Distributed data processing application service networking in a provider network

1. A computer-implemented method comprising:

receiving, at a computer system in a warm pool of computer systems hosted in a provider network, a first request to launch a virtual machine to execute a distributed data processing application runtime, the first request including a session network identifier;

creating, by an agent executing on the computer system, a jail to host a virtual machine;

launching the requested virtual machine within the jail from a virtual machine snapshot stored locally on the computer system;

setting an internet protocol (IP) address of the virtual machine, wherein the IP address of the virtual machine is formed at least in part by combining an IP subnet assigned to the computer system with the session network identifier; and

configuring a firewall within the jail to allow packets having a source or destination address that matches a portion of the IP address of the virtual machine that includes the session network identifier.

2. The computer-implemented method of claim 1 , further comprising:

by a network manager service of the provider network:

shuffling at least a portion of an N-bit session network identifier space; and

dividing the shuffled session network identifier space into chunks, each chunk having a plurality of unused session network identifiers;

by a session manager service of the provider network:

obtaining a chunk of unused session network identifiers from the network manager service;

selecting the session network identifier from the obtained chunk of unused session network identifiers; and

causing the first request to launch the virtual machine to be sent.

3. The computer-implemented method of claim 1 , further comprising:

by the virtual machine:

executing the distributed data processing application runtime to process a calculation;

sending a second request to launch another virtual machine to a session manager service of the provider network; and

by the session manager service:

obtaining the session network identifier associated with the distributed data processing application runtime executed by the virtual machine; and

sending a third request to launch another virtual machine to another computer system in the warm pool of computer systems, the third request including the session network identifier.

4. A computer-implemented method comprising:

receiving, at a computer system hosted in a provider network, a first request to launch a virtual machine, the first request including a session network identifier to identify a network of a distributed data processing application cluster hosted by the provider network;

launching a first virtual machine;

setting an internet protocol (IP) address of the first virtual machine, wherein the IP address of the first virtual machine is formed at least in part by combining an IP subnet assigned to the computer system with the session network identifier; and

configuring a firewall controlling network traffic to and from the first virtual machine to allow packets having a source or destination address that matches a portion of the IP address of the first virtual machine that includes the session network identifier.

5. The computer-implemented method of claim 4 , further comprising:

by a session manager service of the provider network:

obtaining a chunk of unused session network identifiers from a network manager service of the provider network;

selecting the session network identifier from the obtained chunk of unused session network identifiers; and

causing the first request to launch the first virtual machine to be sent.

6. The computer-implemented method of claim 5 , further comprising:

updating, by the session manager service, a session metadata data store to associate the selected session network identifier with a session identifier that identifies the distributed data processing application cluster.

7. The computer-implemented method of claim 5 , further comprising:

by the network manager service:

shuffling at least a portion of an N-bit session network identifier space; and

dividing the shuffled session network identifier space into chunks, each chunk having a plurality of unused session network identifiers.

8. The computer-implemented method of claim 4 , further comprising:

generating a local network identifier for the first virtual machine;

determining that the local network identifier does not cause an address conflict with another virtual machine hosted by the computer system; and

wherein the IP address of the first virtual machine is further formed at least in part by combining the IP subnet assigned to the computer system, the session network identifier, and the local network identifier.

9. The computer-implemented method of claim 4 , further comprising sending, from the first virtual machine, a request to launch another virtual machine to execute a distributed data processing application runtime to process a portion of a calculation, the request including the session network identifier.

10. The computer-implemented method of claim 4 , wherein launching a first virtual machine comprises:

creating a jail within an operating system running on the computer system; and

launching the first virtual machine from a virtual machine bundle that includes a snapshot of a paused virtual machine having already launched a distributed data processing application runtime.

11. The computer-implemented method of claim 10 , wherein the firewall is within the jail.

12. The computer-implemented method of claim 4 , further comprising:

receiving, at a second computer system hosted in the provider network, a second request to launch another virtual machine, the second request including the session network identifier;

launching a second virtual machine on the second computer system;

setting an IP address of the second virtual machine, wherein the IP address of the second virtual machine is formed at least in part by combining an IP subnet assigned to the second computer system with the session network identifier; and

configuring a second firewall controlling network traffic to and from the second virtual machine to allow packets having a source or destination address that matches a portion of the IP address of the first virtual machine that includes the session network identifier; and

sending, by the first virtual machine, a packet to the second virtual machine without modifying the firewall on the first virtual machine.

13. A system comprising:

a computer system hosted in a provider network, the computer system including instructions that upon execution cause the computer system to:

receive a first request to launch a virtual machine, the first request including a session network identifier to identify a network of a distributed data processing application cluster hosted by the provider network;

launch a first virtual machine;

set an internet protocol (IP) address of the first virtual machine, wherein the IP address of the first virtual machine is formed at least in part by combining an IP subnet assigned to the computer system with the session network identifier; and

configure a firewall controlling network traffic to and from the first virtual machine to allow packets having a source or destination address that matches a portion of the IP address of the first virtual machine that includes the session network identifier.

14. The system of claim 13 , further comprising:

a first one or more electronic devices to implement a session manager service of the provider network, the session manager service including instructions that upon execution cause the session manager service to:

obtain a chunk of unused session network identifiers from a network manager service of the provider network;

select the session network identifier from the obtained chunk of unused session network identifiers; and

cause the first request to launch the first virtual machine to be sent.

15. The system of claim 14 , wherein the session manager service includes further instructions that upon execution cause the session manager service to update a session metadata data store to associate the selected session network identifier with a session identifier that identifies the distributed data processing application cluster.

16. The system of claim 14 , further comprising:

a second one or more electronic devices to implement a network manager service of the provider network, the network manager service including instructions that upon execution cause the network manager service to:

shuffle at least a portion of an N-bit session network identifier space; and

divide the shuffled session network identifier space into chunks, each chunk having a plurality of unused session network identifiers.

17. The system of claim 14 :

wherein the session manager service includes further instructions that upon execution cause the session manager service to generate a local network identifier for the first virtual machine;

wherein the computer system includes further instructions that upon execution cause the computer system to determine that the local network identifier does not cause an address conflict with another virtual machine hosted by the computer system; and

wherein the IP address of the first virtual machine is further formed at least in part by combining the IP subnet assigned to the computer system, the session network identifier, and the local network identifier.

18. The system of claim 13 , wherein the first virtual machine includes instructions that upon execution cause the first virtual machine to send a request to launch another virtual machine to execute a distributed data processing application runtime to process a portion of a calculation, the request including the session network identifier.

19. The system of claim 13 , wherein the computer system includes further instructions that upon execution cause the computer system to:

create a jail within an operating system running on the computer system; and

launch the first virtual machine from a virtual machine bundle that includes a snapshot of a paused virtual machine having already launched a distributed data processing application runtime.

20. The system of claim 19 , wherein the firewall is within the jail.