US 11,709,695 B2
Generation, actuation, and enforcement of policies for resources within a distributed computing system
Mathieu Colombet, Palo Alto, CA (US); Daniel Evan Schwartz, Palo Alto, CA (US); Julie A. Pickhardt, Boulder, CO (US); and Prateek Gangwal, San Jose, CA (US)
Assigned to VMware, Inc., Palo Alto, CA (US)
Filed by VMware, Inc., Palo Alto, CA (US)
Filed on Jan. 31, 2020, as Appl. No. 16/779,494.
Prior Publication US 2021/0240507 A1, Aug. 5, 2021
Int. Cl. G06F 9/455 (2018.01); G06F 9/50 (2006.01); G06F 21/33 (2013.01)
CPC G06F 9/45558 (2013.01) [G06F 9/50 (2013.01); G06F 9/5061 (2013.01); G06F 21/335 (2013.01); G06F 2009/45562 (2013.01); G06F 2009/45587 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method for operating a distributed computing system that comprises a set of resources, the method comprising:
at a policy server employing one or more processors and memory:
detecting an update to a policy of a set of policies or another pre-defined triggering event;
in response to the detecting, automatically:
accessing the set of policies, wherein each policy of the set of policies includes one or more fields having values defining the policy;
for each policy of the set of policies, associating a subset of the set of resources with the policy based on a scope of the policy;
generating a priority ordering for a subset of the set of policies based on one or more ordering rules, wherein the scope of each policy in the subset of the set of policies includes a first subset of the set of resources;
merging the subset of the set of policies based on the priority ordering to generate an effective policy, wherein the merging comprises:
selecting a policy of the subset of policies with the highest priority as the effective policy for the subset of resources; and
iteratively adding each policy of the subset of policies in order of priority from highest to lowest to the effective policy, wherein each policy of the subset of policies is checked for incompatibility with the effective policy prior to being added to the effective policy and in response to a determination that a respective policy is incompatible, the respective policy is discarded or the respective policy is changed to make the respective policy compatible with the effective policy prior to adding the respective policy to the effective policy, wherein iteratively adding includes for all policies that are added to the effective policy, merging the respective values of the fields of the respective policy that correspond to the fields of the effective policy; and
enforcing the generated effective policy on the first subset of the set of resources.