NL2026759B1

NL2026759B1 - Prioritizing configuration commands for a running configuration on a network device

Info

Publication number: NL2026759B1
Application number: NL2026759A
Authority: NL
Inventors: Gonzalez Prieto Alberto; Bhagaban Patro Rupesh; Hennessy Mark; Sagar Narsian Anish
Original assignee: Microsoft Technology Licensing Llc
Priority date: 2020-10-23
Filing date: 2020-10-23
Publication date: 2022-06-17
Also published as: WO2022087256A1

Abstract

The present disclosure relates to systems, methods, and computer-readable media for generating and implementing a running configuration for a computing device in which configuration commands are prioritized in accordance a plurality of priority buckets. For 5 example, systems disclosed herein include receiVing configuration commands from various configuration sources and comparing metadata of the configuration commands with bucket assignment rules that indicate one or more conditions and associated priority buckets. The systems described herein may group the configuration commands Within the priority buckets and generate a running configuration in accordance with the prioritized configuration 10 commands to resolve command conﬂicts and enable a computing device to operate predictably and in accordance with trusted configuration commands.

Description

PRIORITIZING CONFIGURATION COMMANDS FOR A RUNNING CONFIGURATION ON A NETWORK DEVICE BACKGROUND

[0001] A networked computing system (e.g., a cloud computing system, data center, enterprise network) refers to a collection of computing devices capable of providing various services and resources. As an example, modern computing infrastructures often include a collection of physical server devices organized in a hierarchical structure including computing zones, virtual local area networks (VLANs), racks, fault domains, etc. These computing infrastructures may provide computing resources to users including a variety of processors, memory, and storage devices capable of providing different services to users of the networked computing system. Moreover, devices that make up computing infrastructures may include a wide variety of devices such as computing nodes, storage devices, routers, switches, firewalls, load balancers, storage arrays, and other types of devices.

[0002] Each network device generally includes a configuration that defines rules associated with how the device operates and how data is processed and communicated within a network of devices. For example, a configuration may include rules or commands governing whether a particular device should provide access to various sources and whether information packets should be provided to various destinations. As another example, a configuration may define protocols that a particular device supports. Conventional methods for generating and implementing configurations, however, suffer from a number of problems and drawbacks.

[0003] For example, many configurations are constructed using rules or commands that conflict with one another. In particular, where multiple and sometimes independent entities have configuration capabilities, a computing device (e.g., a network device) may receive conflicting commands to include as part of a running configuration. These conflicting commands may result in a buggy configuration that causes the computing device to operate incorrectly or otherwise inconsistent with respect to one or more desired functions.

[0004] Conventionally, conflicting commands can be resolved using an order-based approach in which a most recently received configuration command overrides or otherwise takes priority over one or more existing (or previously received) configuration commands. While this order-based approach may eliminate conflicts between more recently received commands and previously received commands, this approach still often results in a buggy configuration that causes the computing device to operate incorrectly. Indeed, valid commands from one configuration may be overruled or otherwise overridden by an incorrect or buggy command received from another configuration entity simply because the buggy or incorrect command is received more recently than the previously received valid command(s).

[0005] These and other problems exist in connection with generating and implementing running configurations on network devices (and other computing devices).

BRIEF DESCRIPTION OF THE DRAWINGS

[0006] FIG. 1 illustrates an example environment including an implementation of a configuration management system for generating a running configuration in accordance with priority buckets in accordance with one or more embodiments.

[0007] FIG. 2 illustrates an example workflow illustrating an implementation of the configuration management system grouping configuration commands within priority buckets and implementing a running configuration in accordance with one or more embodiments.

[0008] FIGS. 3A-3C illustrate an example implementation of prioritizing configuration commands and generating a running configuration in accordance with one or more embodiments.

[0009] FIG. 4 illustrates an example series of acts for implementing a configuration management system in accordance with one or more embodiments.

[0010] FIG. 5 illustrates certain components that may be included within a computer system (e.g., a network device).

DETAILED DESCRIPTION

[0011] The present disclosure relates to systems, methods, and computer-readable media for generating and implementing a running configuration for a computing device (e.g., a network device) in which configuration commands are prioritized in accordance with a plurality of priority buckets. In particular, and as will be discussed in further detail below, a configuration management system can receive and place configuration commands within respective priority buckets. The configuration management system may consider a hierarchy of the priority buckets in generating a running configuration to resolve conflicts and/or inconsistencies between configuration commands to ensure that the computing device operates correctly.

[0012] For example, and as will be discussed in further detail below, a configuration management system (e.g., on a network device or other configured computing device) can identify bucket assignment rules for a network device indicating priority buckets and associated command conditions. The configuration management system may then receive a plurality of configuration commands to be included as part of a running configuration for the network device. The configuration management system can compare the received configuration commands with the command conditions from the bucket assignment rules to determine groupings for the configuration commands within the respective priority buckets. The configuration management system may then implement (e.g., generate and execute) a running configuration including a prioritized set of configuration commands based on the determined groupings of the configuration commands within the respective priority buckets.

[0013] The present disclosure includes a number of practical applications that provide benefits and/or solve problems associated with generating and implementing a running configuration on a network device (or other type of computing device(s)). Some examples of these applications and benefits are discussed in further detail below.

[0014] For example, by grouping configuration commands within respective priority buckets, systems described herein can reduce or otherwise prevent conflicts and inconsistencies within running configurations executing on a network device. For instance, where multiple configurators provide different configuration commands for a network device, the configuration management system can compare identifiers of the respective configurators and/or metadata of the configuration commands themselves to intelligently determine a relevant priority bucket for incoming configuration commands. In this way, where multiple configurators provide conflicting commands, the configuration management system can resolve these conflicts prior to generating and implementing the running configuration on the network device. In addition, prioritizing configuration commands in accordance with one or more embodiments described herein facilitates features and functionality of the systems described herein without requiring that an individual manually diagnose and fix every configuration conflict. Moreover, in some cases, manual fixes are not an option at all as certain configurators and platforms will simply re-configure any manual changes and re- introduce various configuration issues.

[0015] In addition to reducing or otherwise eliminating conflicting commands, the configuration management system further enables an administrator (or group of administrators) to provide priority to configurators that are trusted and/or known to be less buggy than other unknown or less trusted configurators. Indeed, by grouping configuration commands based on identifiers of respective configurators within respective priority buckets,

the configuration management system can prevent a scenario where a less trusted configurator overrides a configuration command from a more trusted configurator.

[0016] As will be discussed below, the configuration management system additionally provides a flexible framework for establishing priority rules and priority buckets in conjunction with an existing framework of a variety of network devices (and other configurable computing devices). For example, in one or more embodiments, a plurality of priority buckets includes a substrate bucket and one or more additional priority buckets. The substrate bucket may refer to a base-level priority bucket for the network device. In addition, the substrate bucket may include any configuration commands that would not otherwise be placed within one or more additional priority buckets having a higher priority than the substrate bucket. This augmentation of a substrate bucket may provide additional features and functionality that overcome problems associated with existing configuration systems without interrupting or disrupting normal functionality of the network device(s) and/or underlying device network.

[0017] Moreover, the configuration management system provides a dynamic and flexible approach to updating and/or modifying a set of configuration commands in effect on a network device. For example, in one or more embodiments, the configuration management system can re-generate or otherwise update the running configuration dynamically based on receiving one or more new configuration commands. Indeed, as will be discussed in further detail below, the configuration management system can dynamically update the running configuration based on receiving configuration commands from any of a plurality of configurators. In addition, or as an alternative, the configuration management system can update the priority groupings and/or running configuration based on detected updates to bucket assignment rules.

[0018] As illustrated in the foregoing discussion, the present disclosure utilizes a variety of terms to describe features and advantages of a configuration management system within a variety of computing environments. Additional detail will now be provided regarding the meaning of some of these terms.

[0019] For example, as used herein, a “computing device” or “configurable device” may refer to a variety of computing device types including, for example, a network device or other electronic device implemented within an environment of networked computing devices, such as a cloud computing system (or other hierarchical network of computing devices). Indeed, a computing device may refer to any of a variety of devices that perform various functions on a private or public cloud computing system. By way of example, and not limitation, a computing device may refer to computing nodes, enterprise devices, storage devices, routers, switches, firewalls, load balancers, and storage arrays. Each computing device on the cloud computing system may include a configuration implemented thereon. Each configuration 5 may be unique to each specific device. Moreover, while one or more embodiments described herein relate specifically to generating and implementing a running configuration on a network device, features and functionality described herein may similarly apply to other types of computing devices. Indeed, features and functionality of a configuration management system may be applicable to any configurable computing device capable of performing a variety of functions in accordance with a running configuration implemented thereon.

[0020] As used herein, a “configuration” or “device configuration” may refer generally to any information indicating rules and commands associated with operation of a corresponding network device. As used herein, a “running configuration” may refer to an active or current configuration implemented and otherwise in effect on a network device. In one or more embodiments described herein, a running configuration specifically refers to a hierarchical model of commands (e.g., rules, policies) that make up the configuration and govern how the network device communicates with other devices (e.g., within or outside a cloud computing system) and/or how the network device generally operates. As an example, a configuration may include commands indicating acceptable interfaces or communication protocols that a network device may use when receiving and/or transmitting data packets (e.g., information packets, network packets) to other devices. A configuration may additionally include commands indicating whether the network device is permitted to receive and/or transmit data packets to select locations (e.g., source addresses and/or destination addresses). A configuration may further include policies associated with how data is processed when received and/or prior to being transmitted by the network device. A configuration may include metadata associated with respective commands indicating information about each command such as a user, configurator, or other entity that created or modified a command or a time when a command was created and/or modified. Metadata may also indicate dependencies between a configuration command and other command within the device configuration and any information associated with modifications to a respective command.

[0021] As mentioned above, a configuration may include commands (e.g., rules, policies) that are modeled or accessible in a variety of ways. In one or more embodiments described herein, a configuration includes a hierarchical model of commands organized using a tree structure. For example, a configuration may refer to a data model instantiated using extensible markup language (XML) (e.g., an XML data model instantiation). In this example, portions of the configuration may be referenced using XPaths. The data model may be defined using a variety of data model languages, such as a Yet Another Next Generation (YANG) or JavaScript Object Notation (JSON). As another non-limiting example, the configuration may be defined or referenced using a command-line interface (CLI) based model including a list of commands (e.g., partial commands) organized in a hierarchy of modes. Similar to the data model, the CLI-based model may include a hierarchical structure of modes (e.g., commands, partial commands, sub-commands) that define how the network device operates (e.g., within a cloud computing system). As a further example, a command may be defined or referenced using a network configuration protocol (NETCONF).

[0022] As mentioned above, in one or more embodiments, the configuration commands to be used as part of a running configuration may be grouped according to respective priorities within priority buckets. As used herein, “priority buckets” may refer to any grouping or category of commands as determined based on a set of rules (e.g., bucket assignment rules) that include conditions to consider in grouping commands within respective groupings. In addition, priority buckets may have associated levels of priority relative to one another. In one or more embodiments, a plurality of priority buckets refers to a substrate bucket associated with a base-level of priority in combination with one or more additional priority buckets having a higher priority than the substrate bucket.

[0023] As mentioned above, groupings or associations of configuration commands within respective priority buckets may be determined based on bucket assignment rules that include command conditions associated with respective priority buckets. For example, a “bucket assignment rule” may include a condition that, when present for a configuration command, causes the configuration command to be grouped within or otherwise associated with a corresponding priority bucket. To illustrate, a bucket assignment rule may indicate a specific configuration source (e.g., a configurator identifier) or other metadata (or any command characteristics) that would cause a configuration command to be grouped within an identified priority bucket. As will be discussed below, any type of metadata or condition may be used in grouping respective configuration commands within corresponding priority buckets. Moreover, a network device may consider any number of bucket assignment rules that identify any number of priority buckets.

[0024] As used herein, a “configurator” or “configuration source” may refer to any entity having access to or otherwise capable of providing a configuration command to a network device to be implemented within a device configuration. A configurator may refer to an application or sub-system on either the network device or another computing device. A configurator may refer to a specific user or client device. For instance, a configurator may refer to an administrator, group of administrators, group of devices, group of users, or virtually any source from which a configuration command can originate. In one or more embodiments, a configurator refers to a control plane on a cloud plane or resources managed by the control plane on a cloud computing system. Further examples in connection with one or more embodiments 1s discussed in further detail below.

[0025] Additional detail will now be provided regarding a configuration management system 1n relation to illustrative figures portraying example implementations. For example, FIG. 1 illustrates an example environment 100 including a client device 102 and a cloud computing system 104. The cloud computing system 104 may include any number of network devices 106. In accordance with one or more embodiments described herein, the network devices 106 may include a wide variety of different types of network devices having different capabilities and configurations implemented thereon. Moreover, as mentioned above, while one or more implementations described herein are discussed specifically in connection with a cloud computing system 104, features and functionality described in connection with network devices 106 of a cloud computing system 104 may similarly apply to any configurable computing device within any type of network of devices.

[0026] As shown in FIG. 1, each of the client device(s) 102 and the network devices 106 on the cloud computing system 104 may include one or more configuration application(s) 108a-b implemented thereon. As used herein, a “configuring application” may refer to any application or agent capable of generating and providing configuration commands to be implemented within a running configuration on the network device 106. Thus, in one or more implementations described herein, a configurator or configuration source may refer to one or more configuration applications on the network device or on a remote device (e.g., client device 102) that provides data that makes up a configuration command to be implemented on one or more of the network devices 106. Additional information in connection with example configurators and various types of configuration sources will be discussed below in connection with FIG. 2.

[0027] Each of the client device 102 and network devices 106 of the cloud computing system 104 may communicate with one another via a network 118. The network 118 may include one or multiple networks that use one or more communication platforms or communication technologies for transmitting data. For example, the network 118 may include the internet or other data link that enables transport of electronic device between the client device 102 and network devices 106 of the cloud computing system 104 as well as between respective network devices 106 of the cloud computing system 104.

[0028] As further shown in FIG. 1, a network device may include a configuration management system 110 implemented thereon. It will be appreciated that each network device of the plurality of network devices 106 may similarly include a configuration management system 110 thereon having features and functionality that are unique to each of the respective network devices 106. For example, each of the network devices 106 may have distinct purposes and functions within the cloud computing system 104. Moreover, each of the network devices 106 may have unique configurations including independent sets of configuration commands that dictate how data is received, sent, or otherwise processed on each of the network devices 106. Nevertheless, while the network devices 106 may have different running configurations implemented thereon, features discussed in connection with the illustrated network device having the configuration management system 110 may broadly apply to each of the network devices 106 of the cloud computing system 104. Indeed, consistent with examples discussed above, features and functionality described in connection with the configuration management system 110 on the illustrated network device(s) may similarly apply to any configurable computing device having a configuration (e.g., a running configuration) implemented thereon.

[0029] As shown in FIG. 1, the configuration management system 110 may include a priority bucket manager 112 and a running configuration generator 114. As will be discussed in further detail below, the priority bucket manager 112 and the running configuration generator 114 may cooperatively consider bucket assignment rules and various features (e.g., metadata) of incoming configuration commands in prioritizing configuration commands and implementing a running configuration based on the prioritization of the configuration commands within respective priority buckets.

[0030] For example, the priority bucket manager 112 may identify and consider bucket assignment rules including an indication of one or more conditions and associated priority buckets. In particular, the priority bucket manager 112 may maintain a set of rules that indicate which priority bucket a given configuration command should be grouped within based on whether the given configuration command satisfies the condition(s) indicated within the respective bucket assignment rule. Where the configuration command satisfies the condition(s), the priority bucket manager 112 may group the configuration command within the priority bucket indicated by the bucket assignment rule.

[0031] In considering whether a given configuration command satisfies an indicated condition(s), the priority bucket manager 112 may consider any number of characteristics or metadata associated with the configuration command. For example, as used herein, a “condition” or “command condition” may refer to any characteristic or feature of a command that may be used by the priority bucket manager 112 in determining a corresponding priority bucket. For example, the priority bucket manager 112 may compare metadata or any other information associated with a given configuration command with a set of conditions to determine whether a bucket assignment rule applies to the given configuration command. Indeed, the condition may refer to any feature or combination of multiple features indicated within a bucket assignment rule.

[0032] As an example, a command condition of a bucket assignment rule may refer to a source of the configuration command. For instance, a command condition may indicate source metadata indicating a specific device, type of device, location of device, device model, or specification of a device from which a configuration command originates. If the configuration command originates from a computing device (e.g., client device, network device) of the indicated device type (e.g., matching the indicated source metadata), the priority bucket manager 112 may group the received configuration command within a corresponding priority bucket indicated by the associated bucket assignment rule.

[0033] The command condition may similarly indicate other types of configuration sources. For instance, a command condition may indicate source metadata indicating a specific user or group of users, such as a specific individual, team of individuals, an administrator of the network device, and/or a group including multiple administrative users of the network device. As another example, a command condition may indicate source metadata indicating a specific application, such as one of the configuration applications 108a-b illustrated in FIG. 1. Additional examples of configuration sources will be discussed below in connection with FIG. 2.

[0034] In addition to a configuration source, the command condition(s) may indicate any other features of a received configuration command. For example, the command condition may indicate a specific type of command, such as a configuration command having instructions on how data is received and/or transmitted from the network device, and may even consider the specific target destination indicated by the configuration command. Command conditions may indicate specific interfaces or protocols of the configuration commands, such as a configuration command having a command level interface (CLI), a network configuration protocol (NETCONF), or an XML data model of a particular type.

[0035] In one or more embodiments, bucket assignment rules may identify a combination of multiple command conditions that merit categorization of an associated configuration command within a respective priority bucket. For example, a command condition may indicate that any configuration command originating from an administrative user and having a CLI protocol should be grouped within a corresponding priority bucket. Indeed, any combination of conditions may be considered when categorizing the respective configuration commands.

[0036] As mentioned above, and as shown in FIG. 1, the configuration management system 110 may include a running configuration generator 114. In one or more embodiments, the running configuration generator 114 compiles the configuration rules, resolve configuration conflicts based on the groupings of the commands within the respective priority buckets, and generates a running configuration for the network device. In particular, the running configuration generator 114 prioritizes consideration of the configuration commands based on the priority buckets and generates a running configuration in which potential conflicts have been eliminated based on prioritization of the configuration commands across the respective priority buckets. Additional information in connection with prioritizing the configuration commands and generating the running configuration will be discussed below in connection with FIG. 2.

[0037] As further shown in FIG. 1, the configuration management system 110 includes device configuration data 116. The device configuration data 116 may refer to any information used by any components of the configuration management system 110 to implement features and functionality described herein. For example, the device configuration data 116 may include bucket assignment rule data maintained on the network device. In one or more embodiments, the device configuration data 116 includes conditions and other metadata indicators that may be used by the configuration management system 110 to determine which of a plurality priority buckets to place a corresponding configuration command. The device configuration data 116 may further include information about configuration commands or other instructions to be used in generating a running configuration based on a received set of configuration commands.

[0038] Additional information will now be provided in connection with an example framework of the configuration management system 110 in accordance with one or more embodiments described herein. For example, FIG. 2 illustrates an example workflow 200 including one example implementation in which a running configuration is generated and implemented on a network device 201. In particular, the workflow 200 shows an example in which a plurality of configuration commands are grouped within respective priority buckets and a running configuration is generated in accordance with the prioritized configuration commands within the priority buckets.

[0039] As illustrated in FIG. 2, a plurality of configurators 202a-n may provide a plurality of configuration commands to the configuration management system 110. For example, a first configurator 202a may provide one or more configuration commands to a priority bucket manager 112 on the configuration management system 110 while any number of additional configurators 202b-n provide one or more configuration commands to the priority bucket manager 112. Each of the configurators 202a-n may refer to different software, hardware, or individual entities that may operate independent from one another.

[0040] In one or more embodiments, the plurality of configuration commands are inclusive of all configuration commands of a configuration to be implemented on the network device 201. Alternatively, in one or more embodiments, the configuration commands are provided by the various configurators 202a-n to supplement a current running configuration implemented or otherwise in effect on the network device 201. For example, in one or more embodiments, the configurators 202a-n may refer to applications, devices, or other configuration sources providing additional rules or policies to modify how the network device 201 should operate within a computing environment (e.g., a cloud computing system).

[0041] As noted above, the configurators 202a-n may refer to a variety of devices, applications, individuals, or other source from which the configuration commands originate. For example, one or more of the configurators 202a-n may refer to a specific user or group of users (e.g., administrator(s) of the network device 201). In one or more embodiments, the configurators 202a-n may refer to a specific device, type of device, or location of devices. In one or more embodiments, the configurators 202a-n may refer to a specific system or application on the network device 201 or other device(s). In one or more embodiments, at least one of the configurators 202a-n may refer to a device administrator on the network device 201.

[0042] The configurators 202a-n may refer to different configuration sources associated with different types of configuration commands. As an example, a first configurator may refer to an application, system, or device that provides security-related configuration rules.

As another example, a second configurator may refer to an application, system, or device that provides configuration rules related to data paths. Other configurator(s) may refer to a source of configuration rules related to providing access to the network device 201 to another entity.

[0043] As shown in FIG. 2, the priority bucket manager 112 may receive assignment rules (e.g, bucket assignment rules) that include rules and associated conditions. As discussed above, the assignment rules 204 may include conditions and associated priority levels (e.g., indicated priority buckets) to use in determining which of the received configuration commands should be grouped within respective priority buckets of a plurality of priority buckets 206.

[0044] The assignment rules 204 may be received from a variety of sources. For example, in one or more embodiments, the assignment rules 204 refer to rules that have been programmed on the network device 201 for use 1n prioritizing configuration commands. In one or more embodiments, the assignment rules 204 are more dynamic, and may include any number of updates received from a variety of sources (e.g., device administrator(s), applications) that include additions or modifications to an existing set of assignment rules on the network device 201. In one or more embodiments, the bucket assignment rules can only be changed or modified via a device administrator on the network device 201.

[0045] As shown in FIG. 2, the priority bucket manager 112 can compare features and metadata of the received configuration commands with the data from the assignment rules

204. For example, the priority bucket manager 112 can compare metadata indicating a source or other characteristic (e.g., interface, type of command, etc.) of the configuration command with mformation from the assignment rules 204 to determine whether the configuration command should be sorted within a specific priority bucket. Where the metadata or other characteristic(s) of the configuration command matches an assignment rule, the priority bucket manager 112 can place the configuration command within (or otherwise associate the configuration command with) the indicated priority bucket.

[0046] While a configuration command will typically be found to belong within a specific priority bucket (e.g., a higher priority or the substrate priority), there may be scenarios where multiple conditions are met by a specific configuration command. For example, a first assignment rule may indicate that all commands originating from an administrator should be grouped within a second priority bucket while a second assignment rule may indicate that all CLI commands should be grouped within a first priority bucket. In this example, where a CLI command originates from an administrator, the priority bucket manager 112 may determine placement of the configuration command within either the first or second priority bucket in a variety of ways.

[0047] In one or more embodiments, the priority bucket manager 112 may place the configuration command within the respective bucket based on an order in which the assignment rule is received or evaluated. In one or more embodiments, the priority bucket manager 112 defaults to the lower priority bucket of the two possible priority buckets. Alternatively, the priority bucket manager 112 may default to the higher priority bucket of the possible buckets. In one or more embodiments, the priority bucket manager 112 may default to any of the above examples and flag the configuration command for further review by an administrator at a later time to manually resolve the potential inconsistency. In one or more embodiments, the priority bucket manager 112 may simply maintain a policy specific to the network device 201 on how to resolve configuration commands, which may include instructions to place the configuration command in any of the above ways, or in accordance other specific instructions.

[0048] As shown in FIG. 2, the plurality of priority buckets 206 may include a substrate bucket and any number of additional priority buckets. As used herein, a “substrate bucket” may refer to a priority bucket having a base-level priority relative to one or more additional priority buckets. In one or more implementations, the substrate bucket may refer to a bucket having a base-level priority in which any configuration command that would not otherwise be grouped within an additional priority bucket is grouped within the substrate bucket.

[0049] As indicated above, the priority bucket manager 112 may place any number of configuration commands within groups defined by the plurality of priority buckets based on a comparison of the configuration commands and conditions indicated by the assignment rules

204. Accordingly, where one or more features of the configuration commands match or otherwise satisfy one or more rule conditions, the priority bucket manager 112 may place the configuration commands in corresponding priority buckets having a higher priority than the substrate bucket (e.g., priority buckets 1-N).

[0050] In one or more embodiments, each of the received configuration commands are placed in a priority bucket having a higher priority than the substrate bucket associated with a base-level priority of configuration commands. In one or more embodiments, the priority bucket manager 112 places one or more configuration commands within the substrate bucket. For example, in one or more embodiments, an assignment rule may indicate the substrate bucket as a priority bucket associated with one or more conditions. In addition, or as an alternative, in one or more embodiments, where set of conditions from any of the assignment rules 204 are not satisfied by a given configuration command, the priority bucket manager 112 may place the configuration command within the substrate bucket.

[0051] After grouping or otherwise sorting the configuration commands within respective priority buckets, the priority bucket manager 112 may provide the prioritized configuration commands to a configuration generator 114 for further processing. In particular, the configuration generator 114 can receive the prioritized set of configuration commands and generate a running configuration 208 in which configuration commands have been prioritized in accordance with the groupings of the configuration commands within the plurality of priority buckets.

[0052] The configuration generator 114 may generate the running configuration 208 in a variety of ways. For example, in one or more embodiments, the configuration generator 114 simply runs through the set of configuration commands in an order based on the sorting of the configuration commands within the priority buckets. For instance, the configuration generator 114 may process the configuration commands in order starting with the configuration commands from the substrate bucket to the configuration commands from the highest priority bucket (e.g., priority N bucket). In this way, if there is a configuration command from a higher priority bucket that conflicts with a configuration command from a lower priority bucket (e.g., the substrate bucket), the higher priority configuration command may supersede the lower priority configuration command(s) when generating the running configuration 208.

[0053] As another example, in one or more embodiments, the configuration generator 114 analyzes the received collection of configuration commands within all of the priority buckets. In particular, the configuration generator 114 may iterate through all of the configuration commands and identify any number of the configuration commands that conflict with one another. The configuration generator 114 may then resolve the conflicting commands by prioritizing the higher priority configuration commands over the lower priority configuration commands that conflict with the higher priority commands.

[0054] In each of these approaches, the configuration generator 114 may overcome problems associated with configuration systems in which later-received configuration commands supersede or otherwise overrule previously received configuration commands. Indeed, by prioritizing configuration commands in accordance with assignment rules 204 and prior to generating the running configuration 208, the configuration generator 114 can prevent untrusted applications (or individuals) from modifying or overruling configuration commands from trusted sources received at an earlier time. Moreover, by implementing the assignment rules 1n this fashion, a system administrator or other trusted user may control how incoming configuration commands are processed and prevent one or more configurators from hijacking operation of the network device 201 or otherwise introducing bugs into the system that cause the network device 201 from operating as configured.

[0055] FIGS. 3A-3C illustrate another example implementation of the configuration management system 110 in accordance with one or more embodiments described herein. For example, FIGS. 3A-3C illustrate an example implementation that involves receiving a plurality of configuration commands to be considered in modifying a base configuration, grouping the configuration commands within a plurality of priority buckets, and generating a running configuration based on the prioritization of the configuration commands within the priority buckets.

[0056] In particular, FIG. 3A shows priority bucket manager 112 of a configuration management system 110 that receives a plurality of configuration commands. In accordance with examples discussed above, the configuration commands may be received from a plurality of configurators. Further, the configuration commands may include a variety of commands indicating modifications to current configuration 302a for a network device.

[0057] To illustrate, FIG. 3A shows a current running configuration 302a associated with a set of configuration commands that have been grouped within a substrate bucket 306a. By way of example, the configuration commands within the substrate bucket 306a and as illustrated in the current running configuration 302a include the following commands: add “ip route vrf id:1 route 1.1.1.1 a.a.a.a” add “ip route vrf id: 1 route 2.2.2.2 b.b.b.b” add “ip route vrf ip:2 route 3.3.3.3 c.c.c.c” In accordance with one or more embodiments, each of these configuration commands may be grouped within the substrate bucket 306a based on the commands not having a set of features that satisfy any combination of rule conditions for the higher priority buckets 306b-c. In one or more embodiments, the running configuration 302a may refer to a state of a running configuration on a network device prior to receiving one or more additional configuration commands and/or prior to implementing bucket assignment rules.

[0058] In the illustrated example, the priority bucket manager 112 may receive configuration commands (e.g., additional configuration commands) indicating various additions or modifications to the current configuration 302a. The configuration commands may include different types of modifications including, by way of example, and not limitation, a delete command, a merge (or other type of modification) command, or an add command. For instance, the priority bucket manager 112 may receive a plurality of configuration commands similar to the following: delete “ip route vrf 1p:1 route 1.1.1.1 a.a.a.a.” modify next hop in “ip route vrf ip:1 route 2.2.2.2 b.b.b.b into ff ff" add “ip route vrf 1p:2 route 4.4.4.4 d.d.d.d” Each of these configuration commands will be discussed in further detail below in connection with FIGS. 3B-3C.

[0059] As shown in FIG. 3A, the priority bucket manager 112 may consider a set of categorization rules in determining which of the plurality of priority buckets 304 to use in grouping the received configuration commands. In the example shown in FIG. 3A in connection with the current running configuration 302a, each of a set of configuration rules have been grouped within a substrate bucket of the priority of buckets 304.

[0060] In accordance with one or more embodiments described herein, the substrate bucket is associated with a base-level of priority, and may or may not meet conditions for grouping configuration commands within the first priority bucket 306a. As further shown, the second priority bucket 306b may be associated with a categorization rule including instructions to group any CLI commands therein. The third priority bucket 306c may be associated with one or more administrative users and include instructions to group any configuration command received from an administrative user within the third (e.g., highest) priority bucket.

[0061] Once grouped within the respective priority buckets, the configuration management system 110 may generate or otherwise apply the received configuration commands to a running configuration for the network device. In considering the configuration commands, the configuration management system 110 can identify any conflicting commands within any of the configuration buckets and prioritize those configuration commands from the higher priority buckets over any of the lower priority buckets. In this example, for instance, the configuration management system 110 can prioritize any of the configuration commands grouped within the third priority bucket 306c over any of the configuration commands within the second priority bucket 306b or the first (ie. substrate) priority bucket 300a.

[0062] As shown in FIG. 3B, a first configuration command indicating a command to delete a piece (e.g., a subtree) of the configuration structure beginning with index “1.1.1.1” may be grouped within the third priority bucket 306c based on a determination that the configuration command originated from an administrative user. Similarly, a second configuration command indicating a command to modify a next hop in a piece of the configuration structure beginning with index “2.2.2.2” from “b.b.b.b” to “fff” may be grouped within the third priority bucket 306¢ based on a determination that the configuration command originated from the administrative user. Further, a third configuration command indicating a command to add a piece (e.g., subtree) beginning with index 4.4.4.4 having a next hop value of “d.d.d.d” based on a determination that the configuration command is a CLI command (and was not received from an administrative user). Any additional received configuration commands may be grouped within the first priority bucket 306a.

[0063] As shown in FIG. 3B, a modified running configuration is shown in which the configuration management system 110 identifies portions of the configuration that are to be modified or that have conflicting configuration commands within the priority buckets 304. In this example, the configuration management system 110 may identify a plurality of conflicts 308a-c (e.g., modifications from a base configuration) between the received configuration commands grouped within the second and third priority buckets 306b-c and configuration commands previously included within the substrate bucket 306a.

[0064] For example, the configuration management system 110 may identify a first conflict 308a between a first configuration command (e.g., from the third priority bucket 306c). The configuration management system 110 may additionally identify a second conflict 308b between a second configuration command (e.g., from the third priority bucket 306c). The configuration management system 110 may further identify a third conflict 308c between a third configuration command (e.g., from the second priority bucket 3066).

[0065] While FIG. 3B does not explicitly show an example in which the configuration command(s) from the second priority bucket 306b conflict with any of the configuration command(s) from the third priority bucket 306c, in a scenario where one or more configuration commands from a higher priority bucket conflict with a lower priority bucket, the configuration management system 110 may prioritize the commands in a variety of ways. In one or more embodiments, the configuration management system 110 may discard the lower priority command in favor of the higher priority command. In one or more implementations, the configuration management system 110 may partially implement the lower priority configuration command insofar as implementing the portion of the configuration command does not cause a particular portion of the device configuration to conflict with another portion of the configuration command. In one or more embodiments, the configuration management system 110 may simply consider the configuration commands mm reverse order of priority to ensure that the higher priority configuration commands are considered later in order and causing conflicting commands to be superseded by the higher priority commands.

[0066] As shown in FIG. 3C, the configuration management system 110 can generate a running configuration in accordance with the prioritized configuration commands. For instance, as shown in the updated running configuration 302c shown in FIG. 3C, the configuration management system 110 may remove the associated piece from the configuration beginning with index “1.1.1.1,” modify the piece of the configuration beginning with “2.2.2.2” and add a new piece (e.g., subtree) beginning with index “4.4.4.4.” Once updated, the configuration management system 110 can cause this updated configuration 302c to be executed on the network device.

[0067] In one or more embodiments, the configuration management system 110 may continue to receive additional configuration commands from one or more configurators. In this example, the configuration management system 110 may simply regroup the received configuration command(s) within a corresponding priority bucket (e.g., from the existing set of priority buckets 304). Where the received configuration command would result in a modification to the running configuration, the configuration management system 110 may again update the configuration based on the received configuration commands in accordance with the grouping of the received configuration commands within the respective priority buckets.

[0068] In addition to updating or otherwise modifying the running configuration in response to receiving additional configuration commands, the configuration management system 110 can additionally update the running configuration based on updated bucket assignment rules. For example, in response to receiving a new bucket assignment rule,

removing an existing bucket assignment rule, and/or modifying an associated priority and/or condition of an existing bucket assignment rule, the configuration management system 110 may similarly reprocess any number of received configuration commands to generate updated groupings within priority buckets and re-generate or update the running configuration for the network device. The configuration management system 110 may then redeploy or otherwise execute the updated running configuration dynamically as further changes to the bucket rules and/or configuration are detected.

[0069] Turning now to FIG. 4, this figure illustrates an example flowchart including a series of acts for prioritizing configuration commands and generating a running configuration mn accordance with the prioritized configuration commands. While FIG. 4 illustrates acts according to one or more embodiments, alternative embodiments may omit, add to, reorder, and/or modify any of the acts shown in FIG. 4. The acts of FIG. 4 can be performed as part of a method. Alternatively, a non-transitory computer-readable medium can comprise structions that, when executed by one or more processors, cause a computing device (e.g., input device, gaming console, client device) to perform the acts of FIG. 4. In still further embodiments, a system can perform the acts of FIG. 4.

[0070] In particular, FIG. 4 shows a series of acts 400 for prioritizing configuration commands and generating a running configuration based on the prioritized set of configuration commands. As shown in FIG. 4, the series of acts 400 includes an act 410 of identifying, for a computing device, bucket assignment rules indicating priority buckets and associated command conditions. For example, in one or more implementations, the act 410 mvolves identifying one or more bucket assignment rules for a computing device where the one or more bucket assignment rules indicate a plurality of priority buckets and associated command conditions.

[0071] In one or more embodiments, the command conditions of the one or more bucket assignment rules indicate one or more priority buckets associated with metadata indicating one or more configuration sources where a given configuration source is associated with an entity that provides the configuration command to be included as part of the running configuration for the computing device. In one or more embodiments, the configuration sources include one or more of an identifier of a configuring application, an identifier of a user (e.g., an administrative user), an identifier of a group of users (e.g., a group of admins), or an identification of a configuring device.

[0072] In one or more embodiments, the associated command conditions of the one or more bucket assignment rules indicate one or more priority buckets associated with one or more configuration interfaces. In one or more implementations, the configuration interfaces may refer to one or more of a command level interface (CLI) or a network configuration protocol (NETCONF).

[0073] As further shown in FIG. 4, the series of acts 400 includes an act 420 of receiving configuration commands to be included as part of a running configuration for the computing device. For example, in one or more embodiments, the act 420 involves receiving a plurality of configuration commands to be included as part of a running configuration for the computing device.,

[0074] As further shown in FIG. 4, the series of acts 400 includes an act 430 of grouping the configuration commands within respective priority buckets based on a comparison of the configuration commands and the associated command conditions. For example, in one or more embodiments, the act 430 involves grouping the plurality of configuration commands within respective priority buckets from the plurality of priority buckets based on a comparison of the plurality of configuration commands and the associated command conditions from the one or more bucket assignment rules.

[0075] In one or more embodiments, the plurality of priority buckets includes a substrate bucket associated with a base-level priority and one or more additional priority buckets associated with a higher priority than the substrate bucket. In one or more embodiments, any configuration command not associated with the one or more additional priority buckets is grouped within the substrate bucket.

[0076] In one or more embodiments, grouping the plurality of configuration commands includes determining that a configuration command from the plurality of configuration commands meets both a first command condition associated with a first priority bucket and a second command condition associated with a second priority bucket. Grouping the configuration commands may further include placing the configuration command within the first priority bucket or the second priority bucket based on a policy of the computing device established by a device administrator.

[0077] As further shown in FIG. 4, the series of acts 400 includes an act 440 of implementing the running configuration having a prioritized set of configuration commands based on groupings of the configuration commands within the priority buckets. For example, in one or more embodiments, the act 440 involves implementing the running configuration for the computing device where the running configuration includes a prioritized set of configuration commands from the plurality of configuration commands in which one or more configuration commands are prioritized over one or more conflicting configuration commands based on groupings of the plurality of configuration commands within the respective priority buckets.

[0078] In one or more embodiments, the series of acts 400 includes receiving an additional configuration command. In response to receiving the additional configuration command, the series of acts 400 may include updating the groupings of the plurality of configuration commands to include the additional configuration command. The series of acts 400 may further include updating the running configuration based on the updated groupings of the plurality of configuration commands.

[0079] In one or more embodiments, implementing the running configuration includes generating the running configuration and executing the running configuration on the computing device in accordance with the prioritized set of configuration commands. Further, in one or more embodiments, the computing device includes one or more of a router, a switch, a firewall, or a load balancer on a cloud computing system. Further, in one or more implementations, the computing device is configured to communicate information packets between computing nodes on the cloud computing system (e.g., in accordance with the running configuration implemented thereon).

[0080] FIG. 5 illustrates certain components that may be included within a computer system 500. One or more computer systems 500 may be used to implement the various devices, components, and systems described herein.

[0081] The computer system 500 includes a processor 501. The processor 501 may be a general-purpose single or multi-chip microprocessor (e.g., an Advanced RISC (Reduced Instruction Set Computer) Machine (ARM)), a special purpose microprocessor (e.g., a digital signal processor (DSP)), a microcontroller, a programmable gate array, etc. The processor 501 may be referred to as a central processing unit (CPU). Although just a single processor 501 is shown in the computer system 500 of FIG. 5, in an alternative configuration, a combination of processors (e.g., an ARM and DSP) could be used.

[0082] The computer system 500 also includes memory 503 in electronic communication with the processor 501. The memory 503 may be any electronic component capable of storing electronic information. For example, the memory 503 may be embodied as random access memory (RAM), read-only memory (ROM), magnetic disk storage media, optical storage media, flash memory devices in RAM, on-board memory included with the processor, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) memory, registers, and so forth, including combinations thereof.

[0083] Instructions 505 and data 507 may be stored in the memory 503. The instructions 505 may be executable by the processor 501 to implement some or all of the functionality disclosed herein. Executing the instructions 505 may involve the use of the data 507 that is stored in the memory 503. Any of the various examples of modules and components described herein may be implemented, partially or wholly, as instructions 505 stored in memory 503 and executed by the processor 501. Any of the various examples of data described herein may be among the data 507 that is stored in memory 503 and used during execution of the instructions 505 by the processor 501.

[0084] A computer system 500 may also include one or more communication interfaces 509 for communicating with other electronic devices. The communication interface(s) 509 may be based on wired communication technology, wireless communication technology, or both. Some examples of communication interfaces 509 include a Universal Serial Bus (USB), an Ethernet adapter, a wireless adapter that operates in accordance with an Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless communication protocol, a Bluetooth® wireless communication adapter, and an infrared (IR) communication port.

[0085] A computer system 500 may also include one or more input devices 511 and one or more output devices 513. Some examples of input devices 511 include a keyboard, mouse, microphone, remote control device, button, joystick, trackball, touchpad, and light pen (or light-sensitive wand). Some examples of output devices 513 include a speaker and a printer. One specific type of output device that is typically included in a computer system 500 is a display device 515. Display devices 515 used with embodiments disclosed herein may utilize any suitable image projection technology, such as liquid crystal display (LCD), light-emitting diode (LED), gas plasma, electroluminescence, or the like. A display controller 517 may also be provided, for converting data 507 stored in the memory 503 into text, graphics, and/or moving images (as appropriate) shown on the display device 515.

[0086] The various components of the computer system 500 may be coupled together by one or more buses, which may include a power bus, a control signal bus, a status signal bus, a data bus, etc. For the sake of clarity, the various buses are illustrated in FIG. 5 as a bus system 519.

[0087] The techniques described herein may be implemented in hardware, software, firmware, or any combination thereof, unless specifically described as being implemented in a specific manner. Any features described as modules, components, or the like may also be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques may be realized at least in part by a non-transitory processor-readable storage medium comprising instructions that, when executed by at least one processor, perform one or more of the methods described herein. The structions may be organized into routines, programs, objects, components, data structures, etc., which may perform particular tasks and/or implement particular data types, and which may be combined or distributed as desired in various embodiments.

[0088] Computer-readable media can be any available media that can be accessed by a general purpose or special purpose computer system. Computer-readable media that store computer-executable instructions are non-transitory computer-readable storage media (devices). Computer-readable media that carry computer-executable instructions are transmission media. Thus, by way of example, and not limitation, embodiments of the disclosure can comprise at least two distinctly different kinds of computer-readable media: non-transitory computer-readable storage media (devices) and transmission media.

[0089] As used herein, non-transitory computer-readable storage media (devices) may include RAM, ROM, EEPROM, CD-ROM, solid state drives (“SSDs”) (e.g., based on RAM), Flash memory, phase-change memory (“PCM”), other types of memory, other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store desired program code means in the form of computer-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer.

[0090] The steps and/or actions of the methods described herein may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps or actions 1s required for proper operation of the method that is being described, the order and/or use of specific steps and/or actions may be modified without departing from the scope of the claims.

[0091] The term “determining” encompasses a wide variety of actions and, therefore, “determining” can include calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, a database or another data structure), ascertaining and the like. Also, “determining” can include receiving (e.g., receiving information), accessing

(e.g., accessing data in a memory) and the like. Also, “determining” can include resolving, selecting, choosing, establishing and the like.

[0092] The terms “comprising,” “including,” and “having” are intended to be inclusive and mean that there may be additional elements other than the listed elements. Additionally, it should be understood that references to “one embodiment” or “an embodiment” of the present disclosure are not intended to be interpreted as excluding the existence of additional embodiments that also incorporate the recited features. For example, any element or feature described in relation to an embodiment herein may be combinable with any element or feature of any other embodiment described herein, where compatible.

[0093] The present disclosure may be embodied in other specific forms without departing from its spirit or characteristics. The described embodiments are to be considered as illustrative and not restrictive. The scope of the disclosure 1s, therefore, indicated by the appended claims rather than by the foregoing description. Changes that come within the meaning and range of equivalency of the claims are to be embraced within their scope.

Claims

CONCLUSIONS

A method comprising: identifying one or more bucket assignment rules for a computing device, the one or more bucket assignment rules specifying multiple priority buckets and associated command conditions; receiving multiple configuration commands to be included as part of a running configuration for the computing device; grouping the plurality of configuration commands within respective priority buckets from the plurality of priority buckets based on a comparison of the plurality of configuration commands and the associated command conditions from the one or more bucket assignment rules; and implementing the current configuration for the computing device, the current configuration comprising a prioritized set of configuration commands from the plurality of configuration commands wherein one or more configuration commands are prioritized over one or more conflicting configuration commands based on groupings of the multiple configuration commands within the respective priority buckets.

The method of claim 1, wherein the associated command conditions of the one or more bucket assignment rules indicate one or more priority buckets associated with metadata indicating one or more configuration resources, wherein a given configuration resource belongs to an entity, which provides the configuration command to be included as part of the current configuration for the computing device.

The method of claim 2, wherein the one or more configuration resources comprise one or more of: a configuring application identifier; an identifier of a user;

an identifier of a group of users; or an identifier of a configuring device.

The method of any one of claims 1 to 3, wherein the associated command conditions of the one or more bucket assignment rules indicate one or more priority buckets associated with one or more configuration links, wherein the one or more configuration links includes one or more of : a command level interface (CLI, Command Level Interface) or a network configuration protocol (NETCONF).

The method of any one of claims 1-4, wherein the plurality of priority buckets comprise a substrate bucket associated with a base-level priority and one or more additional priority buckets associated with a higher priority than the substrate bucket. .

The method of claim 5, wherein each configuration command that does not belong to the one or more additional priority buckets is grouped within the substrate bucket.

The method of any one of claims 1-6, further comprising: receiving an additional configuration command; in response to receiving the additional configuration command, updating the groupings of the plurality of configuration commands to include the additional configuration command; and updating the current configuration based on the updated groupings of the plurality of configuration commands.

The method of any one of claims 1 to 7, wherein grouping the plurality of configuration commands comprises: determining that a configuration command from the plurality of configuration commands applies to both a first command condition associated with a first priority bucket and a second command for - value, which belongs to a second priority bucket, is satisfactory; and placing the configuration command within the first priority bucket or the second priority bucket based on a policy of the computing device established by a device manager.

The method of any one of claims 1-8, wherein implementing the running configuration comprises generating the running configuration and executing the running configuration on the computing device in accordance with the prioritized set of configuration commands.

The method of any one of claims 1-8, wherein the computing device comprises one or more of a router, a switch, a firewall or a load balancing unit on a cloud computing system, the computing device configured to transfer information packets between computing nodes on the cloud computing system. to communicate.

11. A system comprising: one or more processing units; memory in electronic communication with the one or more processing units; instructions stored in memory, the instructions executable by the one or more processing units to: identify one or more bucket assignment rules for a computing device, the one or more bucket assignment rules specifying multiple priority buckets and associated command conditions; receiving multiple configuration commands to be included as part of a running configuration for the computing device; grouping the plurality of configuration commands within respective priority buckets from the plurality of priority buckets based on a comparison of the plurality of configuration commands and the associated command conditions from the one or more bucket assignment rules; and implementing the current configuration for the computing device, the current configuration comprising a prioritized set of configuration commands from the plurality of configuration commands wherein one or more configuration commands are prioritized over one or more conflicting configuration commands based on groupings of the multiple configuration commands within the respective priority buckets.

The system of claim 11, wherein the associated command conditions of the one or more bucket assignment rules include one or more priority buckets associated with metadata, wherein the one or more configuration resources indicate one or more of: an identifier of a configuring application; an identifier of a user; an identifier of a group of users; or an identifier of a configuring device.

The system of any of claims 11-12, wherein the plurality of priority buckets include a substrate bucket associated with a base-level priority and one or more additional priority buckets associated with a higher priority than the substrate bucket, and wherein any configuration command that does not belong to the one or more additional priority buckets is grouped within the substrate bucket.

The system of any of claims 11-13, wherein implementing the running configuration comprises generating the running configuration and executing the running configuration on the computing device in accordance with the prioritized set of configuration commands; and wherein the computing device comprises one or more of a router, a switch, a firewall or a load balancer on a cloud computing system, the computing device configured to communicate packets of information between computing nodes on the cloud computing system.

A computer program which, when executed on a process of a computing system, is configured to perform the method of any one of claims 1-10.