Performing services on a host
Some embodiments provide a novel method for performing services on a host computer that executes several data compute nodes (DCNs). The method receives, at a module executing on the host, a data message associated with a DCN executing on the host. The method supplies the data message to a service virtual machine (SVM) that executes on the host and on which several service containers execute. One or more of the service containers then perform a set of one or more services on the data message. The method then receives an indication from the SVM that the set of services has been performed on the data message.
1 . A method of performing services on a host computer that executes a plurality of guest virtual machines (GVM) and at least one service virtual machine (SVM), the method comprising:
at the SVM:
receiving a data message associated with a GVM;
identifying, by a message processing engine of the SVM, a set of two or more services that have to be performed on the data message by a set of two or more containers operating on the SVM, the one or more containers being isolated to provide operation-system level segregation for different groups of operations;
successively directing, by the message processing engine, each container in the container set to perform the container's respective service operation on the data message; and
returning the data message to a module executing on the host computer outside of the SVM to forward the data message to a destination of the data message;
wherein the two or more containers are executed within the SVM comprising a container-based service virtual machine to avoid overhead associated with deploying additional virtual machines, and wherein the message processing engine passes the data message from a first container of the set of two or more containers to a second container of the set of two or more containers, and the message processing engine is configured to identify a rule in a rule data storage and to check a connection data storage to determine a status of cached service actions.
2 . The method of claim 1 , wherein the data message's destination is the GVM that executes on the host computer and that is associated with the data message.
3 . The method of claim 1 , wherein the data message's destination operates outside of the host computer.
4 . The method of claim 1 , wherein a software forwarding element executing on the SVM performs the receiving, identifying, directing and returning operations.
5 . The method of claim 1 further comprising receiving a service tag with the data message that identifies the set of two or more services that have to be performed.
6 . The method of claim 1 , wherein identifying the set of two or more service comprises using a set of attributes associated with the data message to identify the set of services to perform.
7 . The method of claim 6 , wherein using the set of attributes comprises using the set of attributes to identify a security profile that specifies the set of services to perform.
8 . The method of claim 1 , wherein at least two different service containers operating on the SVM perform at least two different operations, and the identified set of services specifies a sequence of different service operations that have to be performed on the data message.
9 . The method of claim 1 further comprising creating a connection record for the data message to identify the set of services to perform for a data message flow that includes the data message.
10 . The method of claim 9 further comprising using the connection record to identify the set of services to perform for another data message in the data message flow.
11 . A non-transitory machine readable medium storing a service virtual machine (SVM) that executes on a host computer to perform services on the host computer, which also executes a plurality of guest virtual machines (GVMs), the program comprising sets of instructions for:
receiving a data message associated with a GVM;
identifying, by a message processing engine of the SVM, a set of two or more services that have to be performed on the data message by a set of two or more containers operating on the SVM, the one or more containers being isolated to provide operation-system level segregation for different groups of operations;
successively directing, by the message processing engine, each container in the container set to perform the container's respective service operation on the data message; and
returning the data message to a module executing on the host computer outside of the SVM to forward the data message to a destination of the data message;
wherein the two or more containers are executed the SVM comprising within a container-based service virtual machine to avoid overhead associated with deploying additional virtual machines, and wherein the message processing engine passes the data message from a first container of the set of two or more containers to a second container of the set of two or more containers, and the message processing engine is configured to identify a rule in a rule data storage and to check a connection data storage to determine a status of cached service actions.
12 . The non-transitory machine readable medium of claim 11 , wherein the data message's destination is the GVM that executes on the host computer and that is associated with the data message.
13 . The non-transitory machine readable medium of claim 11 , wherein the data message's destination operates outside of the host computer.
14 . The non-transitory machine readable medium of claim 11 , wherein a software forwarding element executing on the SVM performs the receiving, identifying, directing and returning operations.
15 . The non-transitory machine readable medium of claim 11 , wherein the SVM further comprises a set of instructions for receiving a service tag with the data message that identifies the set of two or more services that have to be performed.
16 . The non-transitory machine readable medium of claim 11 , wherein the set of instructions for identifying the set of two or more service comprises a set of instructions for using a set of attributes associated with the data message to identify the set of services to perform.
17 . The non-transitory machine readable medium of claim 16 , wherein the set of instructions for using the set of attributes comprises a set of instructions for using the set of attributes to identify a security profile that specifies the set of services to perform.
18 . The non-transitory machine readable medium of claim 11 , wherein at least two different service containers operating on the SVM perform at least two different operations, and the identified set of services specifies a sequence of different service operations that have to be performed on the data message.
19 . The non-transitory machine readable medium of claim 11 , wherein the SVM further comprises a set of instructions for creating a connection record for the data message to identify the set of services to perform for a data message flow that includes the data message.
20 . The non-transitory machine readable medium of claim 19 , wherein the SVM further comprises a set of instructions for using the connection record to identify the set of services to perform for another data message in the data message flow.