Patent ID: 12210893

DETAILED DESCRIPTION

In a virtualization architecture, transports (also referred to as “connections” hereafter) are used to connect different applications and/or execution environments on a host system to facilitate communication. The communication between the different applications may be routed via a virtual switch executed by a processing device of the host system. To enable communication between these applications, a hypervisor or virtual machine manager may first establish and configure the connections between the applications. In some embodiments, the connections may use sockets, such as UNIX™ domain sockets, to facilitate the communication.

In a conventional virtualization architecture, a host system may support a number virtual machines and/or containers that are executing different applications (also referred to as “clients” hereafter). To establish a connection between these applications, processing logic of the host system may utilize a socket as a transport and define two roles, a “master” role and a “slave” role as part of a user protocol that uses sockets as a transport. The “master” role and the “slave” role can either be the server/host system (e.g., the entity that creates the socket) or the client (e.g., the entity that connects to the existing socket). In some embodiments, the processing logic may designate the client as the “master” and a virtual switch of the host system as the “slave.” In such an embodiment, a disconnection requires the “master” to be restarted in order to re-establish communication. For example, in the case of a disconnection, the client (e.g., the “master”), such as a virtual machine or container, may need to be restarted in order to re-establish the connection, decreasing the performance of the virtualization architecture. If the “master” role is the host system and the “slave” role is the client then such a restart is not needed. However, in a conventional virtualization architecture, it may be inconvenient or undesirable for a user to utilize such an embodiment.

Aspects of the disclosure address the above-noted and other deficiencies by utilizing an intermediary broker to establish process connections in a host system. The broker may be executed by processing logic of a processing device of a host system that supports multiple execution environments. In embodiments, an execution environment may be a virtual machine. In some embodiments, an execution environment may be a container. The broker may create a single socket that is used to communicate with the clients, such as execution environments and virtual switches, of the host system.

To establish a connection for an execution environment, a virtual switch of the host system may receive a command to generate a virtual port to be used by the execution environment. The command may also include a key that is associated with the virtual port. In embodiments, the key may correspond to a stream or sequence of bytes. Upon receiving the command, the virtual switch may generate the virtual port, transmit the key associated with the virtual port to the broker via the broker socket, and wait for an end point for the connection. In embodiments, the virtual switch may have multiple virtual ports, each with a corresponding key, that have been generated for different execution environments of the host system.

When the execution environment is instantiated by the host system, the execution environment may receive a key that matches the key associated to with the virtual port at the virtual switch. After the execution environment has been instantiated and is running on the host system, the execution environment may transmit a request to establish a connection to the broker via the broker socket. The request may include the key that was received by the execution environment during instantiation. The broker may then compare the key received from the execution environment to any keys provided by the virtual switch (which are each associated with a corresponding virtual port) to determine whether there is a match. Upon determining that the key of the execution environment matches a key provided by the virtual switch, the broker may provide connection end points to the virtual switch and the execution environment to establish communication between the execution environment and the corresponding virtual port of the virtual switch. By utilizing an intermediary broker, a host system may be able to generate fast, reliable connections between clients of the host system, improving the performance of the virtualization architecture.

FIG.1depicts a high-level component diagram of an illustrative example of a computing architecture100, in accordance with one or more aspects of the present disclosure. However, other computing architectures100are possible, and the implementation of a computer system utilizing examples of the disclosure are not necessarily limited to the specific architecture depicted byFIG.1.

As shown inFIG.1, computing architecture100includes host systems110a, band client device150. The host systems110a, band client device150include one or more processing devices160, memory170, which may include volatile memory devices (e.g., random access memory (RAM)), non-volatile memory devices (e.g., flash memory) and/or other types of memory devices, a storage device180(e.g., one or more magnetic hard disk drives, a Peripheral Component Interconnect [PCI] solid state drive, a Redundant Array of Independent Disks [RAID] system, a network attached storage [NAS] array, etc.), and one or more devices190(e.g., a Peripheral Component Interconnect [PCI] device, network interface controller (NIC), a video card, an I/O device, etc.). In certain implementations, memory170may be non-uniform access (NUMA), such that memory access time depends on the memory location relative to processing device160. It should be noted that although, for simplicity, a single processing device160, storage device180, and device190are depicted inFIG.1, other embodiments of host systems110a, band client device150may include multiple processing devices, storage devices, or devices. Processing device160may include a complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or a processor implementing other instruction sets or processors implementing a combination of instruction sets. Processing device160may also include one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like.

The host systems110a, band client device150may be a server, a mainframe, a workstation, a personal computer (PC), a mobile phone, a palm-sized computing device, etc. In embodiments, host systems110a, band client device150may be separate computing devices. In some embodiments, host systems110a, band client device150may be implemented by a single computing device. For clarity, some components of host system110band client device150are not shown. Although computing architecture100is illustrated as having two host systems, embodiments of the disclosure may utilize any number of host systems.

Host systems110a, bmay additionally include execution environments130, which may include one or more virtual machines (VMs)132a, containers136a, containers136bresiding within virtual machines132b, and host operating system (OS)120. VM132aand VM132bare software implementations of machines that execute programs as though they were actual physical machines. Container136acts as isolated execution environments for different workloads of services, as previously described. Host OS120manages the hardware resources of the computer system and provides functions such as inter-process communication, scheduling, memory management, and so forth.

Host OS120may include a hypervisor125(which may also be known as a virtual machine monitor (VMM)), which provides a virtual operating platform for VMs132a, band manages their execution. Hypervisor125may manage system resources, including access to physical processing devices (e.g., processors, CPUs, etc.), physical memory (e.g., RAM), storage device (e.g., HDDs, SSDs), and/or other devices (e.g., sound cards, video cards, etc.). The hypervisor125, though typically implemented in software, may emulate and export a bare machine interface to higher level software in the form of virtual processors and guest memory. Higher level software may comprise a standard or real-time OS, may be a highly stripped down operating environment with limited operating system functionality, and/or may not include traditional OS facilities, etc. Hypervisor125may present other software (i.e., “guest” software) the abstraction of one or more VMs that provide the same or different abstractions to various guest software (e.g., guest operating system, guest applications). It should be noted that in some alternative implementations, hypervisor125may be external to host OS120, rather than embedded within host OS120, or may replace host OS120.

The host systems110a, band client device150are coupled to each other (e.g., may be operatively coupled, communicatively coupled, may communicate data/messages with each other) via network105. Network105may be a public network (e.g., the internet), a private network (e.g., a local area network (LAN) or wide area network (WAN)), or a combination thereof. In one embodiment, network105may include a wired or a wireless infrastructure, which may be provided by one or more wireless communications systems, such as a WiFi′mhotspot connected with the network105and/or a wireless carrier system that can be implemented using various data processing equipment, communication towers (e.g., cell towers), etc. The network105may carry communications (e.g., data, message, packets, frames, etc.) between the various components of host systems110a, band client device150.

In embodiments, processing device160may execute a broker162. The broker162may act as an intermediary to establish transports between clients of host system110a. The broker162may perform key comparisons to determine how to configure the transports between the clients. Further details regarding broker162will be discussed atFIGS.2-11below.

FIG.2is an illustration of an example of a broker of a host system200receiving requests to establish a transport, in accordance with embodiments of the disclosure. The host system200may correspond to host system110aofFIG.1. The host system200includes a broker162having a broker socket202, client204a, and client204b. Client204ahas a corresponding key206aand client204bhas a corresponding key206b. As previously described, key206aand key206bmay be streams or sequences of bytes. In embodiments, the streams or sequences of bytes may be randomly or pseudo-randomly generated.

Broker socket202may act as a communication interface that facilitates communication between broker162and client204a, as well as between broker162and client204b. Because a transport has not yet been established between client204aand client204b, client204amay be unable to communicate with client204b. Although a single client pair (e.g., client204aand client204b) is shown inFIG.2, host system may include any number of client pairs, which may use the broker socket202to communicate with broker162. In some embodiments, client204aand client204bmay correspond to a virtual switch, a virtual machine, a container, or any combination thereof. As previously described, one or more of client204aor client204bmay be executing one or more applications. To establish a transport between client204aand client204b, client204amay transmit a first request to broker162to establish the transport that includes key206a. Client204bmay transmit a second request to broker162that includes key206b.

FIG.3is an illustration of an example of a broker of a host system300establishing a transport between clients, in accordance with embodiments of the disclosure. InFIG.3, broker162has received the requests from client204aand client204bincluding key206aand key206b, respectively. Upon receiving the requests including the keys, the broker may perform a key comparison to compare key206awith key206b. If key206aand key206bmatch, then broker162may establish the transport304between client204aand client204bby providing end point302ato client204aand end point302bto client204b.

End point302aand end point302bmay correspond to communication interfaces that enable the corresponding clients (e.g., client204aand client204b) to communicate via transport304. In some embodiments, end point302aand end point302bmay correspond to sockets of a socket pair of transport304. Transport304may correspond to network connection that facilitates the transmission of data between client204aand client204b. In some embodiments, transport304may be a transport that supports the transferring of file descriptors. A file descriptor may be a handle that is used in an interface between user and kernel space of host system300to identify file/socket resources.

Referring toFIG.3, upon receiving the requests, broker162may compare the sequence of bytes for key206aand key206bto determine whether key206aand key206bmatch. Because the sequence of byes for key206a(e.g.,4132) matches the sequence of bytes for key206b(e.g.,4132), the broker162may provide end point302ato client204aand end point302bto client204bto establish transport304bbetween client204aand client204b. Upon receiving the end points and establishing transport304, client204aand client204bmay be able to communicate and transmit data via transport304.

FIG.4is an illustration of an example of a virtual switch of a host system400receiving a command to generate a virtual port including a key, in accordance with embodiments of the disclosure. The host system400may correspond to host system110aofFIG.1. Host system400includes broker162having a broker socket202and a virtual switch402. Virtual switch402may correspond to an application executed by a processing device (not shown) of host system400that facilitates the communication between execution environments (e.g., execution environments130) of host system400. The virtual switch402may communicate with the execution environments via virtual ports, where each execution environment has a corresponding virtual port.

To ensure that a virtual port is available for an instantiated execution environment on host system400, a command to generate a virtual port is transmitted to virtual switch402that includes key404. In some embodiments, the command may be transmitted by a user/administrator of host system400. In embodiments, the command may be received from a hypervisor (e.g., hypervisor125). In an embodiment, the command may be received from a container/cluster management system. Upon receiving the command, the virtual switch402may generate a virtual port and associate the virtual port with key404. In some embodiments, transmit one or more commands may be transmitted to virtual switch402to generate multiple virtual ports, where each of the multiple virtual ports has a different corresponding key. In embodiments, upon generating the virtual port, the virtual switch may transmit a request to establish a transport including key404to broker162, as previously described.

FIG.5is an illustration of an example of a client of a host system500receiving a key in response to an instantiation of the client, in accordance with embodiments of the disclosure. InFIG.5, client502may be a virtual machine or container that has been instantiated on host system500. Upon detecting the instantiation of client502, the entity that instantiates client502may transmit key504that matches key404to client502so that a transport may be subsequently established using the virtual port associated with key404at the virtual switch402. In some embodiments, the entity that instantiates client502may be a user/administrator of host system500. In embodiments, the entity may be a hypervisor (e.g., hypervisor125). In an embodiment, the entity may be a container/cluster management system.

FIG.6is an illustration of an example of a broker of a host system600establishing a transport between a client and a virtual switch, in accordance with embodiments of the disclosure. InFIG.6, virtual switch402may transmit a first request to establish transport304that includes key404to broker162and client502may transmit a second request to establish transport304that includes key504. In some embodiments, the virtual switch402may transmit the request upon generating the virtual port associated with key404. In embodiments, the client502may transmit the request in response to the completion of a startup of client502.

Upon receiving the requests, the broker162may determine whether key404matches key504. In some embodiments, the broker162may include a data structure that includes multiple keys received from different clients of the host system. Upon receiving a request including a key, the broker162may query the data structure to determine whether any of the keys included in the data structure match the key received with the request. For example, upon receiving the request from the virtual switch402that includes key404, the broker162may add the key404associated with virtual switch402. Upon receiving the request from client502including key504, the broker162may query the data structure and identify key404in the data structure that matches key504. Upon determining that key404matches key504, the broker162may provide end point302ato virtual switch402and end point302bto client502to establish transport304between virtual switch402and client502, as previously described.

FIG.7is a flow diagram of a method700of transmitting a subsequent request to establish a transport in response identifying a disconnection with a broker, in accordance with some embodiments. Method800may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, a processor, a processing device, a central processing unit (CPU), a system-on-chip (SoC), etc.), software (e.g., instructions running/executing on a processing device), firmware (e.g., microcode), or a combination thereof. In some embodiments, at least a portion of method700may be performed by processing device160executing a client, such as client204aofFIG.2.

With reference toFIG.7, method700illustrates example functions used by various embodiments. Although specific function blocks (“blocks”) are disclosed in method700, such blocks are examples. That is, embodiments are well suited to performing various other blocks or variations of the blocks recited in method700. It is appreciated that the blocks in method700may be performed in an order different than presented, and that not all of the blocks in method700may be performed.

Method700begins at block710, where the processing logic provides a request to establish a transport to a broker that includes a key.

At block720, the processing logic identifies a disconnection with the broker. The processing logic may identify that a network connection between the client and the broker via a broker socket is no longer transmitting data.

At block730, upon identifying the disconnection with the broker, the processing logic may provide a subsequent request to establish the transport to the broker that includes the key.

FIG.8is a flow diagram of a method800of establishing a transport between clients supported by a host system, in accordance with some embodiments. Method800may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, a processor, a processing device, a central processing unit (CPU), a system-on-chip (SoC), etc.), software (e.g., instructions running/executing on a processing device), firmware (e.g., microcode), or a combination thereof. In some embodiments, at least a portion of method800may be performed by broker162ofFIG.1.

With reference toFIG.8, method800illustrates example functions used by various embodiments. Although specific function blocks (“blocks”) are disclosed in method800, such blocks are examples. That is, embodiments are well suited to performing various other blocks or variations of the blocks recited in method800. It is appreciated that the blocks in method800may be performed in an order different than presented, and that not all of the blocks in method800may be performed.

Method800begins at block810, where the processing logic receives, from a first client supported by a host system, a first request to establish a transport that includes a first key.

At block820, the processing logic receives, from a second client supported by the host system, a second request to establish the transport that includes a second key.

At block830, the processing logic determines whether the first key matches the second key. At block840, in response to determining that the first key matches the second key, the processing logic provides a first end point of the transport to the first client and a second end point of the transport to the second client.

FIG.9is a flow diagram of a method900of establishing a transport between a client and a virtual switch, in accordance with some embodiments. Method900may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, a processor, a processing device, a central processing unit (CPU), a system-on-chip (SoC), etc.), software (e.g., instructions running/executing on a processing device), firmware (e.g., microcode), or a combination thereof. In some embodiments, at least a portion of method900may be performed by processing device160executing a client, such as client204aofFIG.2.

With reference toFIG.9, method900illustrates example functions used by various embodiments. Although specific function blocks (“blocks”) are disclosed in method900, such blocks are examples. That is, embodiments are well suited to performing various other blocks or variations of the blocks recited in method900. It is appreciated that the blocks in method900may be performed in an order different than presented, and that not all of the blocks in method900may be performed.

Method900begins at block910, where the processing logic receives a key for establishing a transport with a virtual switch.

At block920, the processing logic provides a request to establish the transport to a broker that includes the key.

At block930, the processing logic receives, from the broker, and end point for the transport. A corresponding end point for the transport may be received by the virtual switch, as previously described.

FIG.10is a flow diagram of a method1000of a virtual switch generating a virtual port associated with a received key, in accordance with some embodiments. Method1000may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, a processor, a processing device, a central processing unit (CPU), a system-on-chip (SoC), etc.), software (e.g., instructions running/executing on a processing device), firmware (e.g., microcode), or a combination thereof. In some embodiments, at least a portion of method1000may be performed by processing device160executing a virtual switch, such as virtual switch402ofFIG.4.

With reference toFIG.10, method1000illustrates example functions used by various embodiments. Although specific function blocks (“blocks”) are disclosed in method1000, such blocks are examples. That is, embodiments are well suited to performing various other blocks or variations of the blocks recited in method1000. It is appreciated that the blocks in method1000may be performed in an order different than presented, and that not all of the blocks in method1000may be performed.

Method1000begins at block1010, where the processing logic receives, by a virtual switch, a command to generate a virtual port, wherein the command includes a first key associated with the virtual port.

At block1020, in response to receiving the command, the processing logic generates the virtual port to facilitate network connectivity.

At block1030, the processing logic transmits, to a broker, the key upon generating the virtual port.

At block1040, the processing logic receives, from the broker, an endpoint of a transport to facilitate communication with a client. The client may be associated with a second key that matches the first key, as previously described.

FIG.11is a flow diagram of a method1100of generating a connection between a virtual switch and an execution environment, in accordance with some embodiments. Method1100may be performed by processing logic that may comprise hardware (e.g., circuitry, dedicated logic, programmable logic, a processor, a processing device, a central processing unit (CPU), a system-on-chip (SoC), etc.), software (e.g., instructions running/executing on a processing device), firmware (e.g., microcode), or a combination thereof. In some embodiments, at least a portion of method1100may be performed by broker162ofFIG.1.

With reference toFIG.11, method1100illustrates example functions used by various embodiments. Although specific function blocks (“blocks”) are disclosed in method1100, such blocks are examples. That is, embodiments are well suited to performing various other blocks or variations of the blocks recited in method1100. It is appreciated that the blocks in method1100may be performed in an order different than presented, and that not all of the blocks in method1100may be performed.

Method1100begins at block1110, where the processing logic receives, from a virtual switch, a first request to generate a connection between an execution environment and a virtual switch that includes a first key.

At block1120, the processing logic receives a second request from the execution environment to generate the connection that includes a second key.

At block1130, the processing logic generates the connection between the execution environment and the virtual switch upon determining that the first key matches the second key.

FIG.12is a block diagram of an example computing device1200that may perform one or more of the operations described herein, in accordance with some embodiments. Computing device1200may be connected to other computing devices in a LAN, an intranet, an extranet, and/or the Internet. The computing device may operate in the capacity of a server machine in client-server network environment or in the capacity of a client in a peer-to-peer network environment. The computing device may be provided by a personal computer (PC), a set-top box (STB), a server, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single computing device is illustrated, the term “computing device” shall also be taken to include any collection of computing devices that individually or jointly execute a set (or multiple sets) of instructions to perform the methods discussed herein.

The example computing device1200may include a processing device (e.g., a general purpose processor, a PLD, etc.)1202, a main memory1204(e.g., synchronous dynamic random access memory (DRAM), read-only memory (ROM)), a static memory1206(e.g., flash memory and a data storage device1218), which may communicate with each other via a bus1230.

Processing device1202may be provided by one or more general-purpose processing devices such as a microprocessor, central processing unit, or the like. In an illustrative example, processing device1202may include a complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or a processor implementing other instruction sets or processors implementing a combination of instruction sets. Processing device1202may also comprise one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device1202may be configured to execute the operations described herein, in accordance with one or more aspects of the present disclosure, for performing the operations and steps discussed herein.

Computing device1200may further include a network interface device1208which may communicate with a network1220. The computing device1200also may include a video display unit1210(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device1212(e.g., a keyboard), a cursor control device1214(e.g., a mouse) and an acoustic signal generation device1216(e.g., a speaker). In one embodiment, video display unit1210, alphanumeric input device1212, and cursor control device1214may be combined into a single component or device (e.g., an LCD touch screen).

Data storage device1218may include a computer-readable storage medium1228on which may be stored one or more sets of instructions1225that may include instructions for a broker, e.g., broker162, virtual switch, e.g., virtual switch402, and/or a client, e.g., client502for carrying out the operations described herein, in accordance with one or more aspects of the present disclosure. Instructions1225may also reside, completely or at least partially, within main memory1204and/or within processing device1202during execution thereof by computing device1200, main memory1204and processing device1202also constituting computer-readable media. The instructions1225may further be transmitted or received over a network1220via network interface device1208.

While computer-readable storage medium1228is shown in an illustrative example to be a single medium, the term “computer-readable storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database and/or associated caches and servers) that store the one or more sets of instructions. The term “computer-readable storage medium” shall also be taken to include any medium that is capable of storing, encoding or carrying a set of instructions for execution by the machine and that cause the machine to perform the methods described herein. The term “computer-readable storage medium” shall accordingly be taken to include, but not be limited to, solid-state memories, optical media and magnetic media.

Example 1 is a method comprising: receiving, from a first client supported by a host system, a first request to establish a transport, the request comprising a first key; receiving, from a second client supported by the host system, a second request to establish the transport, the request comprising a second key; determining, by a processing device of the host system, whether the first key matches the second key; and in response to determining that the first key matches the second key, providing a first end point of the transport to the first client and a second end point of the transport to the second client.

Example 2 is the method of Example 1, wherein the first client comprises a virtual switch.

Example 3 is the method of any of Examples 1-2, wherein the first key is provided to the virtual switch with a command to generate a virtual port.

Example 4 is the method of any of Examples 1-3, wherein the second client comprises a virtual machine.

Example 5 is the method of any of Examples 1-4, wherein the second client comprises an application executing within a container.

Example 6 is the method of any of Examples 1-5, wherein the host system supports a plurality of clients and wherein a single socket is used to communicate with the plurality of clients.

Example 7 is the method of any of Examples 1-6, wherein the transport comprises a socket pair.

Example 8 is the method of any of Examples 1-7, wherein the transport supports transferring of file descriptors.

Example 9 is a system comprising: a memory; and a processing device, operatively coupled to the memory, to: receive a key for establishing a transport with a virtual switch; provide a request to establish the transport to a broker, the request comprising the key; and receive, from the broker, an end point for the transport, wherein a corresponding end point for the transport is received by the virtual switch.

Example 10 is the system of Example 9, wherein the broker is to determine whether the key matches a corresponding key provided by the virtual switch.

Example 11 is the system of any of Examples 9-10, wherein the one or more execution environments comprise one or more containers.

Example 12 is the system of any of Examples 9-11, wherein the key is received in response to an instantiation of a virtual machine.

Example 13 is the system of any of Examples 9-12, wherein the transport comprises a socket pair.

Example 14 is the system of any of Examples 9-13, wherein the transport supports transferring of file descriptors.

Example 15 is the system of any of Examples 9-14, wherein the processing device is further to: identify a disconnection with the broker; and provide a subsequent request to establish the transport to the broker, the request comprising the key.

Example 16 is the system of any of Examples 9-15, wherein the processing device is further to: transmit data to the virtual switch via the transport.

Example 17 is a non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to: receive, by the processing device executing a virtual switch, a command to generate a virtual port, wherein the command comprises a first key associated with the virtual port; in response to receiving the command, generate the virtual port to facilitate network connectivity; transmit, to a broker, the key upon generating the virtual port; and receive, from the broker, an end point of a transport to facilitate communication with a client, wherein the client is associated with a second key that matches the first key.

Example 18 is the non-transitory computer-readable storage medium of Example 17, wherein the client comprises an application executing within a container.

Example 19 is the non-transitory computer-readable storage medium of any of Examples 17-18, wherein the client comprises a virtual machine.

Example 20 is the non-transitory computer-readable storage medium of any of Examples 17-19, wherein the transport comprises a socket pair.

Example 21 is the non-transitory computer-readable storage medium of any of Examples 17-20, wherein the transport supports transferring of file descriptors.

Example 22 is the non-transitory computer-readable storage medium of any of Examples 17-21, wherein the processing device is further to: identify a disconnection with the broker; and subsequently transmit the key to the broker.

Example 23 is the non-transitory computer-readable storage medium of any of Examples 17-22, wherein the virtual switch comprises a plurality of virtual ports, and wherein each of the plurality of virtual ports is associated with a corresponding key.

Example 24 is a method comprising: receiving, from a virtual switch, a first request to generate a connection between an execution environment and a virtual switch, the request comprising a first key; receiving a second request from the execution environment to generate the connection, the request comprising a second key; and generating, by a processing device, the connection between the execution environment and the virtual switch upon determining that the first key matches the second key.

Example 25 is the method of Example 24, further comprising: transmitting a command to generate a virtual port for the connection at the virtual switch; and providing the first key to the virtual switch.

Example 26 is the method of any of Examples 24-25, wherein the execution environment comprises a virtual machine.

Example 27 is the method of any of Examples 24-26, wherein the execution environment comprises an application executing within a container.

Example 28 is the method of any of Examples 24-27, wherein the connection comprises a socket pair.

Example 29 is the method of any of Examples 24-28, wherein the connection supports transferring of file descriptors.

Example 30 is the method of any of Examples 24-29, wherein generating the connection between the execution environment and the virtual switch comprises: providing a first end point of the connection to the virtual switch and a second end point of the transport to the execution environment.

Example 31 is an apparatus comprising: means for receiving, from a first client supported by a host system, a first request to establish a transport, the request comprising a first key; means for receiving, from a second client supported by the host system, a second request to establish the transport, the request comprising a second key; means for determining whether the first key matches the second key; and means for in response to determining that the first key matches the second key, providing a first end point of the transport to the first client and a second end point of the transport to the second client.

Example 32 is the apparatus of Example 31, wherein the first client comprises a virtual switch.

Example 33 is the apparatus of any of Examples 31-32, wherein the first key is provided to the virtual switch with a command to generate a virtual port.

Example 34 is the apparatus of any of Examples 31-33, wherein the second client comprises a virtual machine.

Example 35 is the apparatus of any of Examples 31-34, wherein the second client comprises an application executing within a container.

Example 36 is the apparatus of any of Examples 31-35, wherein the host system supports a plurality of clients and wherein a single socket is used to communicate with the plurality of clients.

Example 37 is the apparatus of any of Examples 31-36, wherein the transport comprises a socket pair.

Example 38 is the apparatus of any of Examples 31-37, wherein the transport supports transferring of file descriptors.

Unless specifically stated otherwise, terms such as “receiving,” “configuring,” “identifying,” “transmitting,” or the like, refer to actions and processes performed or implemented by computing devices that manipulates and transforms data represented as physical (electronic) quantities within the computing device's registers and memories into other data similarly represented as physical quantities within the computing device memories or registers or other such information storage, transmission or display devices. Also, the terms “first,” “second,” “third,” “fourth,” etc., as used herein are meant as labels to distinguish among different elements and may not necessarily have an ordinal meaning according to their numerical designation.

Examples described herein also relate to an apparatus for performing the operations described herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computing device selectively programmed by a computer program stored in the computing device. Such a computer program may be stored in a computer-readable non-transitory storage medium.

The methods and illustrative examples described herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used in accordance with the teachings described herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear as set forth in the description above.

The above description is intended to be illustrative, and not restrictive. Although the present disclosure has been described with references to specific illustrative examples, it will be recognized that the present disclosure is not limited to the examples described. The scope of the disclosure should be determined with reference to the following claims, along with the full scope of equivalents to which the claims are entitled.

As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “includes”, and/or “including”, when used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. Therefore, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting.

It should also be noted that in some alternative implementations, the functions/acts noted may occur out of the order noted in the figures. For example, two figures shown in succession may in fact be executed substantially concurrently or may sometimes be executed in the reverse order, depending upon the functionality/acts involved.

Although the method operations were described in a specific order, it should be understood that other operations may be performed in between described operations, described operations may be adjusted so that they occur at slightly different times or the described operations may be distributed in a system which allows the occurrence of the processing operations at various intervals associated with the processing.

Various units, circuits, or other components may be described or claimed as “configured to” or “configurable to” perform a task or tasks. In such contexts, the phrase “configured to” or “configurable to” is used to connote structure by indicating that the units/circuits/components include structure (e.g., circuitry) that performs the task or tasks during operation. As such, the unit/circuit/component can be said to be configured to perform the task, or configurable to perform the task, even when the specified unit/circuit/component is not currently operational (e.g., is not on). The units/circuits/components used with the “configured to” or “configurable to” language include hardware—for example, circuits, memory storing program instructions executable to implement the operation, etc. Reciting that a unit/circuit/component is “configured to” perform one or more tasks, or is “configurable to” perform one or more tasks, is expressly intended not to invoke 35 U.S.C. 112, sixth paragraph, for that unit/circuit/component. Additionally, “configured to” or “configurable to” can include generic structure (e.g., generic circuitry) that is manipulated by software and/or firmware (e.g., an FPGA or a general-purpose processor executing software) to operate in manner that is capable of performing the task(s) at issue. “Configured to” may also include adapting a manufacturing process (e.g., a semiconductor fabrication facility) to fabricate devices (e.g., integrated circuits) that are adapted to implement or perform one or more tasks. “Configurable to” is expressly intended not to apply to blank media, an unprogrammed processor or unprogrammed generic computer, or an unprogrammed programmable logic device, programmable gate array, or other unprogrammed device, unless accompanied by programmed media that confers the ability to the unprogrammed device to be configured to perform the disclosed function(s).

The foregoing description, for the purpose of explanation, has been described with reference to specific embodiments. However, the illustrative discussions above are not intended to be exhaustive or to limit the invention to the precise forms disclosed. Many modifications and variations are possible in view of the above teachings. The embodiments were chosen and described in order to best explain the principles of the embodiments and its practical applications, to thereby enable others skilled in the art to best utilize the embodiments and various modifications as may be suited to the particular use contemplated. Accordingly, the present embodiments are to be considered as illustrative and not restrictive, and the invention is not to be limited to the details given herein, but may be modified within the scope and equivalents of the appended claims.