manager 610, and data repository 620. The compute instance configuration manager 610 may include one or more functional components such as a graphical user interface generator 612, a compute instance selector 616, a compute instance builder 618, and a machine learning algorithm 642.

In one or more embodiments, system 600 may include more or fewer components than those shown in FIG. 6. The components shown in fig. 6 may be located locally or remotely from each other. The components shown in fig. 6 may be implemented in software and/or hardware. Each component may be distributed across multiple applications and/or machines. Multiple components may be combined into one application and/or machine. Operations described with respect to one component may instead be performed by another component.

In one or more embodiments, compute instance configuration manager 610 refers to hardware and/or software configured to perform the operations described herein for receiving user input requesting creation of a compute instance, selecting from various options to create a compute instance that meets the request, and starting the compute instance. Examples of operations for receiving user input requesting creation of a computing instance, selecting from various options to create a computing instance that meets the request, and starting the computing instance will be described below with reference to fig. 8A-8B and 9.

In one or more embodiments, graphical User Interface (GUI) generator 612 refers to hardware and/or software configured to perform the operations described herein for displaying one or more interface elements 614 in a GUI, receiving user input 630 via interface elements 614, and providing information corresponding to a selection to compute instance selector 616 and/or compute instance builder 618. For example, GUI generator 612 may present interface elements corresponding to one or more configurable properties. The interface element may allow the user to indicate, for a given configurable attribute, whether the system should select a value, or whether the user will provide a value as the attribute value 632. Other interface elements may allow a user to select or input particular values of the configurable properties. Still other interface elements may allow a user to specify preferences and/or priorities that the system should consider when selecting values of the configurable properties. Examples of GUIs are discussed below with reference to FIGS. 7 and 10-12.

In one or more embodiments, compute instance selector 616 refers to hardware and/or software configured to perform the operations described herein for selecting a value of a compute instance when a user indicates that the system should make a selection. The compute instance selector 616 may select the value of the configurable attribute based on user specified criteria, such as user preferences 634. The compute instance selector 616 may select the value of the configurable attribute based on system-specified parameters including, for example, vendor criteria 622, supply chain information 626, cost information 628, and/or availability information 629. In one or more embodiments, the compute instance selector 616 may select the values of the configurable properties using a machine learning model 644 generated by a machine learning algorithm 642. In one or more embodiments, compute instance selector 616 may use instance selection logic 646 to select values of configurable properties.

In one or more embodiments, compute instance builder 618 refers to hardware and/or software configured to perform the operations described herein for receiving system-selected configurable attribute values and user-selected configurable attribute values and creating and launching a particular compute instance based on the configurable attribute values. The compute instance builder 618 may, for example, allocate a particular region and/or multiple cores of a particular processing unit of a particular processor type within an availability domain to a requesting user. The computing instance builder 618 can then make the assigned cores and any additional resources (such as networks and storage) that the user may need to use the computing instance available to the requesting user.

In one or more embodiments, data repository 620 is any type of storage unit and/or device (e.g., a file system, a database, a collection of tables, or any other storage mechanism) for storing data. In addition, data repository 620 may include a plurality of different storage units and/or devices. The plurality of different storage units and/or devices may or may not be of the same type or located at the same physical site. In addition, the data repository 620 may be implemented or executed on the same computing system as the computing instance configuration manager 610. Alternatively or additionally, the data repository 620 may be implemented or executed on a different computing system than the computing instance configuration manager 610. The data repository 620 may be communicatively coupled with the compute instance configuration manager 610 via a direct connection or via a network.

Vendor criteria 622 may include one or more parameters regarding the cloud service provider's resources, business models, or other factors that system 600 may consider when selecting particular values for configurable attributes. The supply chain information 626 may include information regarding installed computing shape resources as well as computing shape resources that have been planned but not yet delivered or installed. The cost information 628 may include information regarding the cost of obtaining the computing shape resource, the cost of operating the computing shape resource, and/or profits associated with operating the computing resource. Availability information 629 may include information about which computing shape resources are in use and thus unavailable, and which computing shape resources are unused and thus available for allocation to users.

The data repository 620 may include information about the calculated shape 624. The computing shape information 624 may include information about the type of computing shape that the cloud service provider supplies to the user, as well as information needed to initiate a computing instance from the computing shape.

The information describing the compute instance configuration manager 610 may be implemented in any component in the system 600. But for clarity and explanation purposes this information is illustrated in data repository 620.

In one or more embodiments, instance selection logic 646 can include logic to select particular values for computing configurable properties of instances. For example, instance selection logic 646 may include one or more decision trees for selecting values for configurable properties. Instance selection logic 646 can include a weighted formula that aggregates system and/or user preferences into a ranked list of available computing shapes.

In one or more embodiments, the machine learning algorithm 642 is an algorithm that can be iterated to learn a target model f that optimally maps a set of input variables to output variables. In particular, the machine learning algorithm 642 is configured to generate and/or train a machine learning model 644.

The machine learning algorithm is an algorithm that can be iterated to learn a target model f that optimally maps a set of input variables to output variables using a set of training data. The training data includes a dataset and associated tags. The dataset is associated with input variables of the target model f. The associated labels are associated with the output variables of the target model f. The training data may be updated based on, for example, feedback on the accuracy of the current target model f. The updated training data is fed back into the machine learning algorithm, which in turn updates the target model f.

The machine learning algorithm 642 generates a target model f such that the target model f best fits the dataset of training data to the labels of the training data. Additionally or alternatively, the machine learning algorithm 642 generates the target model f such that, when the target model f is applied to the dataset of training data, the maximum number of results determined by the target model f matches the labels of the training data. Different target models may be generated based on different machine learning algorithms and/or different training data sets.

The machine learning algorithm 642 may include a supervised component and/or an unsupervised component. Various types of algorithms may be used, such as linear regression, logistic regression, linear discriminant analysis, classification and regression trees, naive bayes, k-nearest neighbors, learning vector quantization, support vector machines, bagging (bagging) and random forests, boosting (boosting), back propagation, and/or clustering.

In an embodiment, the compute instance configuration manager 610 is implemented on one or more digital devices. The term "digital device" generally refers to any hardware device that includes a processor. A digital device may refer to a physical device executing an application or virtual machine. Examples of digital devices include computers, tablet computers, laptop computers, desktops, netbooks, servers, web servers, network policy servers, proxy servers, general-purpose machines, function-specific hardware devices, hardware routers, hardware switches, hardware firewalls, hardware Network Address Translators (NATs), hardware load balancers, mainframes, televisions, content receivers, set-top boxes, printers, mobile handsets, smart phones, personal Digital Assistants (PDAs), wireless receivers and/or transmitters, base stations, communication management devices, routers, switches, controllers, access points, and/or client devices.

In one or more embodiments, interface 602 refers to hardware and/or software configured to facilitate communication between a user and computing instance configuration manager 610. Interface 602 renders user interface elements (e.g., interface element 614) and receives input via the user interface elements. Examples of interfaces include a Graphical User Interface (GUI), a Command Line Interface (CLI), a haptic interface, an Application Programming Interface (API) accessed via a console, and a voice command interface. Examples of user interface elements include check boxes, radio buttons, drop down lists, list boxes, buttons, toggle buttons, text fields, date and time selectors, command lines, sliders, pages, and forms.

In an embodiment, different components of interface 602 are specified using different languages. The behavior of the user interface element is specified using a dynamic programming language, such as JavaScript. The content of the user interface element is specified using a markup language, such as hypertext markup language (HTML) or XML user interface language (XUL). The layout of the user interface elements is specified using a style sheet language, such as Cascading Style Sheets (CSS). Alternatively, interface 602 is specified using one or more other languages (such as Java, C, or C++).

Additional embodiments and/or examples related to computer networks are described below in section 8 entitled "computer networks and cloud networks".

4. Graphic user interface

Fig. 7 illustrates an example of a graphical user interface 702 that may be generated by the graphical user interface generator 612. The graphical user interface 702 may be presented via the interface 602. As shown, graphical user interface 702 is presenting four interface elements, configurable attribute element 712, configurable attribute element 722, attribute value setting element 730, and create compute instance selection element 740.

Interface element 712 represents configurable property 710 and includes selectable component 714 and selectable component 716. The selectable component 714, when selected by the user, corresponds to a selection of a value for the configurable property 710 for the system. The selectable component 716, when selected by a user, corresponds to a selection item that allows the user to select a value of the configurable property 710. Similarly, interface element 722 represents configurable property 720 and includes selectable component 724 and selectable component 726. Selectable component 724, when selected by a user, corresponds to a selection of a value for the configurable property 720 for the system. The selectable component 726, when selected by a user, corresponds to a selection item that allows the user to select a value of the configurable property 720. In the example shown, the user has selected selectable elements 714 and 726.

In response to receiving a selection of a selectable element (e.g., element 726) corresponding to a user-selected selection, GUI 702 may present interface element 730. Interface element 730 may include one or more input elements, such as input element 732 and input element 734. The input element(s) may allow the user to select from a set of values for the configurable property. The input element may provide the allowable selection values, for example, in a menu, a checklist, a slider, or any other interface element for selection. The input element may allow a user to enter a value, for example, in a text input field in which the user may manually type or otherwise enter a value.

Once the user has selected their desired computing instance settings, they may choose to create computing instance element 740. In response to this selection, compute instance selector 616 may select a value for any configurable attribute that the user indicates a system selected value, e.g., a value for configurable attribute 710. The compute instance builder 617 may then initiate a compute instance based on the system-selected value and the user-selected value.

5. Configuring computing instances

Fig. 8A and 8B illustrate an example set of operations to present a graphical user interface for configuring and launching a computing instance in accordance with one or more embodiments. One or more of the operations illustrated in fig. 8A-8B may be modified, rearranged, or omitted entirely. Accordingly, the particular sequence of operations illustrated in fig. 8A-8B should not be construed as limiting the scope of one or more embodiments.

Graphical user interface generator 612 may display a Graphical User Interface (GUI) having one or more elements, each element representing a different configurable attribute and selectable components for configuring each respective configurable attribute (operation 802). For example, the interface element corresponding to the configurable property may include a name of the configurable property, a first selectable component indicating that the system should select a value, and a second selectable component indicating that the user will select a value.

GUI generator 612 may receive a configuration of selectable attributes (operation 804). The user may select either the first selectable component or the second selectable component for the configurable attribute. The selection of the first selectable component or the second selectable component may be mutually exclusive.

GUI generator 612 may determine whether the user has selected the first selectable component or the second selectable component for the configurable attribute (operation 806). When the user selects the first selectable component, the GUI generator 612 will store a system selection indication of the configurable property (operation 808). When the user selects the second selectable component, the GUI generator 612 will store a user-selected indication of the configurable property (operation 810).

GUI generator 612 may determine whether there are any remaining configurable property selections to process (operation 812). If so, the GUI generator may return to operation 804 to receive a configuration of another configurable property.

When GUI generator 612 receives all configurations of the configurable properties displayed in the GUI, the system proceeds to the operation shown in fig. 8B.

The compute instance builder 618 may initiate configuration of the compute instance (operation 822). In some embodiments, the user may have selected an interface element indicating that their request has been completed and they wish to create a computing instance.

The compute instance builder 618 may select a configurable attribute for the compute instance (operation 824). For example, computing instance builder 618 may select one of a processor type, availability domain, failure domain, region, or boot time configurable attribute for a computing instance.

The compute instance builder 618 may determine what type of configuration is selected for the configurable attribute (operation 826). For example, computing instance builder 618 may retrieve a storage configuration for the configurable attribute.

The compute instance builder 618 may determine what type of configuration is stored for the configurable attribute (operation 826). When the configuration is an attribute selected for the system, compute instance selector 616 selects a value for the configurable attribute (operation 828). The computing instance selector 616 may select the value of the configurable attribute from the available resources according to one or more vendor-specified criteria, one or more user preferences, or both. For example, a vendor-specified processor generation value (generation value) criteria may be to prioritize the latest generation. For availability domain configuration attribute values, the vendor-specified criteria may be to select the availability domain with the most available unused processor cores. Some user preferences may indicate that the user prefers a certain value of the configuration attribute over other values, and may include a priority ranking of a plurality of possible values. Other user preferences may indicate that the user wishes to include a first value specifically, or exclude a second value of the configurable attribute when available. In one or more embodiments, the computing instance selector 616 may consider multiple vendor-specified criteria and/or multiple user preferences. The multiple vendor-specified criteria and/or user preferences may be weighted with respect to each other.

Compute instance selector 616 may use instance selection logic 645 to select the value of the configurable property. Alternatively, compute instance selector 616 may use machine learning model 644 to select the value of the configurable property.

When the configuration is a value selected for the user, the GUI generator 612 displays an input element for receiving user input of a specified value (operation 830). The input element may comprise a predetermined set of possible values or a series of possible values from which the user may select. The input element may be an input field into which the user may insert any value. GUI generator 612 or computing instance builder 618 may check whether the value inserted by the user is a valid selection and may prompt the user to alter its input when the value is not valid for the configurable property. GUI generator 612 receives the user-entered values of the configurable properties (operation 832).

Alternatively, in some embodiments, the second selectable component may include an input component such that the user may indicate simultaneously that they will provide a value by providing a value in operation 804. In some embodiments, operations 830 and 832 may be performed prior to operation 810.

The compute instance builder 618 determines if any additional configurable properties are selected to be processed (operation 834). When additional configurable attribute selections exist, the compute instance builder 618 returns to operation 824 to select the next configurable attribute.

When no configurable attributes remain to be processed, the compute instance builder 618 configures the attributes of the compute instance and initiates the compute instance according to the system selected values and the user selected values.

FIG. 9 illustrates an example set of operations for selecting an attribute of a configurable attribute when a user indicates that the system should select a value, in accordance with one or more embodiments. One or more of the operations illustrated in fig. 9 may be modified, rearranged, or omitted entirely. Accordingly, the particular sequence of operations illustrated in FIG. 9 should not be construed as limiting the scope of one or more embodiments.

The compute instance builder 618 may receive a request to create a compute instance (operation 902). The request may include one or more criteria that specify a configurable property of the computing instance, but does not include user input of a particular value of the configurable property. For example, the request may include criteria for an architecture type processor, but not specify a vendor or generation. In another example, the request may include criteria for a north american region, but no specific region is specified.

The compute instance selector 616 may select a particular value for the configurable property from a set of candidate values based on one or more criteria (operation 904). The compute instance selector 616 may first determine which compute instance resources are available, for example, by evaluating the compute shape 624 and the availability information 629. The compute instance selector 616 may then determine a set of candidate values from the available resources. For example, the compute instance selector 616 may identify which processors of a given processor architecture are available.

The computing instance selector 616 may select a particular value from the set of candidate values based on one or more vendor-specified criteria, one or more user preferences, or both. For example, the vendor-specified criteria for a processor of a particular architecture type value may be the latest generation of any available processors of that architecture type selected first, or the available processors of the specified architecture type selected from the availability domain with the greatest number of available processors. In one or more embodiments, the computing instance selector 616 may consider multiple vendor-specified criteria and/or multiple user preferences. The multiple vendor-specified criteria and/or user preferences may be weighted with respect to each other.

Compute instance selector 616 may use instance selection logic 645 to select the value of the configurable property. Alternatively, compute instance selector 616 may use machine learning model 644 to select the value of the configurable property.

The compute instance selector 616 may store the system selected value in association with the configurable attribute (operation 906). One or more embodiments may train or revise the machine learning model 644 using stored system-selected values of the configurable properties. One or more embodiments may store the system-selected value outside of the lifecycle of the user's particular computing instance, and may use the system-selected value to create a subsequent computing instance for the user.

The compute instance builder 618 may launch the compute instance based on the system-selected value of the configurable property (operation 908). For example, the compute instance builder 618 may allocate a compute shape composed of particular processor units in a particular availability domain for a particular region and provide the user with access to the compute shape.

6. Example embodiment

For clarity, detailed examples are described below. The components and/or operations described below should be understood as one specific example, which may not be applicable to certain embodiments. Accordingly, the components and/or operations described below should not be construed as limiting the scope of any claims.

Fig. 10 illustrates an example of a graphical user interface 1002 that allows a user to set preferences for how the system should select a value of a configurable property when the user specifies that the system should select that value. In particular, the graphical user interface 1002 may allow a user to indicate which configurable attribute values to include or exclude in a system-selected configurable attribute value setting operation. In the illustrated example, the graphical user interface 1002 displays a number of possible values of the processor-type configurable attribute. Processor type configurable properties of a processor architecture (e.g., X86 processor architecture) may be further defined by processor vendor (e.g., INTEL or AMD) and generation (e.g., E2, E3, X7, X9).

Graphical user interface 1002 may list possible values for a given configurable attribute, such as vendor 1 (1012) and vendor 2 (1014). Each possible value may be displayed with an inclusion user interface element (e.g., 1022 a) and an exclusion user interface element (e.g., 1022 b). The user may choose to include a user interface element to specify that when the system selects a value for a configurable property, the corresponding value should be included as a possible value. The user may choose to exclude user interface elements to specify that when the system selects a value for a configurable property, the corresponding value should be excluded from possible values. As shown, the user has selected to include vendor 1 and exclude generation 1 (1016). When neither inclusion nor exclusion of a user interface element is selected, the system may consider the corresponding value as a possible value for the configurable attribute, while prioritizing any value explicitly included by the user. For example, the system may first attempt to provide a 2 nd or 3 rd generation processor (if available) of vendor 1. If no vendor 1 processor is available, the system may attempt to provide vendor 2's generation 2 or generation 3 processors.

FIG. 11 illustrates an example of a graphical user interface 1102 that allows a user to set preferences for how a system should select a value of a configurable property when the user specifies that the system should select that value. In particular, the graphical user interface 1102 allows a user to rank, prioritize, or otherwise order the various possible values of the configurable properties. In the illustrated example, the graphical user interface 1102 provides values for processor architecture type configurable properties. For example, the processor architecture of the x86 architecture may be obtained from vendor 1 (1112 a) or vendor 2 (1112 b). Processor architectures are available in generation 1 (1114 a), generation 2 (111 b), and generation 3 (1114 c). As shown, the user has entered a priority or ranking of "1" in user interface element 1122b corresponding to vendor 2 and a priority or ranking of "2" in user interface element 1122a corresponding to vendor 1. The user also enters a priority or ranking of "1" in user interface element 1124b corresponding to generation 2, a priority or ranking of "2" in user interface element 1124c corresponding to generation 3, and a priority or ranking of "3" in user interface element 1124a corresponding to generation 1.

In accordance with the illustrated preference, in one or more embodiments, when a user selects a value that lets the system select a processor type within the processor architecture, the system may first attempt to select the 2 nd generation processor of vendor 2. If no processors are available, the system may attempt to select the 2 nd generation processor of vendor 1 or may attempt to select the third generation processor of vendor 2. In one or more embodiments, a user or system may assign weights to different configurable attributes and may alter the value of the lower-weight attribute first and then the higher-weight attribute.

When the user selects user interface element 1140 to save their preferences, the system may save these values as user preferences 634 for use by subsequent computing instance creation operations.

FIG. 12 illustrates an example of a graphical user interface 1202 that allows a user to create multiple computing instances that will have at least one configurable attribute value in common. In the illustrated example, the user interface element 1204 allows a user to input a number of computing instances to be created, e.g., four. User interface element 1206 allows the user to specify a configurable attribute value that all computing instances will have in common, such as the x86 processor architecture from vendor 1. Interface elements 1204 and 1206 may be text entry boxes, drop down menus, or any other type of interface element that allows a user to enter or select a value.

In one or more embodiments, graphical user interface 1202 may also provide one or more additional user interface elements corresponding to other configurable properties to allow a user to select whether the value of the corresponding configurable property is selected by the system or by the user. For example, user interface element 1210 corresponds to an availability domain configurable property and user interface element 1212 corresponds to a region configurable property. In the example shown, the user has selected to let the system select an availability domain.

The user also selects a value for the region selection. Graphical user interface 1202 accordingly presents user interface element 1230 to allow the user to select a particular value for the region. As shown, the user has selected user interface element 1232 corresponding to the value "region 1".

In the illustrated example, when a user selects user interface element 1240 to create a pool of computing instances, the system may identify a first set of vendor 1x86 computing instances in region 1. The system may select a first set of vendor 1x86 computing instances in a first availability domain. The system may determine that the number of available compute instances in the first set of compute instances does not satisfy the specified number 4 of the requested plurality of compute instances.

The system may then identify a second set of vendor 1x86 computing instances in the different availability domains in region 1. If the number of available computing instances in the second set of computing instances satisfies the specified number 4 of the requested plurality of computing instances, the system may select the second set of computing instances and launch the specified number of the second set of computing instances.

In some cases, the user may specify a category for the configurable attribute instead of a particular value, e.g., an x86 processor, without vendor selection. In this case, the system may determine a set of candidate values in the category of the configurable attribute. The system may then select a particular value of the configurable attribute from the set of candidate values based on the available resources, and may initiate a pool of requested computing instances having the system-selected value for the configurable attribute.

7. Practical application, advantages and improvements

Conventionally, a cloud service provider may require a user to specify all values of a configurable attribute of a computing instance. If no computing shape is available that satisfies all of the values specified by the user, the user may not be able to use the cloud service or may need to restart their request with one or more new values. Other cloud service providers may not allow users to select any particular value for a computing instance. The user may have access to the computing instance, but the computing instance may not meet the user's needs.

One or more embodiments described herein provide a more flexible and customizable method of providing computing instances that allows users to indicate which properties are not of interest to them, and which properties are that they want to set particular values. This allows cloud service providers to extend the scope of searches among all available computing resources while still meeting the specific needs of the user.

8. Computer network and cloud network

In one or more embodiments, a computer network provides connections between a set of nodes. Nodes may be local and/or remote from each other. The nodes are connected by a set of links. Examples of links include coaxial cables, unshielded twisted cable, copper cable, optical fiber, and virtual links.

The subset of nodes implements a computer network. Examples of such nodes include switches, routers, firewalls, and network address translators NAT. Another subset of nodes uses a computer network. Such nodes (also referred to as "hosts") may execute client processes and/or server processes. The client process makes a request for a computing service, such as execution of a particular application and/or storage of a particular amount of data. The server process responds by executing the requested service and/or returning corresponding data.

The computer network may be a physical network comprising physical nodes connected by physical links. A physical node is any digital device. The physical nodes may be function specific hardware devices such as hardware switches, hardware routers, hardware firewalls, and hardware NATs. Additionally or alternatively, the physical nodes may be general-purpose machines configured to execute various virtual machines and/or applications that perform corresponding functions. A physical link is a physical medium that connects two or more physical nodes. Examples of links include coaxial cables, unshielded twisted cables, copper cables, and optical fibers.

The computer network may be an overlay network. An overlay network is a logical network implemented over another network, such as a physical network. Each node in the overlay network corresponds to a respective node in the underlay network. Thus, each node in the overlay network is associated with both an overlay address (for addressing the overlay node) and an underlay address (for addressing the underlay node implementing the overlay node). The overlay nodes may be digital devices and/or software processes (such as virtual machines, application instances, or threads). The links connecting the overlay nodes are implemented as tunnels through the underlying network. The overlay nodes at either end of the tunnel treat the underlying multi-hop path between them as a single logical link. Tunnel processing (tunneling) is performed by encapsulation and decapsulation.

In embodiments, the client may be located locally to the computer network and/or remotely from the computer network. Clients may access a computer network through other computer networks, such as a private network or the internet. The client may transmit the request to the computer network using a communication protocol, such as the hypertext transfer protocol (HTTP). The request is transmitted through an interface such as a client interface (such as a web browser), a program interface or an (application programming interface) API.

In an embodiment, a computer network provides a connection between a client and a network resource. The network resources include hardware and/or software configured to execute server processes. Examples of network resources include processors, data storage, virtual machines, containers, and/or software applications. Network resources are shared among multiple clients. The clients request computing services from the computer network independently of each other. Network resources are dynamically allocated to the requesting and/or client as needed. The network resources allocated to each request and/or client may be scaled up or down based on, for example, (a) computing services requested by a particular client, (b) aggregated computing services requested by a particular tenant, and/or (c) requested aggregated computing services of a computer network. Such computer networks may be referred to as "cloud networks".

In an embodiment, a service provider provides a cloud network to one or more end users. The cloud network may implement various service models including, but not limited to, software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS). In SaaS, a service provider provides end users with the ability to use applications of the service provider that are executing on network resources. In PaaS, service providers provide end users with the ability to deploy custom applications onto network resources. Custom applications may be created using programming languages, libraries, services, and tools supported by a service provider. In IaaS, service providers offer end users the ability to provision processing, storage, networking, and other basic computing resources provided by network resources. Any arbitrary application may be deployed on the network resources, including the operating system.

In an embodiment, a computer network may implement various deployment models including, but not limited to, private cloud, public cloud, and hybrid cloud. In private clouds, network resources are exclusively used by a particular group of one or more entities (the term "entity" as used herein refers to a company, organization, person, or other entity). The network resources may be local to and/or remote from the locale of the particular set of entities. In public clouds, cloud resources are supplied to multiple entities (also referred to as "tenants" or "customers") that are independent of each other. The computer network and its network resources are accessed by clients corresponding to different tenants. Such computer networks may be referred to as "multi-tenant computer networks. Several tenants may use the same particular network resources at different times and/or at the same time. The network resources may be local to the tenant's premises and/or remote from the tenant's premises. In a hybrid cloud, a computer network includes a private cloud and a public cloud. The interface between private and public clouds allows portability of data and applications. Data stored at the private cloud and data stored at the public cloud may be exchanged through the interface. An application implemented at a private cloud and an application implemented at a public cloud may have dependencies on each other. Calls from applications at the private cloud to applications at the public cloud (and vice versa) may be performed through the interface.

In an embodiment, tenants of the multi-tenant computer network are independent of each other. For example, the business or operation of one tenant may be separate from the business or operation of another tenant. Different tenants may require different network requirements for the computer network. Examples of network requirements include processing speed, data storage, security requirements, performance requirements, throughput requirements, latency requirements, resilience requirements, quality of service (QoS) requirements, tenant isolation, and/or consistency. The same computer network may need to fulfill different network requirements required by different tenants.

In one or more embodiments, tenant isolation is implemented in a multi-tenant computer network to ensure that applications and/or data of different tenants are not shared with each other. Various tenant isolation methods may be used.

In an embodiment, each tenant is associated with a tenant ID. Each network resource of the multi-tenant computer network is labeled with a tenant ID. A tenant is allowed to access a particular network resource only if the tenant and the particular network resource are associated with the same tenant ID.

In an embodiment, each tenant is associated with a tenant ID. Each application implemented by the computer network is labeled with a tenant ID. Additionally or alternatively, each data structure and/or data set stored by the computer network is labeled with a tenant ID. A tenant is only allowed to access a particular application, data structure, and/or data set if the tenant and the particular application, data structure, and/or data set are associated with the same tenant ID.

As an example, each database implemented by a multi-tenant computer network may be labeled with a tenant ID. Only the tenant associated with the corresponding tenant ID may access the data of the particular database. As another example, each entry in a database implemented by a multi-tenant computer network may be labeled with a tenant ID. Only the tenant associated with the corresponding tenant ID may access the data of the particular entry. The database may be shared by multiple tenants.

In an embodiment, the subscription list indicates which tenants have authorization to access which applications. For each application, a list of tenant IDs of tenants authorized to access the application is stored. A tenant is allowed to access a particular application only if its tenant ID is contained in a subscription list corresponding to the particular application.

In an embodiment, network resources (such as digital devices, virtual machines, application instances, and threads) corresponding to different tenants are isolated to tenant-specific overlay networks maintained by the multi-tenant computer network. As an example, a data packet from any source device in the tenant overlay network may be transmitted only to other devices within the same tenant overlay network. Encapsulation tunnels are used to prohibit any transmission from a source device on the tenant overlay network to devices in other tenant overlay networks. In particular, packets received from the source device are encapsulated within external packets. External data packets are transmitted from a first encapsulation tunnel endpoint (in communication with a source device in the tenant overlay network) to a second encapsulation tunnel endpoint (in communication with a destination device in the tenant overlay network). The second encapsulation tunnel endpoint decapsulates the external data packet to obtain the original data packet for transmission by the source device. The original data packet is transmitted from the second encapsulation tunnel endpoint to the destination device in the same particular overlay network.

9. Other matters, expansion

Embodiments are directed to a system having one or more devices including a hardware processor and configured to perform any of the operations described herein and/or in any of the following claims.

In an embodiment, a non-transitory computer-readable storage medium includes instructions that, when executed by one or more hardware processors, cause performance of any of the operations described and/or claimed herein.

While specific embodiments have been described, various modifications, alterations, alternative constructions, and equivalents are also included within the scope of the disclosure. Embodiments are not limited to operation within certain specific data processing environments, but may be free to operate within multiple data processing environments. Furthermore, while embodiments have been described using a particular series of transactions and steps, it should be apparent to those skilled in the art that the scope of the present disclosure is not limited to the described series of transactions and steps. The various features and aspects of the embodiments described above may be used alone or in combination.

In addition, while embodiments have been described using a particular combination of hardware and software, it should be recognized that other combinations of hardware and software are also within the scope of the present disclosure. Embodiments may be implemented in hardware alone, or in software alone, or in a combination thereof. The various processes described herein may be implemented in any combination on the same processor or on different processors. Accordingly, where a component or service is described as being configured to perform certain operations, such configuration may be accomplished by, for example, designing the electronic circuitry to perform the operations, programming programmable electronic circuitry (such as a microprocessor) to perform the operations, or any combination thereof. The processes may communicate using a variety of techniques, including but not limited to conventional techniques for inter-process communication, and different pairs of processes may use different techniques, or the same pair of processes may use different techniques at different times.

The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. It will be evident that various additions, subtractions, deletions and other modifications and changes may be made thereunto without departing from the broader spirit and scope as set forth in the claims. Thus, while specific disclosed embodiments have been described, these are not intended to be limiting. Various modifications and equivalents are intended to be within the scope of the following claims.

The use of the terms "a" and "an" and "the" and similar referents in the context of describing the disclosed embodiments (especially in the context of the following claims) are to be construed to cover both the singular and the plural, unless otherwise indicated herein or clearly contradicted by context. Unless otherwise indicated, the terms "comprising," "having," "including," and "containing" are to be construed as open-ended terms (i.e., meaning "including, but not limited to"). The term "connected" should be interpreted as including in part or in whole, attached to, or connected together, even though something is intermediate. Recitation of ranges of values herein are merely intended to serve as a shorthand method of referring individually to each separate value falling within the range, unless otherwise indicated herein, and each separate value is incorporated into the specification as if it were individually recited herein. All methods described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The use of any and all examples, or exemplary language (e.g., "such as") provided herein, is intended merely to better illuminate the embodiments and does not pose a limitation on the scope of the disclosure unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the disclosure.

A disjunctive language, such as the phrase "at least one of X, Y or Z," unless explicitly stated otherwise, is intended to be understood in the context of what is commonly used to refer to an item, term, etc., may be X, Y or Z, or any combination thereof (e.g., X, Y and/or Z). Thus, such disjunctive language is generally not intended nor should it suggest that certain embodiments require at least one of X, at least one of Y, or at least one of Z to each be present.

Preferred embodiments of this disclosure are described herein, including the best mode known for carrying out the disclosure. Variations of those preferred embodiments may become apparent to those of ordinary skill in the art upon reading the foregoing description. One of ordinary skill in the art should be able to employ such variations as appropriate and may practice the disclosure in a manner other than that specifically described herein. Accordingly, this disclosure includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Moreover, unless otherwise indicated herein, the present disclosure includes any combination of the above elements in all possible variations thereof.

All references, including publications, patent applications, and patents, cited herein are hereby incorporated by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and were set forth in its entirety herein.

In the foregoing specification, aspects of the present disclosure have been described with reference to specific embodiments thereof, but those skilled in the art will recognize that the present disclosure is not limited thereto. The various features and aspects of the disclosure described above may be used alone or in combination. In addition, embodiments may be utilized in any number of environments and applications other than those described herein without departing from the broader spirit and scope of the specification. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

Any combination of the features and functions described herein may be used in accordance with one or more embodiments. In the foregoing specification, embodiments have been described with reference to numerous specific details that may vary from implementation to implementation. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. The sole and exclusive indicator of the scope of the application, and what is intended by the applicants to be the scope of the application, is the literal and equivalent scope of the set of claims, which issue from this application, in the specific form in which such claims issue, including any subsequent correction.

Claims (20)

1. A non-transitory computer-readable medium comprising instructions that, when executed by one or more hardware processors, cause operations to be performed, the operations comprising:

Receiving a request to initiate a computing instance, the computing instance being defined by at least a first configurable attribute, the request including one or more user-specified criteria for the first configurable attribute and not including a particular value of the first configurable attribute;

determining a set of candidate values for the first configurable attribute;

Selecting, by the system, a particular value of the first configurable attribute from the set of candidate values of the first configurable attribute based on the one or more user-specified criteria;

storing a particular value in association with a first configurable attribute, and

The computing instance is started based on a system-selected particular value for a first configurable attribute of the computing instance.

2. The medium of claim 1, wherein determining the set of candidate values comprises:

determining a set of candidate computing instances that meet the one or more criteria based on available resources;

determining values corresponding to the set of candidate computing instances for the first configurable attribute, and

Values corresponding to the set of candidate computing instances are selected as the set of candidate values for the first configurable attribute.

3. The medium of claim 1, wherein the one or more criteria specify a class of particular values for the system to determine the first configurable property.

4. The medium of claim 3 wherein the first configurable attribute comprises a processor type and the category comprises a processor vendor, a processor architecture, or a processor generation.

5. The medium of claim 1, wherein the one or more criteria include at least one of a user preference for a particular value of the first configurable attribute, a user ranking of a set of values, a user-specified exclusion term for a particular value of the first configurable attribute, a user-specified location for launching the computing instance, a user-specified operating system preference for the first computing instance, and a user-specified cost preference for the computing instance.

6. The medium of claim 1, further comprising selecting a weight for each value in the set of candidate values based on the one or more criteria, wherein selecting a particular value is based on the weights.

7. The medium of claim 1, wherein selecting the particular value of the first configurable property comprises applying a machine learning model to the one or more criteria to calculate the particular value of the first configurable property.

8. The medium of claim 1, wherein the configurable properties comprise at least one of a processor type, an availability domain, a boot time, a region, and a fault domain.

9. The medium of claim 1, wherein the computing instance is further defined by a second configurable attribute and the request includes a second user input specifying a user-selected value of the second configurable attribute, the operations further comprising launching the computing instance based on a system-selected particular value of the first configurable attribute of the computing instance and the user-selected value of the second configurable attribute of the computing instance.

10. The medium of claim 1, wherein the operations further comprise:

obtaining one or more vendor-specified criteria;

Wherein the system further selects a particular value of the first configurable attribute based on the one or more vendor-specified criteria.

11. The medium of claim 10, wherein determining the set of candidate values comprises:

Determining a set of candidate computing instances that meet the one or more vendor-specified criteria based on available resources;

determining values corresponding to the set of candidate computing instances for the first configurable attribute, and

Values corresponding to the set of candidate computing instances are selected as the set of candidate values for the first configurable attribute.

12. The medium of claim 10, wherein the one or more vendor-specified criteria comprise at least one of:

The number of cores available;

substitution order;

cost constraints;

operating system requirements;

an expected demand for a computation shape corresponding to an available computation instance;

actual requirements of the computation shape corresponding to the available computation instance;

Supply chain information;

Profitability information;

Power consumption;

User preference, and

The physical location of the instance is calculated.

13. The medium of claim 12, further comprising selecting weights for each of the one or more criteria, wherein selecting a particular value is based on the weights of the respective criteria.

14. The medium of claim 10, wherein selecting the particular value of the first configurable property comprises applying a machine learning model to the one or more criteria to calculate the particular value of the first configurable property.

15. The medium of claim 10, wherein the computing instance is further defined by a second configurable attribute and the request includes a second user input specifying a user-selected value of the second configurable attribute, and the computing instance is launched based on a system-selected particular value of the first configurable attribute of the computing instance and a user-selected value of the second configurable attribute of the computing instance.

16. A non-transitory computer-readable medium comprising instructions that, when executed by one or more hardware processors, cause operations to be performed, the operations comprising:

Receiving a request to initiate a pool of n computing instances, the request including one or more user-specified criteria for a first configurable attribute of each computing instance in the pool of n computing instances;

determining a set of candidate values for the first configurable attribute;

selecting, by the system, a particular value of the first configurable attribute from the set of candidate values for the first configurable attribute based on the one or more user-specified criteria and the available resources;

a pool of the n computing instances is started, each of the n computing instances having a particular value of the first configurable attribute.

17. The medium of claim 16, wherein a first compute instance of the n compute instances has a different value of a second configurable attribute than a second compute instance of the n compute instances.

18. A system, comprising:

one or more processors, and

A memory storing instructions that, when executed by the one or more processors, cause the system to perform operations of any of claims 1-17.

19. A method comprising the operations of any one of claims 1-17.

20. A system comprising means for performing the operations of any one of claims 1 to 17.