Isolamento de tráfego eficiente para datacenters virtualizados

Abstract

A typical cloud-based datacenter hosts multiple services owned by various tenants in a shared facility. Each service can consist of a collection of one or more virtual machines (VM) placed on one or more physical machines. With the trend of outsourcing the infrastructure, motivated by the wide spread of the utility computing model, thenumber of tenants sharing the computational resources of a single datacenter is also expected to grow. Meanwhile, infrastructure providers are adopting server consolidation techniques to maximize the resource utilization by placing even more VMs on each server. These factors increase the interactions on resource consumption among different tenants. Thus, such shared environments will have a strong need for improved mechanisms to enforce performance isolation for tenants that share datacenter resources.While existing virtualization mechanisms provide good support for allocating CPU and memory resources, only rudimentary support is currently available to manage the use of datacenter network I/O resources. Today's virtualization solutions can enforce resource consumption in the transmit direction, but the reception still depends onservers' cooperation. Therefore, these traffic isolation solutions are vulnerable to selfish tenants, which doesn't cooperate to share the network resources in a fairly manner. The Gatekeeper system is an initiative to solve this problem. The system detects resource consumption violations according to traffic guarantees specified by the datacenter operator and enforces bandwitdh allocations for each VM, for both egress and ingress traffic, on each server. However, the algorithms and the architecture of Gatekeeper have limitations that lead to poor performance isolation in some scenarios. This work proposes a new version of the system, called Gatekeeper-ng, that solves these problems.Keywords: Computer Networks, Distributed Systems, Quality of Service, Virtualization.