Microkernel Overview I. Background  https://en.wikipedia.org/wiki/Microkernel Security I. Background  Difference Between Microkernel and Monolithic Kernel: Source: https://www with usermode VMMs Source: https://sel4.systems/About/seL4-whitepaper.pdf 1.2.1.3 Provable Security I. Background  .  https://docs.sel4.systems/projects/l4v/ https://github Background  https://community.riscv.org/events/details/risc-v-foundation-bay-area-risc-v-group-presents-2021-risc- v-ecosystem-updates/ Source:

#IstioCon Istio Architecture Connect, secure, control, and observe services. #IstioCon Security Architecture #IstioCon Bookinfo architecture without service mesh ● Reviews-v1 ○ doesn’t call accept only plain text ● UNSET: inherit from parent, default to PERMISSIVE if no set apiVersion: "security.istio.io/v1beta1“ kind: "PeerAuthentication“ metadata: name: "demo-peer-policy“ namespace: "default“ gateway Access productpage #IstioCon Authorize ingress traffic with JWT token apiVersion: "security.istio.io/v1beta1“ kind: "RequestAuthentication“ metadata: name: "jwt-example“ namespace: istio-system

};f # WARNING: Don't try this! Things We Have Done 1. Hardware Isolation 2. Security Tools - SELinux, Seccomp, AppArmor, Capabilities, Cgroup 3. Intrusion Detection - Monitor suspicious nginx EOT Rust- VMM Demo Future Works • Extend Rust-VMM to support networking and storage • Security policy integration • Develop a new fully Rust-based runtime for edge computing • Support live migration

analysis Fraud & spam detection DDoS protection Application performance monitoring Logs & metrics Security events and logs. SIEM Analytics of corporate networks Telemetry Industrial monitoring Sensor data

run steady and persistent nodes for this platform? Two Major Problems ➔ End user drives, no security (or token fund) drives. ➔ Network is like a living creature, it will evolve – grow or die. The

need… • a Service Mesh, but to secure it I need… • an automated Certificate Authority, and for more security I need… • a Container scanning and monitoring service, and to monitor it more I need… • a Log Aggregation

O p s / 平 台 运 维 • I T / 基 础 设 施 • 测 试 / 安 全 团 队 持续测试 (Continuous Testing) 持续安全 (Continuous Security) 软件研发核心工程实践：交付工程 CI/CD 开发者实践 软件研发核心工程实践：全流程质量工程实践 - 持续测试 CT/ 持续安全 CS 协 同 特 点 ： • 流 程 可 定 义

неделю. SELECT Referer, count(*) AS count FROM hits WHERE CounterID = 1234 AND Date >= today() - 7 GROUP BY Referer ORDER BY count DESC LIMIT 10 Типичный запрос в системе веб-аналитики Быстро читаем Distributed таблицы CSV 227 Gb, ~1.3 млрд строк SELECT passenger_count, avg(total_amount) FROM trips GROUP BY passenger_count NYC taxi benchmark Шардов 1 3 140 Время, с. 1,224 0,438 0,043 Ускорени е x2 https://t.me/clickhouse_ru › GitHub: https://github.com/yandex/ClickHouse/ › Google group: https://groups.google.com/group/clickhouse Спасибо

倍一倍增加，本选项比较重要 sort_buffer_size 512K 128M 每个线程的排序缓存大小，一般按照内存可 以设置为 2M 以上，推荐是 16M ，该选项对 排序 order by ， group by 起作用 record_buffer 128K 64M 每个进行一个顺序扫描的线程为其扫描的每 张表分配这个大小的一个缓冲区，可以设置 为 2M 以上 table_cache 64 1024 能够快速缩小结果集的 WHERE WHERE 条件写在前面，如果有恒量条件， 条件写在前面，如果有恒量条件， 也尽量放在前面 也尽量放在前面  尽量避免使用 尽量避免使用 GROUP BY GROUP BY 、 、 DISTINCT DISTINCT 、 、 OR OR 、 、 IN IN 等语句的使用 等语句的使用 ， ， 避免使用联表查询和子查询，因为将使执行效率大大下降

(register via slack.cncf.io) Email group ：（ Refer README on GitHub for the subscription way ） harbor-users@googlegroups.com harbor-dev@googlegroups.com WeChat group: Contact speakers HARBOR Thank