kubectl already in production; TEE-based secure kubectl completed PoC • API server and the rest changes for the TEE-based - PoC stage • Where we go? • To keep the production practice • To explore more intersections between Cloud-Native and Confidential Computing • To submit KEPs to upstream for related changes Special Thanks We’d like to thank the contributors to this work: Yinyong Zheng, Wei Zhang, Yong

kubernetes and all that stuff • Pachyderm can version datasets and trigger new trainings when changes occur • Distributed File Systems • NFS • HDFS • … Classic DevOps solutions: • Containers • CI/CD

kubectl 功能与kubectl保持一致 3. Multi-cluster management 多集群管理 4. Improved security 提高安全性 Top requested changes 1. Third-party plugins or integrations 集成第三方插件 Which third-party plugins or integrations would

app=MyApp Replicas: 2 Service <10.0.0.11>:<9376> Label: app=MyApp Endpoints: track backend pod changes <172.17.10.1>:<80> <172.17.10.2>:<80> ... Cluster DNS record: pod1.clusterdomain pod2.clusterdomain

users looking to try out Kubernetes or develop with it day-to-day. 7 Out of tree components, what changes for me? In-tree vSphere Cloud Provider vSphere CSI Out-of-tree vSphere Cloud Provider

Prometheus + Grafana + EFK ● Ingest metrics and logs into Stackdriver without any instrumentation changes ● Aggregate logs from many clusters -- whether GKE or GKE On-Prem Logging and Monitoring Cloud

c Controller • The heart of Kubernetes orchestrator • drives the cluster state based on the changes to the API objects for { desired := getDesiredState() current := getCurrentState() makeChanges(desired

keys used for encryption of cardholder data, including the following: 3.6.4 Cryptographic key changes for keys that have reached the end of their cryptoperiod (for example, after a defined period of

JSON • Provides core control loops for platform • Watches shared state through apiserver • Makes changes from current to desired • Policy-based workload scheduler • Topology aware • Assists with availability

used for garbage collection of the controlled object and for // reconciling the owner object on changes to controlled (with a Watch + EnqueueRequestForOwner). // Since only one OwnerReference can be a