# Handle Edge Cloud Network with KubeBus Yulin Sun, yulin.sun@huawei.com Seattle Cloud Lab, Huawei R&D USA, Bellevue WA ## Agenda • Edge sample user scenarios • Edge network characteristics • Related [Image](/uploads/documents/0/1/1/e/011e7729ea9b3552e0d5b44619014a60/p3_3.jpg) Edge Area Private Network ## Campus surveillance Campus Surveillance System • Model training • AI execution • AI algorithm/model management • ... Private Network ## Edge network characteristics  ## • Edge Nodes running at private network • Connect to Cloud

# Handle Edge Cloud Network with KubeBus Yulin Sun, yulin.sun@huawei.com Seattle Cloud Lab, Huawei R&D USA, Bellevue WA ## Agenda • Edge sample user scenarios • Edge network characteristics • Related [Image](/uploads/documents/0/1/1/e/011e7729ea9b3552e0d5b44619014a60/p3_3.jpg) Edge Area Private Network ## Campus surveillance Campus Surveillance System • Model training • AI execution • AI algorithm/model management • ... Private Network ## Edge network characteristics  ## • Edge Nodes running at private network • Connect to Cloud

Detection and Network Monitoring by using eBPF Natalia Reka Ivanko, Isovalent eBPF Summit ## I ntroduction ● Wide variety of eBPF use cases (logging, CPU over overhead) • Today: ☐ Network Monitoring [Image](/uploads/documents/c/7/4/d/c74d82edc22d50cbdea681f7475bb901/p2_1.jpg) ## Problem ● Traditional network-layer tools are based on IPs and ports ● K8s workloads are containerized IPs are dynamically changing

period{{(T)Period/(T)Dividend}}; Why is it harder to make a fast-paced online game? ## Network Latency  Transmission [Image](/uploads/documents/8/e/8/b/8e8bf3c37670c50deb25e9aa12f06fc0/p12_2.jpg) Time ## Data sent through the network Positions? Velocity? Server Player Input? Events? Client 1 Local Game State ![Image lock-step For example in Age of Empires. From the article by Paul Bettner: 1500 Archers on a 28.8: Network Programming in Age of Empires and Beyond ![Image](/uploads/documents/8/e/8/b/8e8bf3c37670c50deb

dev@gmail.com ## Outline • Motivation • Overview • Patterns • Lifetime • Exceptions • RAII • Synchronization ## • Conclusions ## Motivation • 40 years of • Experience • Accumulated knowledge ![Ima 0839ae14710dcbb38ddda7e6a7f799/p14_1.jpg) ## Patterns • Lifetime • Exceptions • RAII • Synchronization ## Lifetime ## Lifetime • Lots of worries • Use Structured Concurrency $ ^{[1]} $ • ASAN join async work in classes • Don’t use blockingWait() in a destructor Synchronization # Synchronization Needed? ## Synchronization No shared access? → No int a = 10; co_await reschedule_on_current_executor;

액티비티다이어그램 · 컴포넌트다이어그램 · 배치다이어그램 · 상태다이어그램 • 타이밍다이어그램 다음의 UML 이외의다이어그램도지원함: • JSON Data • Network diagram (nwd) • Wireframe graphical interface • Archimate diagram • Specification and Description nts/3/5/e/3/35e35fdf7b3d14f41d0ae8f418dd59f1/p88_1.jpg) ### 5.6 Synchronization You can use === code === to display synchronization bars. @startuml (*) --> ===B1=== --> "Parallel Action d59f1/p195_1.jpg) [Adapted from QA-13123] ## 12 Network diagram (nwdig) nwdig has been created by Takeshi Komiya and allows to quickly draw network diagrams. So we thank him for his creation! Since

ments/1/5/0/4/150419098dfaf556635346574c520955/p36_1.jpg) ## app ## ↓ Istio RBAC Kubernetes Network Policy ## naiscar ## Lessons learned ## What's next? ## @nais_io @linemoseng @j_hrv

instructions for installing, configuring, and troubleshooting Cilium in different deployment modes. Network Policy : Detailed walkthrough of the policy language structure and the supported formats. Monitoring Guides Installation Observability Network Policy Security Tutorials Advanced Networking Cluster Mesh Operations Istio Concepts Component Overview Terminology Networking Network Security eBPF Datapath Observability pre-flight check (Required) Upgrading Cilium Version Specific Notes Advanced Configuration Core Agent Network Policy Policy Enforcement Modes Rule Basics Layer 3 Examples Layer 4 Examples Layer 7 Examples

OPERATOR 6.11. CLUSTER MACHINE APPROVER OPERATOR 6.12. CLUSTER MONITORING OPERATOR 6.13. CLUSTER NETWORK OPERATOR 6.14. CLUSTER SAMPLES OPERATOR 6.15. CLUSTER STORAGE OPERATOR 6.16. CLUSTER VERSION OPERATOR Container Platform 4.14 Operator 114 1 2 4.5.2. 注入自定义 CA 证书 当集群管理员使用配置映射向集群添加自定义 CA 证书时，Cluster Network Operator 会将用户提供的证 书和系统 CA 证书合并为一个捆绑包（bundle）。您可以将这个合并捆绑包注入 Operator Lifecycle Manager (OLM) 上运行的 证书至集群。 在 OLM 上安装并运行所需的 Operator。 流程 流程 1. 在存在 Operator 订阅的命名空间中创建一个空配置映射，并包括以下标签： 配置映射的名称。 请求 Cluster Network Operator 注入合并的捆绑包。 创建此配置映射后，它会立即使用合并捆绑包的证书内容填充。 2. 更新您的 Subscription 对象，使其包含 spec.config 部分，该部分可将

Kernel Runtime Parameters 3 Configure etcd user and group 4 Ensure that all Namespaces have Network Policies defined 5 Reference Hardened RKE cluster.yml configuration 6 Reference Hardened RKE Namespaces have Network Policies defined Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. Network Policies are namespace scoped. When a network policy