ceil(sum(CurrentPodsCPUUtilization) / Target) � ��Kubernetes�HPA�Horizontal Pod Autoscaling���� ����������� CurrentPodsCPUUtilization�����pod�CPU���� Target������CPU����� ��Target ���50%�����CPU��������60%� /0.5�=12������12-10=2 ��� Pod 1 Pod 2 Pod N …� Pod 1 Scale RC/Deployment� 0oah容器金丝雀发布P发布流程 0oah容器金丝雀发布P灰度发布 Service- center client Proxy� service� pod� ���� ��� weight�100� weight�100� weight�100� service� pod� service� pod� Service- center client Proxy� service� �pod� ���� ��� weight�10� weight�100� service� pod� service� pod� weight�100� weight�100� Service- center

ceil(sum(CurrentPodsCPUUtilization) / Target) ! ��Kubernetes�HPA�Horizontal Pod Autoscaling����� ���������� CurrentPodsCPUUtilization�����pod�CPU���� Target������CPU����� ��Target ���50%�����CPU��������60%�� 10�������CurrentPodsCPUUtilization=60%*10=6�� TargetNumOfPods=ceil�6/0.5�=12������12-10=2��� Pod 1! Pod 2! Pod N! … Pod 1! Scale! RC/Deployment 86 Janus���� VGW! NGINX! VGW��! JANUS! APP! VGW! 110 ���Service Mesh��� Proxy! pod ! pod ! ���1 • ���������pod • �������1�osp-proxy • ��pod��1���Docker�� • osp-proxy��daemonset������� ����pod��������proxy��� ����������� Proxy

提供对 Pod 或者具体容器的错误注入, 包括网络、系统 IO、内核以及一些应用层注入 chaos-mesh.org github.com/chaos-mesh Chaos Mesh 是什么 我们的目标 ● 建立一个完全闭环的云原生混沌工程平台 ● 让混沌工程变得更易用 问题与解决方案 集群中的状态 Chaos Mesh 本身的运行和注入的故障会 给各组件以及目标 Pod 带来各种状态。 XXXChaos PodXXXChaos Status Event Target Pods Status Logs Event k8s 不可直接查询的状态 Chaos Mesh 注入的故障给目标 Pod 带来状态不可通过 k8s API 直接查询。 cluster status Target Pods Mounts Processes ipset iptables Pid Command json path 使用样例 状态查询的障碍2 对于不可通过 kubernetes API 直接查询的状态，往往要通过创建 pod/exec 子资源，运行自定义命 令来获取。它存在的主要问题是查询客户端所需权限过高。 pod/exec 使用样例：列出 daemon pod 上正在运行的进程。 状态查询的障碍3 对于所有的状态查询都存在的一大问题是，各级状态之间很难进行关联查询。 人脑关联查询示例：

Analyze Action u 观察当前的Realized State u 当前有2个正常运行的Pod u 比较Desired State跟Realized State的差距 u 期望3个Pod u 实际状态2个Pod u 控制器执行动作协调到Desired State u 创建1个新的Pod Ø Controller观察特定领域的 系统状态 Ø 协调Desired State跟 Kubernetes 下的部署运维 Server Master Pod-0-0 Server Slave Pod-0-1 Server Slave Pod-0-2 Server Group 0 StatefulSet-0 Server Master Pod-1-0 Server Slave Pod-0-1 Server Slave Pod-0-2 Server Group 1 StatefulSet-1 Master Pod-N-0 Server Slave Pod-N-1 Server Slave Pod-N-2 Server Group N StatefulSet-2 Storage Service Cluster Discovery Service Pod-0 Discovery Service Pod-1 Discovery Service Pod-2 Discovery

point of declaration (POD), introduces entity 'i' int j = i; // POD, introduces entity 'j' // point of look-up (POL), names visible entity 'i' int k = l; // POD, introduces entity declared // (relative invisibility) int l; // point of declaration (POD), introduces entity 'l' int m = n; // POD, introduces entity 'm' // POL, names invisible entity 'n' invisibility) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 // translation unit 2 int n; // POD, introduces entity 'n' 1 2 3 STARTING SIMPLE global scope Lookup of entities at global scope

CocoaPods Gradle plugin Update Podfile for Xcode Possible issues and solutions Add dependencies on a Pod library From the CocoaPods repository On a locally stored library From a custom Git repository project with several targets CocoaPods Gradle plugin DSL reference Enable the plugin cocoapods block pod() function Kotlin/Native libraries Kotlin compiler specifics cinterop tool specifics klib utility without being limited by platform–specific dependencies. For example, you can add dependencies on Pod libraries to the iosMain shared source set. Previously, this only worked with platform-specific libraries

互操作性 与 Swift/Objective-C 互操作性 Kotlin/Native 开发 Apple framework——教程 CocoaPods 集成 CocoaPods 概述 添加对 Pod 库的依赖 使用 Kotlin Gradle 项目作为 CocoaPods 依赖项 CocoaPods Gradle 插件 DSL 参考 Kotlin/Native 库 平台库 Kotlin/Native If you use CocoaPods integration, specify the cinterop option in the configuration block of the pod() function like this: kotlin { ios() cocoapods { summary = "CocoaPods test library" homepage = "https://github.com/JetBrains/kotlin" ios.deploymentTarget = "13.5" pod("PodName") { extraOpts = listOf("-compiler-option", "-fmodules") } } }

platform :ios, '8.0' use_frameworks! target 'MyApp' do pod 'AFNetworking', '~> 2.6' pod 'ORStackView', '~> 3.0' pod 'SwiftyJSON', '~> 2.3' end $ pod install CARTHAGE4 4 https://github.com/Carthage/Carthage YourApp.app/Frameworks/YourFramework.framework/ resource.png 发布框架 GITHUB COCOAPODS pod spec create MyFramework Pod::Spec.new do |s| s.name = "MyFramework" s.version = "1.0.2" s.summary git tag 1.0.2 && git push origin --tags # podspec 文法检查 pod spec lint MyFramework.podspec # 提交到 CocoaPods 中心仓库 pod trunk push MyFramework.podspec CARTHAGE SWIFT PM 将源文件放入 Sources

互操作性 与 Swift/Objective-C 互操作性 Kotlin/Native 开发 Apple framework——教程 CocoaPods 集成 CocoaPods 概述 添加对 Pod 库的依赖 使用 Kotlin Gradle 项目作为 CocoaPods 依赖项 CocoaPods Gradle 插件 DSL 参考 Kotlin/Native 库 平台库 Kotlin/Native If you use CocoaPods integration, specify the cinterop option in the configuration block of the pod() function like this: kotlin { ios() cocoapods { summary = "CocoaPods test library" homepage = "https://github.com/JetBrains/kotlin" ios.deploymentTarget = "13.5" pod("PodName") { extraOpts = listOf("-compiler-option", "-fmodules") } } }

-kubernetes-tim-allclair-google Kubernetes has many layers of isolation, but we will focus on pod-to-pod isolation in this talk, AKA Sandbox Isolation. • Container Escape docker.vh.neargle.com:8888/ COW vulnerability −CVE-2019-5736 Docker runc vulnerability −CVE-2019-14271 Docker CP vulnerability Pod Isolation Challenges • Noisy neighbor −Impact performance on CPU, Memory, Bandwidth, Buffer IO, runsc container container Pod QEMU VMM Firecracker VMM Rust-VMM container container Pod Sandbox Agent gVisor Guest Kernel O C I Gofer container container Pod Sandbox Sentry KVM/ptrace