# Handle Edge Cloud Network with KubeBus Yulin Sun, yulin.sun@huawei.com Seattle Cloud Lab, Huawei R&D USA, Bellevue WA ## Agenda • Edge sample user scenarios • Edge network characteristics • Related [Image](/uploads/documents/0/1/1/e/011e7729ea9b3552e0d5b44619014a60/p3_3.jpg) Edge Area Private Network ## Campus surveillance Campus Surveillance System • Model training • AI execution • AI algorithm/model management • ... Private Network ## Edge network characteristics  ## • Edge Nodes running at private network • Connect to Cloud

# Handle Edge Cloud Network with KubeBus Yulin Sun, yulin.sun@huawei.com Seattle Cloud Lab, Huawei R&D USA, Bellevue WA ## Agenda • Edge sample user scenarios • Edge network characteristics • Related [Image](/uploads/documents/0/1/1/e/011e7729ea9b3552e0d5b44619014a60/p3_3.jpg) Edge Area Private Network ## Campus surveillance Campus Surveillance System • Model training • AI execution • AI algorithm/model management • ... Private Network ## Edge network characteristics  ## • Edge Nodes running at private network • Connect to Cloud

Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent eBPF Summit ## I ntroduction ● Wide variety of eBPF use cases (logging, CPU over overhead) • Today: ☐ Network Monitoring [Image](/uploads/documents/c/7/4/d/c74d82edc22d50cbdea681f7475bb901/p2_1.jpg) ## Problem ● Traditional network-layer tools are based on IPs and ports ● K8s workloads are containerized IPs are dynamically changing

Kernel Runtime Parameters 3 Configure etcd user and group 4 Ensure that all Namespaces have Network Policies defined 5 Reference Hardened RKE cluster.yml configuration 6 Reference Hardened RKE Namespaces have Network Policies defined Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. Network Policies are namespace scoped. When a network policy is introduced

Kernel Runtime Parameters 4 Configure etcd user and group 4 Ensure that all Namespaces have Network Policies defined 5 Reference Hardened RKE cluster.yml configuration 7 Reference Hardened RKE private IP to be provided when registering the custom nodes. • When setting the default_pod_security_policy_template_id: to restricted Rancher creates RoleBindings and ClusterRoleBindings on the default service Namespaces have Network Policies defined Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation

RANCHER $ ^{®} $ # Rancher Kubernetes Cryptographic Library FIPS 140-2 Non-Proprietary Security Policy Document Version 1.1 January 4, 2021 Prepared for: ![Image](/uploads/documents/b/8/7/3/b8730 Triple-DES ..... 16 9.2.5 RSA and ECDSA Keys ..... 16 ## 1 Introduction This non-proprietary security policy for the Rancher Kubernetes Cryptographic Library, hereafter referred to as the Module, provides an

ts/1/5/0/4/150419098dfaf556635346574c520955/p36_1.jpg) ## app ## ↓ Istio RBAC Kubernetes Network Policy ## naiscar ## Lessons learned ## What's next? ## @nais_io @linemoseng @j_hrv

installing, configuring, and troubleshooting Cilium in different deployment modes. Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring & Metrics : Instructions Guides Installation Observability Network Policy Security Tutorials Advanced Networking Cluster Mesh Operations Istio Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer 7 Examples Deny Policies

mesh discovery and routing • Expose gateway services via Istio Gateway • Towards RESTRICTED network policy - On-board services to Authentication and Authorization as applicable ## Thank you! Rajath

p[i]; } class Extents, class LayoutPolicy, class AccessorPolicy > class mdspan; ## layout policy ## layout policy maps multidimensional index to a storage location layout(N, M, Q, R, ...) → offset ## standard dimensionality reduction ...but what if our data doesn’t live on the stack or heap? ## accessor policy ## accessor policy retrieves values from storage locations template struct default_accessor access(data_handle_type p, size_t i) const noexcept { return p[i]; } }; ## accessor policy: element_type retrieves values from storage locations matches template struct