must ensure data scientist are not hindered by structure Why Containers, Kubernetes & Helm? • Container • Contains everything needed to run your application • Build once run anywhere • Starts in seconds:

DB Backup Monitoring Deployment StatefulSet Service CronJob DaemonSet Kubernetes 编排案例 Application Ingress Business Logic A Business Logic A Business Logic A Business Logic A Business Logic A 应用编排架构 基本架构 Kubernetes Cluster Application Registry Application Manager Application A Application … API Gateway API Service A API Service B 应用编排架构 Application Registry - Helm Registry Helm Chart 可选的多种存储后端（FileSystem，OSS，…） 3. 可通过 API 直接对应用进行编排 4. 开源（https://github.com/caicloud/helm-registry） 应用编排架构 Application Manager - Helm Tiller Helm Tiller 1. 负责将 Chart 部署到指定的集群当中，并管理生成的 Release（应用） 2. 支持对 Release

Applications • Scalable Kubernetes Applications • Scalable Infrastructure for Applications Application Operating System Physical Infrastructure Platform Containers as Enabler Fast Boot Environments Rapidly Portable Ability to Move Containers Freely Lightweight Minimal Resources Needed Application Operating System Physical Infrastructure Containers and VMs - A Practical Comparison Containers Containers Containers virtualize the operating system limiting the the number of application dependencies that you need to install on the OS. Virtualization The hypervisor virtualizes the hardware

is organized around the concept of an application. Kubernetes is not a platform as a service (PaaS) and doesn‘t have or enforce a formal notion of an application. Instead, applications are informal and and described with metadata. The definition of what an application contains is loose.” Sited: https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ API 和业务原语 关注点不同 服务语义与抽象程度不同 抽象数据 PaaS 层 UI (e.g. dashboard, cli) 用户 CUE schema/模板 “客户端”抽象 标准化的“服务端”抽象 – 应用模型 Open Application Model (OAM) • 通过 OAM spec 定义“以应用为中心”的原语 • 打破“谷仓”! Common Traits Function Deployment K8s Operator

Dockerfile “script” FROM base container image RUN commands to install dependencies COPY application files over Configure the ENTRYPOINT Run the container Produces some layers Produces some layers ools/jib { "schemaVersion": 2, "mediaType": "application/vnd.docker.distribution.manifest.v2+json" , "config": { "mediaType": "application/vnd.docker.container.image.v1+json" , "digest": 07d6255d46f4f62b3e504948fb86" , "size": 635 }, "layers": [ { "mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip" , "digest": "sha256:eb05f3dbdb543cc6105272486905

televison broadcaster TV2 asked us ● To create an application which works on all devices ● To create an admin interface to run the show ● The application should be able to scale quickly but keep lowest Requests Application architecture Application architecture PHP-based Admin application Shared state in Redis and SQL database Scalable userfacing API in GoLang Queuing system Application technologies Gitlab runner Dockerhub Pod Pod Pod -Build -Test -Push to dockerhub -Deploy Application infrastructure The services around Kubernetes Take control Easy to manage and scale Experience

Deployment Function 应用层 能力管理 用户体验层 Kubernetes Open Application Model（OAM） 一个用来构建云原生应用管理平台的标准规范与核心框架 OAM + OAM Platform UI Open Application Model Platform Kubernetes GitOps/持续集成 标准化定义应用组件 标准化配置应用运维能力 com path: / service_port: 8001 # 2nd component - componentName: redis Open Application Model Platform 部署 应用配置 （Application Configuration） 面向应用维度配置运维能力与组件 apiVersion: core.oam.dev/v1alpha2 kind: TraitDefinition Monitor Service Binding Rollout Ingress interpretability Infra Ops Application Configuration Application Configuration Application Configuration PaaS A PaaS B Serverless C Components Traits Components

Kubernetes storage community since 2015. Chair of Kubernetes VMware SIG. GitHub: @cantbewong Application Platform Architect VMware Supports enterprises with architectural guidance, and works closely Many popular application runtimes (e.g. Java jre) have similar NUMA related issues. 13 How can NUMA issues be avoided? Application can be modified / reconfigured? • The application can be “wrapped” but the combination of the two in a cluster is recommended. This will enable load balancing and application of affinity/anti-affinity rules Deploying HA Hosts in an HA cluster are health monitored and

Ci/CD Application DevOPS Owner Consumes PKS API/CLI Day 1 & Day 2 for k8s clusters Manages access to k8s API for developers IT Operator IaaS Management Internet User Application User 在整個CI/CD管線的各個環節都需要各種控制措施涵蓋 靜態應用安全測試 (白箱測試): Static Application Security Test (SAST) 靜態應用安全測試 : Interactive Application Security Test (IAST) 動態應用安全測試 (黑箱測試): Dynamic Application Security Test (DAST) 軟體元件分析: Software

Many popular application runtimes (e.g. Java jre) have similar NUMA related issues. 13 How can NUMA issues be avoided? Application can be modified / reconfigured? • The application can be “wrapped” but the combination of the two in a cluster is recommended. This will enable load balancing and application of affinity/anti-affinity rules Deploying HA Hosts in an HA cluster are health monitored and