Multi-tenant resource management in a gateway

Abstract

Described herein are systems, methods, and software to manage resources in a gateway shared by multiple tenants. In one example, a system may monitor usage of resources by a tenant of the gateway and compare the usage with usage limits associated with the resources. The system may further determine when the usage of a resource exceeds a usage limit associated with the resource and, when the usage of the resource exceeds the usage limit, identify an operation associated with causing the usage limit to be exceeded and blocking the operation.

What is claimed is: 
     
         1 . A method comprising:
 monitoring usage of one or more resources of a gateway by a tenant of a plurality of tenants associated with the gateway, wherein the one or more resources comprise processing resources of the gateway or memory resource uses of the gateway, and wherein the tenant comprises a plurality of computing nodes communicatively coupled to the gateway;   comparing the usage of the one or more resources with one or more usage limits associated with the one or more resources for the tenant;   determining when the usage of a resource in the one or more resources exceeds at least one usage limit of the one or more usage limits; and   when the usage of the resource exceeds the at least one usage limit;
 identifying an operation associated with causing the at least one usage limit to be exceeded; and 
 blocking the operation. 
   
     
     
         2 . The method of  claim 1 , wherein the one or more resources further comprise firewall sessions, network address translation entries, routing table entries, or internet protocol security (IPsec) sessions. 
     
     
         3 . The method of  claim 1 , wherein identifying the operation associated with causing the at least one usage limit to be exceeded comprises:
 identifying a most recent operation that increased the usage of the at least one resource; and   identifying the most recent operation as the operation.   
     
     
         4 . The method of  claim 1 , wherein the operation comprises a communication request. 
     
     
         5 . The method of  claim 1 , wherein the one or more usage limits comprise a ratio of total memory or processing resources available at the gateway. 
     
     
         6 . The method of  claim 1  further comprising maintaining one or more data structures that store the one or more usage limits for the tenant with one or more additional usage limits associated with a second tenant of the plurality of tenants. 
     
     
         7 . The method of  claim 1 , wherein wherein identifying the operation associated with causing the at least one usage limit to be exceeded comprises:
 identifying operations associated with contributing to the usage of the resource;   identifying qualities of service associated with the operations; and   selecting the operation from the operations based on the qualities of service.   
     
     
         8 . The method of  claim 1  further comprising:
 identifying trends in the usage of the one or more resources; and 
 updating the one or more usage limits based on the trends. 
 
     
     
         9 . The method of  claim 1  further comprising:
 identifying trends in the usage of the one or more resources; 
 determining suggested updates to the one or more usage limits based on the trends; and 
 generating a notification that indicates the suggested updates to the one or more usage limits. 
 
     
     
         10 . A computing apparatus comprising:
 one or more non-transitory computer readable storage media;   a processing system operatively couled to the one or more non-transitory computer readable storage media; and   program instructions stored on the one or more non-transitory computer readable storage media that, when executed by the processing system, direct the computing apparatus to:
 monitor usage of one or more resources of a gateway by a tenant of a plurality of tenants associated with the gateway, wherein the one or more resources comprise processing resources of the gateway or memory resource uses of the gateway, and wherein the tenant comprises a plurality of computing nodes communicatively coupled to the gateway; 
 compare the usage of the one or more resources with one or more usage limits associated with the one or more resources for the tenant; 
 determine when the usage of a resource in the one or more resources exceeds at least one usage limit of the one or more usage limits; and 
 when the usage of the resource exceeds the at least one usage limit;
 identify an operation associated with causing the at least one usage limit to be exceeded; and 
 block the operation. 
 
   
     
     
         11 . The computing apparatus of  claim 10 , wherein the one or more resources further comprise firewall sessions, network address translation entries, routing table entries, or internet protocol security (IPsec) sessions. 
     
     
         12 . The computing apparatus of  claim 10 , wherein identifying the operation associated with causing the at least one usage limit to be exceeded comprises:
 identifying a most recent operation that increased the usage of the at least one resource; and   identifying the most recent operation as the operation.   
     
     
         13 . The computing apparatus of  claim 10 , wherein the operation comprises a communication request. 
     
     
         14 . The computing apparatus of  claim 10 , wherein the one or more usage limits comprise a ratio of total memory or processing resources available at the gateway. 
     
     
         15 . The computing apparatus of  claim 10 , wherein the program instructions further direct the computing apparatus to maintain one or more data structures that store the one or more usage limits for the tenant with one or more additional usage limits associated with a second tenant of the plurality of tenants. 
     
     
         16 . The computing apparatus of  claim 10 , wherein wherein identifying the operation associated with causing the at least one usage limit to be exceeded comprises:
 identifying operations associated with contributing to the usage of the resource;   identifying qualities of service associated with the operations; and   selecting the operation from the operations based on the qualities of service.   
     
     
         17 . The computing apparatus of  claim 10 , wherein the program instructions further direct the computing apparatus to:
 identify trends in the usage of the one or more resources; and   update the one or more usage limits based on the trends.   
     
     
         18 . The computing apparatus of  claim 10 , wherein the program instructions further direct the computing apparatus to:
 identify trends in the usage of the one or more resources;   determine suggested updates to the one or more usage limits based on the trends; and   generate a notification that indicates the suggested updates to the one or more usage limits.   
     
     
         19 . An apparatus comprising:
 one or more non-transitory computer readable storage media; and   program instructions stored on the one or more non-transitory computer readable storage media that, when executed by a processing system, direct the processing system to:
 monitor usage of one or more resources of a gateway by a tenant of a plurality of tenants associated with the gateway, wherein the one or more resources comprise processing resources of the gateway or memory resource uses of the gateway, and wherein the tenant comprises a plurality of computing nodes communicatively coupled to the gateway; 
 compare the usage of the one or more resources with one or more usage limits associated with the one or more resources for the tenant; 
 determine when the usage of a resource in the one or more resources exceeds at least one usage limit of the one or more usage limits; and 
 when the usage of the resource exceeds the at least one usage limit;
 identify an operation associated with causing the at least one usage limit to be exceeded; and 
 block the operation. 
 
   
     
     
         20 . The apparatus of  claim 19 , wherein the plurality of computing nodes comprise a plurality of virtual machines or containers.