Achieving application consistent snapshots in absence of network connectivity between in-guest agent and virtual machine management center
A command is received by a data protection agent to conduct an application-consistent backup of an application. The agent and application are installed as guests in a virtual machine (VM) provided by a hypervisor of a host. The VM is connected to a virtual machine guest network. The hypervisor is connected to an infrastructure network, separate from the virtual machine guest network. A socket communication channel is established between the agent and a snapshot data mover running on the host and outside the VM. A request for a snapshot is issued over the socket communication channel to the snapshot data mover. The snapshot request is passed to a virtual machine manager connected to the infrastructure network.
1 . A method comprising:
receiving at a data protection agent a command to conduct an application-consistent backup of an application, the data protection agent and the application being installed as guests in a virtual machine provided by a hypervisor of a host, the virtual machine being connected to a virtual machine guest network and the host being connected to an infrastructure network, separate from the virtual machine guest network;
establishing a socket communication channel between the data protection agent and a snapshot data mover running on the same host, at a host-level, and outside of the virtual machine;
after establishment of the socket communication channel, issuing, from the data protection agent to a copy service, a request to freeze the application, the request to freeze the application thereby triggering a start of a time window within which the copy service allows the application to be frozen;
issuing, from the data protection agent to the snapshot data mover, a request over the socket communication channel to take a snapshot of the application; and
passing the request to take the snapshot to a virtual machine management center connected to the host through the infrastructure network, the virtual machine management center being responsible for management of multiple hosts connected to the virtual machine management center via the infrastructure network, each host hosting one or more virtual machines, wherein the virtual machine management center is maintained as an entity protected from direct communications from the guests in the virtual machine because of an absence of network connectivity resulting from the infrastructure network being separate from the virtual machine guest network.
2 . The method of claim 1 wherein the establishing a socket communication channel further comprises:
receiving, at the snapshot data mover, a connection request from the virtual machine; and
validating the connection request.
3 . The method of claim 1 wherein the socket communication channel is established before issuance of a request to freeze the application for snapshotting.
4 . The method of claim 1 wherein the virtual machine guest network is isolated from the infrastructure network.
5 . The method of claim 1 wherein the virtual machine is blocked from issuing communications to the virtual machine manager.
6 . A system comprising: a processor; and memory configured to store one or more sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
receiving at a data protection agent a command to conduct an application-consistent backup of an application, the data protection agent and the application being installed as guests in a virtual machine provided by a hypervisor of a host, the virtual machine being connected to a virtual machine guest network and the host being connected to an infrastructure network, separate from the virtual machine guest network;
establishing a socket communication channel between the data protection agent and a snapshot data mover running on the same host, at a host-level, and outside of the virtual machine;
after establishment of the socket communication channel, issuing, from the data protection agent to a copy service, a request to freeze the application, the request to freeze the application thereby triggering a start of a time window within which the copy service allows the application to be frozen;
issuing, from the data protection agent to the snapshot data mover, a request over the socket communication channel to take a snapshot of the application; and
passing the request to take the snapshot to a virtual machine management center connected to the host through the infrastructure network, the virtual machine management center being responsible for management of multiple hosts connected to the virtual machine management center via the infrastructure network, each host hosting one or more virtual machines, wherein the virtual machine management center is maintained as an entity protected from direct communications from the guests in the virtual machine because of an absence of network connectivity resulting from the infrastructure network being separate from the virtual machine guest network.
7 . The system of claim 6 wherein the establishing a socket communication channel further comprises:
receiving, at the snapshot data mover, a connection request from the virtual machine; and
validating the connection request.
8 . The system of claim 6 wherein the socket communication channel is established before issuance of a request to freeze the application for snapshotting.
9 . The system of claim 6 wherein the virtual machine guest network is isolated from the infrastructure network.
10 . The system of claim 6 wherein the virtual machine is blocked from issuing communications to the virtual machine manager.
11 . A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to implement a method comprising:
receiving at a data protection agent a command to conduct an application-consistent backup of an application, the data protection agent and the application being installed as guests in a virtual machine provided by a hypervisor of a host, the virtual machine being connected to a virtual machine guest network and the host being connected to an infrastructure network, separate from the virtual machine guest network;
establishing a socket communication channel between the data protection agent and a snapshot data mover running on the same host, at a host-level, and outside of the virtual machine;
after establishment of the socket communication channel, issuing, from the data protection agent to a copy service, a request to freeze the application, the request to freeze the application thereby triggering a start of a time window within which the copy service allows the application to be frozen;
issuing, from the data protection agent to the snapshot data mover, a request over the socket communication channel to take a snapshot of the application; and
passing the request to take the snapshot to a virtual machine management center connected to the host through the infrastructure network, the virtual machine management center being responsible for management of multiple hosts connected to the virtual machine management center via the infrastructure network, each host hosting one or more virtual machines, wherein the virtual machine management center is maintained as an entity protected from direct communications from the guests in the virtual machine because of an absence of network connectivity resulting from the infrastructure network being separate from the virtual machine guest network.
12 . The computer program product of claim 11 wherein the establishing a socket communication channel further comprises:
receiving, at the snapshot data mover, a connection request from the virtual machine; and
validating the connection request.
13 . The computer program product of claim 11 wherein the socket communication channel is established before issuance of a request to freeze the application for snapshotting.
14 . The computer program product of claim 11 wherein the virtual machine guest network is isolated from the infrastructure network.
15 . The computer program product of claim 11 wherein the virtual machine is blocked from issuing communications to the virtual machine manager.
16 . The method of claim 1 wherein the establishing a socket communication channel comprises:
before issuing the request to the copy service to freeze the application, issuing a connection request for the socket communication channel from the data protection agent to the snapshot data mover; and
authenticating that the connection request is from a valid source.
17 . The method of claim 1 wherein the establishing a socket communication channel comprises:
receiving, at the snapshot data mover, a connection request from the data protection agent;
consulting a listing of valid virtual machines;
validating that the virtual machine is listed in the listing of valid virtual machines; and
upon the validating, allowing the socket communication channel to be established.
18 . The method of claim 1 comprising:
configuring the snapshot data mover with a threshold frequency indicating a number of snapshot requests that the data protection agent is allowed to request within a period of time.
19 . The method of claim 1 comprising:
regulating, by the snapshot data mover, a frequency of snapshot requests that are passed to the virtual machine management center.