Automated scaling of packet processing service resources
A virtual network interface is configured to receive packets of an application at a packet processing service. A first set of fast-path nodes of the service is assigned to execute packet rewriting rules on packets received via the virtual network interface. Based on analysis of metrics obtained from the set of fast-path nodes, a determination is made that a criterion for scaling up fast-path nodes has been met. A second set of fast-path nodes is assigned to execute packet rewriting rules on additional packets received via the interface, with the number of nodes included in the second set based on a statistic (indicated by the metrics) of the size of packets transmitted via the virtual network interface.
1. A system, comprising:
a control plane server of a packet processing service of a cloud computing environment; and
a plurality of fast-path nodes of the packet processing service, wherein individual ones of the fast-path nodes are configured to execute packet rewriting rules on packets of one or more applications;
wherein the control plane server is configured to:
assign a first virtual network interface to receive packets of a first application at the packet processing service, wherein a first network address assigned to the first virtual network interface is utilized as a destination address of packets of the first application which are to be rewritten at the packet processing service;
assign, to execute packet rewriting rules on packets of the first application, a first set of fast-path nodes of the plurality of fast-path nodes, wherein the first set of fast-path nodes is configured in multi-tenant mode, wherein in accordance with the multi-tenant mode, a first fast-path node of the first set executes packet rewriting rules on packets of a plurality of applications including the first application and a second application, wherein a second network address assigned to a second virtual network interface is utilized as a destination address of packets of the second application which are to be rewritten at the packet processing service;
determine, based at least in part on analysis of a set of metrics obtained from the first set of fast-path nodes, that a criterion for scaling up fast-path nodes has been satisfied by the first application, and that the criterion for scaling up fast-path nodes has not been satisfied by the second application;
assign, to execute packet rewriting rules on at least some additional packets of the first application, a second set of fast-path nodes configured in single-tenant mode, such that individual fast-path nodes of the second set execute packet rewriting rules on packets of no other application than the first application, wherein the number of fast-path nodes included in the second set is based at least on an average size of packets transmitted via the first virtual network interface, and wherein the average size is indicated by the set of metrics; and
cause, after assignment of the second set of fast-path nodes, (a) a packet rewriting rule to be executed on an additional packet of the first application at a particular fast-path node of the second set of fast-path nodes and (b) a packet rewriting rule to be executed on an additional packet of the second application at a particular fast-path node of the first set of fast-path nodes.
2. The system as recited in claim 1 , wherein the control plane server is further configured to:
cause a compute instance of a particular category of a plurality of categories of compute instances of a virtualized computing service to be launched, wherein a performance capacity of a compute instance of the particular category differs from a performance capacity of a compute instance of another category of the plurality of categories; and
cause a particular node of the second set of fast-path nodes to be run at the compute instance.
3. The system as recited in claim 2 , wherein the control plane server is further configured to:
obtain an indication of a first category of the plurality of categories of a first compute instance at which a first node of the first set of fast-path nodes runs, wherein the number of fast-path nodes included in the second set of fast-path nodes is based at least in part on the first category.
4. The system as recited in claim 3 , wherein the particular category differs from the first category.
5. The system as recited in claim 1 , wherein the control plane server is further configured to:
determine, based at least in part on analysis of an additional set of metrics obtained from the second set of fast-path nodes, that a criterion for reverting to using fast-path nodes in multi-tenant mode has been satisfied by the first application; and
cause a fast-path node of the first set of fast-path nodes to execute a packet rewriting rule on another packet of the first application.
6. A computer-implemented method, comprising:
configuring a first virtual network interface to receive packets of a first application at a packet processing service, wherein a first network address assigned to the first virtual network interface is utilized as a destination address of packets of the first application which are to be rewritten at the packet processing service;
assigning, to execute packet rewriting rules on packets of the first application, a first set of fast-path nodes of a plurality of fast-path nodes of the packet processing service;
determining, based at least in part on analysis of a set of metrics obtained from the first set of fast-path nodes, that a criterion for scaling up fast-path nodes has been satisfied by the first application; and
assigning, to execute packet rewriting rules on at least some additional packets of the first application, a second set of fast-path nodes, wherein the number of fast-path nodes included in the second set is based at least in part on a statistic of the size of packets transmitted via the first virtual network interface, and wherein the statistic is indicated by the set of metrics.
7. The computer-implemented method as recited in claim 6 , further comprising:
launching a compute instance of a particular category of a plurality of categories of compute instances of a virtualized computing service, wherein a performance capacity of a compute instance of the particular category differs from a performance capacity of a compute instance of another category of the plurality of categories; and
launching a particular node of the second set of fast-path nodes at the compute instance.
8. The computer-implemented method as recited in claim 7 , the computer-implemented method further comprising:
obtaining an indication of a first category of the plurality of categories of a first compute instance at which a first node of the first set of fast-path nodes runs, wherein the number of fast-path nodes included in the second set of fast-path nodes is based at least in part on the first category.
9. The computer-implemented method as recited in claim 8 , wherein the particular category differs from the first category.
10. The computer-implemented method as recited in claim 6 , further comprising:
providing, via a programmatic interface, based at least in part on analysis of the set of metrics, a recommendation to increase a frame size limit of packets of the first application.
11. The computer-implemented method as recited in claim 6 , further comprising:
configuring the first set of fast-path nodes in multi-tenant mode, wherein in accordance with the multi-tenant mode, a first fast-path node of the first set executes packet rewriting rules on packets of a plurality of applications including the first application and a second application, wherein a second network address assigned to a second virtual network interface is utilized as a destination address of packets of the second application which are to be rewritten at the packet processing service.
12. The computer-implemented method as recited in claim 11 , further comprising:
configuring the second set of fast-path nodes in single-tenant mode, wherein in accordance with the single-tenant mode, a second fast-path node of the second set of fast-path nodes executes packet rewriting rules on packets of no other application than the first application.
13. The computer-implemented method as recited in claim 11 , further comprising:
receiving, via a programmatic interface, an indication of a tenancy preference for nodes assigned to the first application; and
selecting a tenancy mode for fast-path nodes of the second set based at least in part on the tenancy preference.
14. The computer-implemented method as recited in claim 6 , further comprising:
assigning a first set of exception-path nodes of the packet processing service to the first application, wherein the first set of exception-path nodes includes a flow state tracking node and a rewriting decisions node, wherein the flow state tracking node is configured to store flow state information of packet flows of the first application, and wherein the rewriting decisions node is configured to generate packet rewriting rules of the first application which are cached and executed at fast-path nodes; and
in response to determining, based at least in part on analysis of a particular metric of the first application, that a criterion for scaling up exception-path nodes of the first application has been met, assigning at least one additional exception-path node to the first application.
15. The computer-implemented method as recited in claim 14 , wherein the particular metric comprises a rate at which network connections are established for transmitting packets of the first application.
16. A non-transitory computer-accessible storage medium storing program instructions that when executed on a processor:
configure a virtual network interface to receive packets of an application at a packet processing service, wherein a network address assigned to the virtual network interface is utilized as a destination address of packets of the application which are to be rewritten at the packet processing service;
assign, to execute packet rewriting rules on packets of the application which are received via the virtual network interface, a first set of fast-path nodes of a plurality of fast-path nodes of the packet processing service;
determine, based at least in part on analysis of a set of metrics obtained from the first set of fast-path nodes, that a criterion for scaling up fast-path nodes has been satisfied by the first application; and
assign, to execute packet rewriting rules on at least some additional packets of the application, a second set of fast-path nodes, wherein the number of fast-path nodes included in the second set is based at least in part on a statistic of the size of packets transmitted via the virtual network interface, and wherein the statistic is indicated by the set of metrics.
17. The non-transitory computer-accessible storage medium as recited in claim 16 , storing further program instructions that when executed on the processor:
cause a compute instance of a particular category of a plurality of categories of compute instances of a virtualized computing service to be launched, wherein a performance capacity of a compute instance of the particular category differs from a performance capacity of a compute instance of another category of the plurality of categories; and
launch a particular fast-path node of the second set of fast-path nodes at the compute instance.
18. The non-transitory computer-accessible storage medium as recited in claim 17 , storing further program instructions that when executed on the processor:
obtain an indication of a first category of the plurality of categories of a first compute instance at which a first fast-path node of the first set of fast-path nodes runs, wherein the number of fast-path nodes included in the second set of fast-path nodes is based at least in part on the first category.
19. The non-transitory computer-accessible storage medium as recited in claim 18 , wherein the particular category differs from the first category.
20. The non-transitory computer-accessible storage medium as recited in claim 16 , storing further program instructions that when executed on the processor:
assign a set of exception-path nodes of a plurality of exception-path nodes of the packet processing service to the application, wherein the set of exception-path nodes includes a flow state tracking node and a rewriting decisions node, wherein the flow state tracking node is configured to store flow state information of packet flows of the application, and wherein the rewriting decisions node is configured to generate packet rewriting rules of the application which are cached and executed at fast-path nodes; and
in response to determining, based at least in part on analysis of a particular metric of the application, that a criterion for scaling up exception-path nodes of the application has been met, assign at least one additional exception-path node to the application.