System and method for scheduling virtual machines based on security policy
An illustrative embodiment disclosed herein is an apparatus including a processor and a memory. In some embodiments, the memory includes programmed instructions that, when executed by the processor, cause the apparatus to apply a category to a first virtual machine (VM) and a second VM, schedule the first VM and the second VM to be placed on a host at least based on the first VM and the second VM including the category, and apply a security policy to the first VM and the second VM at least based on the first VM and the second VM including the category.
1. An apparatus comprising a processor and a memory, wherein the memory includes programmed instructions that, when executed by the processor, cause the apparatus to:
identify a first virtual machine (VM) and a second VM having characteristics corresponding to a security policy;
apply a category to the first VM and the second VM;
schedule the first VM and the second VM to be placed on a same host at least based on the first VM and the second VM including the category; and
apply the security policy to the first VM and the second VM at the same host after the first VM and the second VM are placed on the same host at least based on the first VM and the second VM including the category, the security policy identifying permissible network traffic for the first VM and the second VM.
2. The apparatus of claim 1 , wherein the memory includes the programmed instructions that, when executed by the processor, further cause the apparatus to:
apply the security policy to the first VM and the second VM responsive to the first VM and the second VM being placed on the same host.
3. The apparatus of claim 1 , wherein the memory includes the programmed instructions that, when executed by the processor, further cause the apparatus to:
schedule the first VM and the second VM to be placed on the same host at least based on determining that no anti-affinity policies prevent the first VM and the second VM from being on the same host.
4. The apparatus of claim 1 , wherein the security policy includes a policy identifying at least one of permissible inbound traffic or permissible outbound traffic.
5. A non-transitory computer readable storage medium comprising instructions stored thereon that, when executed by a processor, cause the processor to:
identify a first virtual machine (VM) and a second VM having characteristics corresponding to a security policy;
apply a category to the first VM and the second VM;
schedule the first VM and the second VM to be placed on a same host at least based on the first VM and the second VM including the category; and
apply the security policy to the first VM and the second VM at the same host after the first VM and the second VM are placed on the same host at least based on the first VM and the second VM including the category, the security policy identifying permissible network traffic for the first VM and the second VM.
6. The medium of claim 5 , comprising the instructions stored thereon that, when executed by a processor, further cause the processor to:
apply the security policy to the first VM and the second VM responsive to the first VM and the second VM being placed on the same host.
7. The medium of claim 5 , comprising the instructions stored thereon that, when executed by a processor, further cause the processor to:
schedule the first VM and the second VM to be placed on the same host at least based on determining that no anti-affinity policies prevent the first VM and the second VM from being on the same host.
8. The medium of claim 5 , wherein the security policy includes a policy identifying at least one of permissible inbound traffic or permissible outbound traffic.
9. A computer-implemented method comprising:
identifying, by a processor, a first virtual machine (VM) and a second VM having characteristics corresponding to a security policy;
applying, by the processor, a category to the first VM and the second VM;
scheduling, by the processor, the first VM and the second VM to be placed on a same host at least based on the first VM and the second VM including the category; and
applying, by the processor, the security policy to the first VM and the second VM at the same host after the first VM and the second VM are placed on the same host at least based on the first VM and the second VM including the category, the security policy identifying permissible network traffic for the first VM and the second VM.
10. The method of claim 9 , further comprising:
applying the security policy to the first VM and the second VM responsive to the first VM and the second VM being placed on the same host.
11. The method of claim 9 , further comprising:
scheduling the first VM and the second VM to be placed on the same host at least based on determining that no anti-affinity policies prevent the first VM and the second VM from being on the same host.
12. The method of claim 9 , wherein the security policy includes a policy identifying at least one of permissible inbound traffic or permissible outbound traffic.
13. An apparatus comprising a processor and a memory, wherein the memory includes programmed instructions that, when executed by the processor, cause the apparatus to:
identify a first virtual machine (VM) and a second VM having characteristics corresponding to a security policy;
apply a category to the first VM hosted on a first host and the second VM hosted on a second host;
migrate one of the first VM or the second VM such that the first VM and the second VM are on a same host at least based on the first VM and the second VM including the category; and
apply the security policy to the first VM and the second VM at the same host after the first VM and the second VM are placed on the same host at least based on the first VM and the second VM including the category, the security policy identifying permissible network traffic for the first VM and the second VM.
14. The apparatus of claim 13 , wherein the memory includes the programmed instructions that, when executed by the processor, further cause the apparatus to: apply the security policy to the first VM and the second VM responsive to migrating one of the first VM or the second VM such that the first VM and the second VM are on the same host.
15. The apparatus of claim 13 , wherein the memory includes the programmed instructions that, when executed by the processor, further cause the apparatus to:
migrate one of the first VM or the second VM such that the first VM and the second VM are on the same host at least based on determining that no anti-affinity policies prevent the first VM and the second VM from being on the host.