Policy definition and enforcement for a network virtualization platform

1. A method of defining policies for a network virtualization platform of a data center, the method comprising:

receiving a registration of one or more candidate actions available for each of a plurality of data center services;

providing an interface for defining a policy template by identifying a set of data center resources and identifying a set of registered actions to apply to the identified set of data center resources;

through the interface, receiving an identification of a set of data center resources and an identification of a set of actions, from the registered actions, to be applied to the identified set of data center resources; and

instantiating the template into a set of policy instances, each policy instance comprising an identification of one or more resources and identification of one or more actions identified in the policy template, wherein at least two instantiated policy instances are applicable to two different forwarding or middlebox services in the data center;

wherein the policy is enforced by the set of data center services by applying the actions identified in each policy instance to the resources identified in the policy instance.

2. The method of claim 1 , wherein defining the policy template further comprises receiving a definition of a set of variables, each variable defining an attribute of an action to be applied to a resource identified in the policy template.

3. The method of claim 2 further comprising providing a value for each variable in the policy using an environment profile of each policy instance when instantiating the policy instance.

4. The method of claim 1 , wherein the data center services comprise one or more of a firewall service, a load balancing service, a networking service, an encryption service, a security service, and an edge service.

5. The method of claim 1 further comprising:

receiving a registration of one or more actions provided by a new service; and

receiving a modification to the policy template by selecting one or more actions of the new service to apply to a data center resource.

6. The method of claim 5 further comprising updating the set of policy instances based on the modified template.

7. The method of claim 1 , wherein at least one action in the set of actions identified in the policy template is registered by a service that is not a native service of the network virtualization platform.

8. The method of claim 1 , wherein at least one action in the set of actions identified in the policy template is registered by a service that is provided by a particular tenant of the data center.

9. A non-transitory machine readable medium storing program that when executed by at least one processing unit defines policies for a network virtualization platform of a data center, the program comprising sets of instructions for:

receiving a registration of one or more candidate actions available for each of a plurality of data center services;

providing an interface for defining a policy template by identifying a set of data center resources and identifying a set of registered actions to apply to the identified set of data center resources;

through the interface, receiving an identification of a set of data center resources and an identification of a set of actions, from the registered actions, to be applied to the identified set of data center resources; and

instantiating the template into a set of policy instances, each policy instance comprising an identification of one or more resources and identification of one or more actions identified in the policy template, wherein at least two instantiated policy instances are applicable to two different forwarding or middlebox services in the data center;

wherein the policy is enforced by the set of data center services by applying the actions identified in each policy instance to the resources identified in the policy instance.

10. The non-transitory machine readable medium of claim 9 , wherein the set of instructions for defining the policy template further comprises a set of instructions for defining a set of variables, each variable defining an attribute of an action to be applied to a resource identified in the policy template.

11. The non-transitory machine readable medium of claim 10 , the program further comprising a set of instructions for providing a value for each variable in the policy when instantiating the policy instance.

12. The non-transitory machine readable medium of claim 10 , the program further comprising sets of instructions for:

receiving a registration of one or more actions provided by a new service; and

receiving a modification to the policy template by selecting one or more actions of the new service to apply to a data center resource.

13. The non-transitory machine readable medium of claim 12 , the program further comprising a set of instructions for updating the policy instance based on the modified template.

14. The non-transitory machine readable medium of claim 9 , wherein the data center services comprise one or more of a firewall service, a load balancing service, a networking service, an encryption service, a security service, and an edge service.

15. The non-transitory machine readable medium of claim 9 , wherein at least one action in the set of actions identified in the policy template is registered by a service that is not a native service of the network virtualization platform.

16. The non-transitory machine readable medium of claim 9 , wherein at least one action in the set of actions identified in the policy template is registered by a service that is provided by a particular tenant of the data center.

17. A system comprising:

a set of processing unit; and

a non-transitory machine readable medium storing program that when executed by one of the processing units defines policies for a network virtualization platform of a data center, the program comprising sets of instructions for:

receiving a registration of one or more candidate actions available for each of a plurality of data center services;

providing an interface for defining a policy template by identifying a set of data center resources and identifying a set of registered actions to apply to the identified set of data center resources;

through the interface, receiving an identification of a set of data center resources and an identification of a set of actions, from the registered actions, to be applied to the identified set of data center resources; and

instantiating the template into a set of policy instances, each policy instance comprising an identification of one or more resources and identification of one or more actions identified in the policy template, wherein at least two instantiated policy instances are applicable to two different forwarding or middlebox services in the data center;

wherein the policy is enforced by the set of data center services by applying the actions identified in each policy instance to the resources identified in the policy instance.

18. The system of claim 17 , wherein the set of instructions for defining the policy template further comprises a set of instructions for defining a set of variables, each variable defining an attribute of an action to be applied to a resource identified in the policy template.

19. The system of claim 17 , the program further comprising a set of instructions for providing a value for each variable in the policy when instantiating the policy instance.

20. The system of claim 17 , wherein the data center services comprise one or more of a firewall service, a load balancing service, a networking service, an encryption service, a security service, and an edge service.