GPU Resource Management On JDOS 梁永清 liangyongqing1@jd.com 提供的服务 1. 用于实验的 GPU 容器 2.基于 Kubeflow 的机器学习训练服务 3.模型管理和模型 Serving 服务 Experiment Training Serving 均基于容器，不对业务方直接提供 GPU 物理机 GPU 实验 JDOS 常规的容器服务

Secrets Management at Scale with Vault & Rancher 24. June Robert de Bock Senior DevOps Engineer Adfinis robert.debock@adfinis.com Kapil Arora Senior Solution Engineer HashiCorp kapil@hashicorp.com Kubernetes architecture ● Controlplane: Manages the cluster and exposes an API for control ● Etcd: a key value store used as Kubernetes’ backing store for all cluster data. ● Worker: Runs workloads and Infrastructure Management (Run & Manage) GitOps Continuous Delivery Cluster Templates & Config Enforcement K8s Version Management Node Pool Management Cluster Provisioning & Lifecycle Management Platform

Node Operator: Kubernetes Node Management Made Simple 陈俊(Joe), Ant Financial Agenda • Background and Motivation • Introduction of Operators • Node-Operator • Advanced Topic: • Upgrade Master & Node Components reliably • Canary Rollout • Master & Node Component Versions Management Motivation: Work Order Deployment Worker Order • Upgrade Nodes Versions • Upgrade Node 10.10 Complicated architecture Work order deployment system can not meet the requirements of resource management. Operator Observe Action Analyze • Observe: watch desired resource and actual resource

Processing and Analytics Vasiliki (Vasia) Kalavri
 vkalavri@bu.edu Spring 2020 2/25: State Management Vasiliki Kalavri | Boston University 2020 Logic State <#Brexit, 520> <#WorldCup, 480> Keyed state is scoped to a key defined in the operator’s input records • Flink maintains one state instance per key value and partitions all records with the same key to the operator task that maintains maintains the state for this key • State access is automatically scoped to the key of the current record so that all records with the same key access the same state State management in Apache Flink 5 Vasiliki

Platform 版本的合作伙伴使用，用于未来的 OpenShift Container Platform 版本的硬件设备的预构建 driver-containers。 Kernel Module Management (KMM) 也使用 Driver Toolkit，它目前作为 OperatorHub 上的社区 Operator 提供。KMM 支持树外和第三方内核驱动程序以及底层操作系统的支持软件。用户可以为 Updater 上的 mutual TLS 身份验证的三个标记之一，其他两个是 -cert-file 和 '-key-file'。此标志指定用于验证 nfd-master 真实性的 TLS root 证书。 默认： 空 重要 -ca-file 标志必须与 -cert-file 和 -key-file 标志一起指定。 Example -cert-file -cert-file 标志是在 NFD Topology Updater 上控制 mutual TLS 身份验证的三个标记之一，其他两个与 - ca-file 和 -key-file flags。此标志指定为身份验证传出请求的 TLS 证书。 默认： 空 重要 -cert-file 标志必须与 -ca-file 和 -key-file 标志一起指定。 Example -h, -help 打印使用方法并退出. available:

Users, groups, roles, and passwords 4.14.3. Passwords encryption 4.14.4. Managing authentication by key 4.14.5. RBAC 4.14.6. SecurityMBean 4.14.7. Security providers 4.15. Docker 4.15.1. Docker images Persistence (JPA) 4.17.8. EJB 4.17.9. CDI 4.17.10. HA/failover and cluster 4.18. Monitoring and Management using JMX 4.18.1. Connecting 4.18.2. Configuration 4.18.3. MBeans 4.18.4. RBAC 4.18.5. JMX-HTTP reflection) 5.2.8. Examples 5.3. Programmatically connect 5.3.1. To the console 5.3.2. To the management layer 5.4. Branding 5.4.1. Console 5.4.2. Adding a branding.properties file to etc 5.5. Adding

Accessible by users who shouldn’t have access, e.g., CEO ○ Stored in public storage buckets Secret management requirements Identity Require strong identities and least privilege Auditing Verify the use application-layer … then tries to decrypt it https://xkcd.com/538/, https://xkcd.com/license.html Key rotation “Keys are analogous to the combination of a safe. If a safe combination is known to an penetration. Similarly, poor key management may easily compromise strong algorithms.” NIST SP 800-57, Recommendation for Key Management Keys get old Key rotation ● Key rotation is meant to limit the

hostPath 卷将主机节点的文件系统中的文件或目录挂载到 pod 中。 KMS 密 密钥 OpenShift Container Platform 4.14 存 存储 储 4 Key Management Service (KMS) 可帮助您在不同服务间实现所需的数据加密级别。您可以使用 KMS 密钥加密、解密和重新加密数据。 本地卷 本地卷 本地卷代表挂载的本地存储设备，如磁盘、分区或目录。 torageaccountname= \ 1 --from-literal=azurestorageaccountkey=key> 2 apiVersion: "v1" kind: "PersistentVolume" metadata: name: "pv0001" 1 spec: capacity: storage: "kubernetes.io/readwrite": "ro", 3 "kubernetes.io/secret/<key name>": "<key value>", 4 "kubernetes.io/secret/key name>": "key value>", } { "status": ""

etc. The combination of Baetyl and the Cloud Management Suite of BIE [https://cloud.baidu.com/product/bie.html](Baidu IntelliEdge) will achieve cloud management and application distribution, enable applications or any machine learning framework). Simplify Application Production: Baetyl combines with Cloud Management Suite of BIE and many other productions of Baidu Cloud(such as CFC [https://cloud.baidu.com/product/cfc provides features such as underlying service management, but also provides some basic functional modules, as follows: Baetyl Master is responsible for the management of service instances, such as start, stop