ElasticSearch ElasticSearch Prometheus Push Gateway push metric data • Build task can also expose custom metric data • Ephemeral build task can push metric to gateway if needed • Cluster autoscaler and project management tools • Optimize UI generation methodology • Improve development experience, such as CLI, plugin for IDE, dev on Cloud • Move forward to better DevOps under micro-service architecture

com/GoogleContainerTools/jib ... <plugin> com.spotify dockerfile-maven-plugin 1.4.8 io/petclinic-app ${project.version} plugin> ... github.com/GoogleContainerTools/jib What did we do? 1. Write first better base image 5. Write .dockerignore 6. Improve incremental speed 7. Switch to use a Maven plugin github.com/GoogleContainerTools/jib What did we do? 1. Write first Dockerfile 2. Reduce image

Hypervisor VMs Docker Containers User Cases 9 •Ready-to-go development •Self-service portal Developer Sandbox • New application development • 12-factor apps, PCF Cloud Native •Simplify app maintenance vSphere NSX Manager NSX Controllers T1 NSX Edge Cluster Architecture NSX-T • NSX Container Plugin: NCP is a software component provided by VMware in form of a container image, runs in K8s as a standardized interface to the NSX API Network Container Plugin (NCP) NSX Manager Kubernetes Master etcd API-Server Scheduler NSX Container Plugin (NCP) NSX Infra NSX Manager API Client Kubernetes

要求docker<=20.10 k8s 1.24及之后版本： kubelet→cri-containerd→containerd→runC 后来cri-containerd重构进containerd中（CRI Plugin），合为一个containerd进程 默认调用的cri-socket： unix:///var/run/containerd/containerd.sock 本小节讲解k8s v1 sandbox_image = "cof-lee.com:5443/k8s/pause:3.9" #和k8s需要的pause镜 像版本保持一致 #如果要启用CRI-Plugin，注释掉其中的 disabled_plugins = ["cri"] #再重启containerd即可有 unix:///run/containerd/containerd.sock 接口 #信 githubusercontent.com/projectcalico/calico/v3.26.1/manifests/custom- resources.yaml #创建控制器 Install the Tigera Calico operator and custom resource defini�ons # kubectl create -f �gera-operator.yaml

Huawei(Now) - Cloud Native batch system (Volcano) development • IBM spectrum computing - Cluster resource and workload scheduling platform development l Gaps for Spark • Agenda l Why Spark on Kubernetes task-topology to improve the spark workload efficiency. Summary p Queue priority p Queue reclaim p Queue plugin p Hierarchical queue p Dynamic resource allocation p External shuffle service p Resource reservation

forum for hosting related architectural planning and discussion. Associated activities related to development, testing, and documentation are tracked and reported by the SIG as well as architectural planning Container Storage Interface (CSI) is a standard API allowing a storage provider to write just one plugin that will work for all major container orchestration systems: Kubernetes, Mesos, Docker and Cloud

租户管理员创建／分配⼯具资源 容器化持续集成、持续交付 • Jenkins + Kubernetes • Alauda-Jenkins-Plugin/DSL • 流水线模版 • 图形化模块 • 用户打通 • 权限同步 • Jenkins/Pipeline CRDs/Custom Controllers/API Aggregation 数字化转型引领者 助力企业获得持续创新的核心能力

About us Thomas Hector Head of IT Operations Key Qualifications ● 12+ years’ experience with development and operations ● Automating everything ● Been handling Kubernetes clusters in production for for 2 years Jan-Erik Revsbech CTO Key Qualifications ● 20+ year of experience in web-development & operation/hosting ● OpenSource advocate ● Extensive hand-on experience with Kubernetes and Containerization Co About Peytz & Co ● 5 offices ● +100 employees ● OpenSource ● Infrastructure projects ● Custom built IT solutions ● 15 years’ experience Danish TV Show The task Danish televison broadcaster

Installing Kubernetes On-premises/Cloud Providers with Kubespray:https://kubernetes.io/docs/setup/custom- cloud/kubespray/ 03-使⽤Kubespray部署⽣产可⽤的Kubernetes集群（1.11.2） 14 K8s组件 本⽂概述了Kubernetes集群中所需的各种组件。 $GROUP_NAME/$VERSION （例如 apiVersion: batch/v1 ）。 ⽀持的API组的完整列表可详⻅：Kubernetes API reference 。 使⽤ custom resources 扩展API有两个⽀持的路径： 1. CustomResourceDefinition 适⽤于⾮常基本的CRUD需求的⽤户。 2. 即将推出：⽤户需要完整的Kubernetes name>.svc.cluster.local ，这意味着如果容器只使⽤ ，则它将解析为Namespace本地的服务。 这对在 多个Namespace（例如Development、Staging以及Production）中使⽤相同的配置的场景⾮常有⽤。 如果要跨越 Namespace，请使⽤完全限定域名（FQDN）。 译者按：FQDN是fully qualified

EncryptionConfig uses aescbc with a KMS provider ● Sidecar pod for the KMS plugin Master kube-apiserver etcd kms-plugin SECRETDEK DEKKEK KEK Terminology and Notation DEK Data encryption key KEK kube-apiserver etcd kms-plugin SECRET KMS 1.10 Kube-ApiServer Generates a DEK Master kube-apiserver etcd kms-plugin SECRET KMS 1.10 Kube-ApiServer Sends DEK to Plugin Master kube-apiserver kube-apiserver etcd kms-plugin Encrypt(DEK) SECRET KMS 1.10 Plugin Forwards to KMS Master kube-apiserver etcd kms-plugin Encrypt(DEK) SECRET Encrypt(DEK) KMS 1.10 KMS Encrypts a DEK Master kube-apiserver