Updating management instructions for bound services in a distributed network management system
Management instructions for a managed servers are updated according to a set of rules included in management policy. A global manager computer receives information describing a change in a bound service executed by the particular managed server. The global manager generates an updated description of the particular managed server is generated by modifying an initial description of the particular managed server according to the received information describing the change in the bound service. The global manager determines currently relevant rules for the particular managed server. If the currently-relevant rules differ from previously-relevant rules, the global manager determines a rule is that should be added. The global manager generates a function-level instruction including a reference to an authorized actor-set of actors permitted to communicate with the bound service. The global manager configures the particular managed server to enforce the function-level instruction.
1. A method for distributing rules that control communications between managed servers, the method comprising:
obtaining service information for a managed server describing services provided by the managed server;
assigning respective label sets to the services provided by the managed server based on the obtained service information;
determining a dominant label set for the services that is assigned to a majority of the services provided by the managed server;
assigning the dominant label set to the managed server;
identifying a group of bound services of the set of services that have a differing label set from the dominant label set;
obtaining a policy comprising a plurality of rules for controlling the communications between the managed servers;
identifying a first rule of the plurality of rules for controlling communications to or from managed servers having the dominant label set;
identifying a second rule of the plurality of rules for controlling communications associated with services having the differing label set; and
distributing instructions to the managed server to enable the managed server to enforce the first rule and the second rule.
2. The method of claim 1 , wherein distributing the instructions comprises:
generating a first function-level instruction for implementing the first rule;
generating a second function-level instruction for implementing the second rule; and
sending the first functional-level instruction and the second function-level instruction to the managed server.
3. The method of claim 1 , wherein identifying the group of bound services further comprises:
assigning a group identifier to the group of bound services; and
storing an association between the group identifier and each of the group of bound services.
4. The method of claim 1 , wherein the managed server provides services in a plurality of different bound service groups.
5. The method of claim 1 , wherein the label set comprises a multi-dimensional set of labels.
6. The method of claim 1 , wherein assigning the respective label sets comprises automatically generating the label sets.
7. The method of claim 1 , wherein assigning the respective label sets comprises:
assigning a role label based on one or more processes associated with the services.
8. A non-transitory computer-readable storage medium storing instructions executable by one or more processors to perform steps for distributing rules that control communications between managed servers, the steps comprising:
obtaining service information for a managed server describing services provided by the managed server;
assigning respective label sets to the services provided by the managed server based on the obtained service information;
determining a dominant label set for the services that is assigned to a majority of the services provided by the managed server;
assigning the dominant label set to the managed server;
identifying a group of bound services of the set of services that have a differing label set from the dominant label set;
obtaining a policy comprising a plurality of rules for controlling the communications between the managed servers;
identifying a first rule of the plurality of rules for controlling communications to or from managed servers having the dominant label set;
identifying a second rule of the plurality of rules for controlling communications associated with services having the differing label set; and
distributing instructions to the managed server to enable the managed server to enforce the first rule and the second rule.
9. The non-transitory computer-readable storage medium of claim 8 , wherein distributing the instructions comprises:
generating a first function-level instruction for implementing the first rule;
generating a second function-level instruction for implementing the second rule; and
sending the first functional-level instruction and the second function-level instruction to the managed server.
10. The non-transitory computer-readable storage medium of claim 8 , wherein identifying the group of bound services further comprises:
assigning a group identifier to the group of bound services; and
storing an association between the group identifier and each of the group of bound services.
11. The non-transitory computer-readable storage medium of claim 8 , wherein the managed server provides services in a plurality of different bound service groups.
12. The non-transitory computer-readable storage medium of claim 8 , wherein the label set comprises a multi-dimensional set of labels.
13. The non-transitory computer-readable storage medium of claim 8 , wherein assigning the respective label sets comprises automatically generating the label sets.
14. The non-transitory computer-readable storage medium of claim 8 , wherein assigning the respective label sets comprises:
assigning a role label based on one or more processes associated with the services.
15. A computer system comprising:
one or more processors; and
a non-transitory computer-readable storage medium storing instructions executable by the one or more processors to perform steps for distributing rules that control communications between managed servers, the steps comprising:
obtaining service information for a managed server describing services provided by the managed server;
assigning respective label sets to the services provided by the managed server based on the obtained service information;
determining a dominant label set for the services that is assigned to a majority of the services provided by the managed server;
assigning the dominant label set to the managed server;
identifying a group of bound services of the set of services that have a differing label set from the dominant label set;
obtaining a policy comprising a plurality of rules for controlling the communications between the managed servers;
identifying a first rule of the plurality of rules for controlling communications to or from managed servers having the dominant label set;
identifying a second rule of the plurality of rules for controlling communications associated with services having the differing label set; and
distributing instructions to the managed server to enable the managed server to enforce the first rule and the second rule.
16. The computer system of claim 15 , wherein distributing the instructions comprises:
generating a first function-level instruction for implementing the first rule;
generating a second function-level instruction for implementing the second rule; and
sending the first functional-level instruction and the second function-level instruction to the managed server.
17. The computer system of claim 15 , wherein identifying the group of bound services further comprises:
assigning a group identifier to the group of bound services; and
storing an association between the group identifier and each of the group of bound services.
18. The computer system of claim 15 , wherein the managed server provides services in a plurality of different bound service groups.
19. The computer system of claim 15 , wherein the label set comprises a multi-dimensional set of labels.
20. The computer system of claim 15 , wherein assigning the respective label sets comprises automatically generating the label sets.