Service level enforcement in distributed system based on subscriptions
Methods and systems for managing the operation of a deployment are provided. The deployment may be managed in accordance with a subscription model. The subscription model may use subscriptions to define the extent and limits on use of services provided by the deployment. The subscription services and limits may be enforced by management controllers of network devices of the deployment. The management controllers may operate independently from control planes and data planes of the network devices. If a plane is suspected of being compromised, the management controllers may take action to confirm the suspicions. If confirmed, then remedial activity may be initiated to address the compromised plane. The remedial activity may include use of falsified network condition reports to initiate programming of the data plane.
1. A method of managing operation of a distributed system, the method comprising:
making, by a management controller of a first network device, an identification that a control plane of the first network device is suspected of being compromised;
identifying, by the management controller and based on the identification, a level of network service provided by a data plane of the first network device and that is governed by a subscription;
making, by the management controller, a first determination regarding whether the level of network service is commensurate with the subscription;
in a first instance of the first determination where the level of network service is not commensurate with the subscription:
providing, by the management controller and based on the subscription, a falsified network condition report to the control plane;
programming, by the control plane and based on the falsified network condition report, a data plane of the first network device to conform operation of the data plane to the subscription to obtain an updated data plane; and
providing, by the first network device, network data unit processing services using the updated data plane.
2. The method of claim 1 , wherein the falsified network condition report indicates a level of network data unit processing capability of a second network device does not reflect an actual level of network data unit processing capability of the second network device.
3. The method of claim 2 , wherein the level of network data unit processing capability of the second network device is selected to cause the control plane to program the data plane to reduce forwarding of network data units to the second network device.
4. The method of claim 2 , wherein the level of network data unit processing capability is a latency for processing of network data units forwarded to the second network device by the first network device.
5. The method of claim 2 , wherein the falsified network condition report is provided by injecting it into the data plane.
6. The method of claim 5 , wherein the falsified network condition report appears, to the control plane, as having originated from the second network device.
7. The method of claim 1 , wherein the control plane is programmed to automatically program the data plane based on network condition reports received from other network devices.
8. The method of claim 1 , wherein the management controller comprises a data processing system, the control plane is hosted by computing resources of the first network device, and the data processing system operates independently from the computing resources.
9. The method of claim 8 , wherein the management controller is operably connected to the computing resources via a first management channel, and the first management channel being usable by the management controller to configure the computing resources.
10. The method of claim 9 , wherein the data plane is hosted by a special purposes hardware device operably connected to in-band links through which network traffic is obtained and forwarded on to other devices, and the management controller is operably connected to at least one other device via an out-of-band link.
11. The method of claim 10 , wherein the management controller is operably connected to the special purpose hardware device via a second management channel, and the second management channel being usable by the management controller to configure the special purpose hardware device.
12. The method of claim 11 , wherein the special purpose hardware device comprises a switch application specific integrated circuit adapted to forward network traffic.
13. The method of claim 1 , wherein the subscription is for the level of network service to be provided by the first network device to a subscribing entity.
14. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause a network device to perform operations for managing operation of a distributed system, the operations comprising:
making, by a management controller of a first network device, an identification that a control plane of the first network device is suspected of being compromised;
identifying, by the management controller and based on the identification, a level of network service provided by a data plane of the first network device and that is governed by a subscription;
making, by the management controller, a first determination regarding whether the level of network service is commensurate with the subscription;
in a first instance of the first determination where the level of network service is not commensurate with the subscription:
providing, by the management controller and based on the subscription, a falsified network condition report to the control plane;
programming, by the control plane and based on the falsified network condition report, a data plane of the first network device to conform operation of the data plane to the subscription to obtain an updated data plane; and
providing, by the first network device, network data unit processing services using the updated data plane.
15. The non-transitory machine-readable medium of claim 14 , wherein the falsified network condition report indicates a level of network data unit processing capability of a second network device does not reflect an actual level of network data unit processing capability of the second network device.
16. The non-transitory machine-readable medium of claim 15 , wherein the level of network data unit processing capability of the second network device is selected to cause the control plane to program the data plane to reduce forwarding of network data units to the second network device.
17. The non-transitory machine-readable medium of claim 15 , wherein the level of network data unit processing capability is a latency for processing of network data units forwarded to the second network device by the first network device.
18. A first network device, comprising:
a processor; and
a memory coupled to the processor to store instructions, which when executed by the processor, cause the first network device to perform operations for managing operation of a distributed system, the operations comprising:
making, by a management controller of a first network device, an identification that a control plane of the first network device is suspected of being compromised;
identifying, by the management controller and based on the identification, a level of network service provided by a data plane of the first network device and that is governed by a subscription;
making, by the management controller, a first determination regarding whether the level of network service is commensurate with the subscription;
in a first instance of the first determination where the level of network service is not commensurate with the subscription:
providing, by the management controller and based on the subscription, a falsified network condition report to the control plane;
programming, by the control plane and based on the falsified network condition report, a data plane of the first network device to conform operation of the data plane to the subscription to obtain an updated data plane; and
providing, by the first network device, network data unit processing services using the updated data plane.
19. The first network device of claim 18 , wherein the falsified network condition report indicates a level of network data unit processing capability of a second network device does not reflect an actual level of network data unit processing capability of the second network device.
20. The first network device of claim 19 , wherein the level of network data unit processing capability of the second network device is selected to cause the control plane to program the data plane to reduce forwarding of network data units to the second network device.