"openservice.chart" . }} app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} data: config.ini: | [Common] Mode = product CacheMode "openservice.chart" . }} app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} spec: serviceName: {{ include "openservice.fullname" . }}-headless "openservice.chart" . }} app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} spec: type: {{ .Values.service.type }} ports: - name: openservice

configures off- cluster resources • Operator waits for managed resources to reach a healthy state • Operator conveys readiness of application or managed resources to the user leveraging the status block • Operator reconciles configuration and updates to it with the status of the managed resources Upgrade of the managed workload • Operand can be upgraded in the process of upgrading the Operator, or part of changing the CR • Operator understands how to upgrade older versions of the Operand, managed previously by an older version of the Operator Upgrade of the Operator • Operator can be upgraded

Change a secret regularly in case of compromise Isolation Separate where secrets are used vs managed Encryption at different layers (or turtles) disks file system etcd Recommendation: Use two-layers kube-apiserver etcd SECRET Kubernetes secrets: 1.7 EncryptionConfig ● Encrypt secrets with a locally managed key ● EncryptionConfig for secrets ● Multiple provider options ○ aesgcm ○ aescbc ○ secretbox Kubernetes secrets: 1.10 KMS plugins ● Encrypt secrets with a locally managed key, which is then encrypted with a centrally managed key ● EncryptionConfig uses aescbc with a KMS provider ● Sidecar pod

Fixed price $11B Mobile Our fleet 15 3 US Data Centers POPs 200K+ Managed Vms 4K 100K Managed BMs Applications 4.5PB Managed Storage All of us know that... It’s not easy to manage fleet and infrastructure

parameter - IAM for Pods - New Amazon EKS Regions: Ningxia 研发中 - Amazon EKS on Fargate - Managed Nodes - Managed add-ons - DNS resolution of Amazon EKS private endpoints - New Amazon EKS Regions: Sao Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential Amazon EKS logging EKS managed Customer account Internet Amazon CloudWatch AWS CloudTrail © 2019, Amazon Web Services, Inc.

libvirtd KubeVirt Managed Pods • VMI Foo • VMI Bar KubeVirt Pros & Cons Pros • Kubernetes cluster addon • freedom - not limited by Pod definition Cons • VMs need to be managed separately from kubelet

way to extend managed resource into a current Kubernetes cluster • Auto-generated API in Kubernetes API server • Customized resource controller to implement your business logic of managed resource •

meet this new model on VMware platforms. Agenda 4 What is the VMware SIG Purpose, Projects managed, How to join The Roadmap Moving “Out of Tree” : vSphere cloud provider + storage (CSI) How to

build logs Version Control sync / watch clean history jobs Basic Concepts（partial） Repository Managed Project Pipeline / Stage / Task Dockerfile / Scripts Common Configuration ConfigMap/Secret

Europe Secure records US IT policy Interconnect Connect Peering + VPN Fully and partially-managed offerings extend to non-GCP clouds and on-prem Cluster health, master repair, node repair as