github.com/GoogleContainerTools/jib Build containers faster with Jib A container image builder for Java applications Our Team Cloud Tools for Java Appu Goundan @coollog @loosebazooka Qingyang com/GoogleContainerTools/jib What did we do? 1. Write first Dockerfile 2. Reduce image size 3. Don’t run installs 4. Use better base image 5. Write .dockerignore 6. Improve incremental speed 7. Switch to use com/GoogleContainerTools/jib What did we do? 1. Write first Dockerfile 2. Reduce image size 3. Don’t run installs 4. Use better base image 5. Write .dockerignore 6. Improve incremental speed 7. Switch to use

called “Kubelet” • Application Deployment File = Configuration File of desired state • Container Image = Runs in a Pod (~1:1) • Replicas = QTY of Pods that must be running Worker Node Worker Node production grade Kubernetes clusters Fully supported Kubernetes PKS uses the latest stable distribution of Kubernetes—with no proprietary extensions and constant compatible with GKE Built for Day • NSX Container Plugin: NCP is a software component provided by VMware in form of a container image, runs in K8s as a Pod • Kubernetes Adapter: NCP is built in a modular way, so that individual

(Cloud Native Computing Foundation) Kubernetes offering. K3s is a super-lightweight Kubernetes distribution, designed for production workloads in unat- tended, resource constrained, remote envi- ronments presence. K3s was soon identified as the right solu- tion, due to its small footprint, streamlined distribution and relevance to the digital so- lutions team’s particular needs. The rela- tionship with SUSE entire battalions to strategize on-the-fly—all that processing happens as the camera captures the image. It is scanning, detecting and acting on this insight instantly. This is in sharp contrast to earlier

Agent流量占比对比 • 镜像下载引入BT协议 • 对Docker Daemon零入侵 • 每层分别做种 • 优化blob下载策略 发表论文：《FID: A Faster Image Distribution System for Docker Platform》 2017 IEEE 2nd International Workshops on FASW 安全 能力扩展：弹性伸缩 11:46:38 V7版本开时候运行 • 2018-02-09 09:33:02 对该实例做灰度升级，从V7版本升级到V8 版本 • 2018-02-09 09:33:02 开始pull V8版本的image PS：灰度升级属于原地升级，因此不需要重新过调度，升级的效率 也会提升。 每次升级可以选择要升级的实例个数以及具体哪些(个)实例。 能力扩展：存储场景 物理硬盘 cephFS ceph RBD

through tuning of vSphere, and Kubernetes configuration and labeling. This is applicable to any K8s distribution running on the vSphere stack. Agenda 4 ​Kubernetes default scheduling ​How it works ​Utilizing

through tuning of vSphere, and Kubernetes configuration and labeling. This is applicable to any K8s distribution running on the vSphere stack. Agenda 4 Kubernetes default scheduling How it works Utilizing

容器安全模型: 深层防护 • full blown distro (Ubuntu, AL) vs. minimal environment (container- optimized distribution) • multi-tenancy requirements • gotchas: Linux packages/CVEs, leaks, GDPR (in Europe) • runtime/standards

--service-cidr=10.7.0.0/16 \ # service网段，即cluster ip网段 --ignore-preflight-errors=Swap \ #忽略swap未关闭而导致的检查错误 --image-repository="cof- lee.com:5443/k8s" #指定为集群内部的docker镜像源 如果指定使用集群内部的docker镜像仓库，要提前在docker的daemon com:5443/k8s/etcd:3.4.13-0 #可见镜像名已由默认的k8s.gcr.io/换成了配置文件里指定的docker镜像源 # kubeadm config images pull --image-repository="cof-lee.com:5443/k8s" #提前 下载需要的镜像 # kubeadm init --config /etc/kubeadm-init.yaml /etc/containerd/config.toml #修改以下2行配置 SystemdCgroup = true sandbox_image = "cof-lee.com:5443/k8s/pause:3.9" #和k8s需要的pause镜 像版本保持一致 #如果要启用CRI-Plugin，注释掉其中的

2m v1.11.2 每个node都是ready的，说明OK。 验证2：部署⼀个NGINX # 启动⼀个单节点nginx ]# kubectl run nginx --image=nginx:1.7.9 --port=80 # 为“nginx”服务暴露端⼝ ]# kubectl expose deployment nginx --type=NodePort # 查看nginx服务详情 labels: app: nginx spec: 06-理解K8s对象 21 containers: - name: nginx image: nginx:1.7.9 ports: - containerPort: 80 使⽤该 .yaml ⽂件创建Deployment的⼀种⽅法是在 kubectl 要临时设置请求的Namespace，可使⽤ --namespace 标志。 例如： $ kubectl --namespace= run nginx --image=nginx $ kubectl --namespace= get pods 设置Namespace⾸选项 可在上下⽂中永久保存所有后续

environments（sidecar） Share files between containers, or cache build files Container Image - Image of build / dependent environment [] Command - Command to execute [] Args group of user applications Scheduling customization Cluster Resource Auto Scaling kubelet can do image GC DevOps Service DevOps Operator DevOps Operator DevOps Service DevOps Manager CronJob test - use sidecar container as dependent environment • Encapsulate API / SDK of other tools using image for better integration/ collaboration • Leverage k8s integration capabilities, such as external