GPU Resource Management On JDOS 梁永清 liangyongqing1@jd.com 提供的服务 1. 用于实验的 GPU 容器 2.基于 Kubeflow 的机器学习训练服务 3.模型管理和模型 Serving 服务 Experiment Training Serving 均基于容器，不对业务方直接提供 GPU 物理机 GPU 实验 JDOS 常规的容器服务

Secrets Management at Scale with Vault & Rancher 24. June Robert de Bock Senior DevOps Engineer Adfinis robert.debock@adfinis.com Kapil Arora Senior Solution Engineer HashiCorp kapil@hashicorp.com Infrastructure Management (Run & Manage) GitOps Continuous Delivery Cluster Templates & Config Enforcement K8s Version Management Node Pool Management Cluster Provisioning & Lifecycle Management Platform Amazon EKS Azure AKS Google GKE Cloud Datacenter Edge Branch Dev Secret Management in Kubernetes 16 17 18 Secret Management Challenges ● Secrets sprawl ● Secrets rotation ● X.509 certificates, SSH

Node Operator: Kubernetes Node Management Made Simple 陈俊(Joe), Ant Financial Agenda • Background and Motivation • Introduction of Operators • Node-Operator • Advanced Topic: • Upgrade Master & Node Components reliably • Canary Rollout • Master & Node Component Versions Management Motivation: Work Order Deployment Worker Order • Upgrade Nodes Versions • Upgrade Node 10.10 Complicated architecture Work order deployment system can not meet the requirements of resource management. Operator Observe Action Analyze • Observe: watch desired resource and actual resource

Processing and Analytics Vasiliki (Vasia) Kalavri
 vkalavri@bu.edu Spring 2020 2/25: State Management Vasiliki Kalavri | Boston University 2020 Logic State <#Brexit, 520> <#WorldCup, 480> key of the current record so that all records with the same key access the same state State management in Apache Flink 5 Vasiliki Kalavri | Boston University 2020 Operator state Keyed state State state is stored, accessed, and maintained. State backends are responsible for: • local state management • checkpointing state to remote and persistent storage, e.g. a distributed filesystem or a database

goal of the assessment was to identify security issues related to the Istio code base, highlight high risk configurations commonly used by administrators, and provide perspective on whether security features Confidential Table of Findings For each finding, NCC Group uses a composite risk score that takes into account the severity of the risk, application’s exposure and user population, technical difficulty of exploitation exploitation, and other factors. For an explanation of NCC Group’s risk rating and finding categorization, see Appendix A on page 38. Title ID Risk Inability To Secure Control Plane Network Communications

secret vault (Low) Orchestration Hardening Network Policy Zero-Trust Concepts RBAC Secrets Management Conclusions Cure53, Berlin · 07/01/20 1/19 Dr.-Ing. Mario invocation request, the unsanitized parameter is concatenated onto the targeted URL. This introduces the risk of attackers passing HTTP parameters into the method parameter, which are then appended to secrets of statestore components can be received from Dapr via the getSecrets API. This introduces the risk of attackers extracting passwords and sensitive secrets to authenticate at statestore components,

NIST在容器安全指南中揭露了五種容器應用最應關注的風險 映像風險 Image Risk 登錄風險 Registry Risk 容器調度平台風險 Orchestrator Risk 容器風險 Container Risk 實體作業系統風險 Host OS Risk ©2019 VMware, Inc. 9 針對Kubernetes的安全強化實作參考: Day 1 & Day 2 for k8s clusters Manages access to k8s API for developers IT Operator IaaS Management Internet User Application User Trust Boundary Trust Boundary Trust Boundary Trust Boundary Authentication and Authorization i. Compliance j. File System Permissions k. User Account Management 所有強化在發佈前都經過測試驗證 您不再需要每回合升級都從頭來過 若發現CVE漏洞官方立刻提供修補 •The following servers are not used

. . . . . . . 211 9.25 VirtualBox expert storage management . . . . . . . . . . . . . . . . . . . . . . . 211 9.26 Handling of host power management events . . . . . . . . . . . . . . . . . . . . 212 usage reporting . . . . . . . . . . . . . . . . . 233 12.2.6 Poor performance caused by host power management . . . . . . . . . . 233 12.2.7 GUI: 2D Video Acceleration option is grayed out . . . . . . . to access USB devices from VirtualBox guests in the group vboxusers, either through the GUI user management tools or by running the following command as root: sudo usermod -a -G vboxusers username Note:

. . . . . . . 211 9.25 VirtualBox expert storage management . . . . . . . . . . . . . . . . . . . . . . . 211 9.26 Handling of host power management events . . . . . . . . . . . . . . . . . . . . 212 usage reporting . . . . . . . . . . . . . . . . . 233 12.2.6 Poor performance caused by host power management . . . . . . . . . . 233 12.2.7 GUI: 2D Video Acceleration option is grayed out . . . . . . . to access USB devices from VirtualBox guests in the group vboxusers, either through the GUI user management tools or by running the following command as root: sudo usermod -a -G vboxusers username Note:

flush requests . . . . . . . . . . . . . . . 181 12.2.3 Poor performance caused by host power management . . . . . . . . . . 181 12.2.4 GUI: 2D Video Acceleration option is grayed out . . . . . . . to access USB devices from VirtualBox guests in the group vboxusers, either through the GUI user management tools or by running the following command as root: sudo usermod -a -G vboxusers username Note: member of that group. A user can be made a member of the group vboxusers through the GUI user/group management or at the command line with sudo usermod -a -G vboxusers username Note that adding an active