in- sight which results in faster decision-mak- ing. Pisano continues: “By putting processing power directly into operational kit, we can connect teams and allow collective con- sciousness in the field have to relay a question via radio and wait for a response from each operative. Having processing power at the tactical edge au- tomates this confirmation not only for the individual soldier but across

構 範 圍 再 次 依 序 領 先 OpenShift 及 Rancher： • Canonical Kubernetes支援x86、ARM、IBM POWER及IBM Z。 • Red Hat OpenShift支援X86、IBM POWER及IBM Z。 • Rancher支援x86及ARM。 7 20.價格 Canonical Kubernetes的價格效能，是這三種發行版本中最出色的，主要原因是能

查询记录 , 便 于用户查看服务状态 ，亦可作为 HPA 的数 据源 • 采集项 name,index,fan.speed,te mperature.gpu,pstate,po wer.draw,power.limit,me mory.used,memory.total, utilization.gpu,ecc.errors. uncorrected.aggregate.to tal

Node failure in HA deployments (Kubernetes) Partial loss of control plane components (Kubernetes) Power cycling the entire control plane (Kubernetes) Permanent loss of control plane (External tool) Disaster

Backedn Workload Ÿ PKS: Manage Kubernetes Lifecycle & Underline Infrastructure Summary Modern Apps Power Digital Transformation Connected Car Telemedicine eCommerce Mobile Banking Digital Transformation

代价 最大化释放云的生产力，实现快速创新。AWS 贯彻全面 Serverless 化战略，提供计算、存储、数据库等全领域的 Serverless 服务。微软 发力低/无代码领域，其发布的 Power Platform 已经与 Office 365、 Dynamics 365 以及 Azure 三大生态充分打通，形成完整的技术生态。 二是更注重软硬协同，优化性能。在算力多样化、节点高密化、载

managed Encryption at different layers (or turtles) disks file system etcd Recommendation: Use two-layers of encryption, e.g., full-disk & application-layer … then tries to decrypt it https://xkcd that it encrypts ● Ensure DEKs are encrypted at rest ● Don’t use the same DEK to encrypt data from two different apps/users ● Generate a new DEK every time you write the data. This means you don't need external secret store Kubernetes secrets: summary ● Use encryption based on your threat model, e.g., two layers, like full-disk + application-layer ● Rotate keys regularly to limit the impact of a potential

Lessons from eBPF What is K8s Service • It exposes a set of pods via VIP using a load balancer • Two types • ClusterIP provides in-cluster access • NodePort provides out-of-cluster access • Major conntrack/iptables SNAT • Pros • O(1) time complexity in control/data plane • Stably runs for two decades • Support rich scheduling algorithm • Cons • Performance cost caused by conntrack • Some

Pod -> container runtime -> Linux OS ​Cgroups are used to map Pod CPU and Memory Resources • Note: Two Cgroups Drivers exist (cgroupfs [default], systemd) 20 Supplement Kubernetes Resource Management hypervisor hosts are required. HA can be deployed independent of DRS, but the combination of the two in a cluster is recommended. This will enable load balancing and application of affinity/anti-affinity

Pod -> container runtime -> Linux OS Cgroups are used to map Pod CPU and Memory Resources • Note: Two Cgroups Drivers exist (cgroupfs [default], systemd) 20 Supplement Kubernetes Resource Management hypervisor hosts are required. HA can be deployed independent of DRS, but the combination of the two in a cluster is recommended. This will enable load balancing and application of affinity/anti-affinity