Confidential AWS 中国（宁夏）区域由西云数据运营 AWS 中国（北京）区域由光环新网运营 周琦，AWS 解决方案架构师 Amazon Elastic Kubernetes Service (EKS) 初探秘 © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential Elastic Container Registry 管理 容器化应用的部署，调度，扩 展和管理 Amazon Elastic Container Service Amazon Elastic Container Service for Kubernetes 主机 容器在哪里运行 Amazon EC2 AWS Fargate 服务注册发现 云端服务的黄页 AWS Cloud New Amazon EKS Region: Paris, London, Mumbai - CNI v1.5.0 - New Regions: Hong Kong 即将发布 - Service linked role for Amazon EKS - EKS Support for K8s version 1.13 + ECR AWS PrivateLink - EKS-optimized

������Kubernetes Service�������� �� ��Cloud BU - PaaS��� Github: @m1093782566 Kubernetes�Service�� Iptables��Service���� ��Iptables������� IPVS��Service���� Iptables vs. IPVS Kubernetes�Service ����onl��a�o� ����onl��a�o� - ��������������t� - ���������� - �����IP�n������� - �������� - ��������� Kubernetes Service�Endpoints Label Selector Label: app=backend IP: 172.17.10.1 Port: 80 Label: app=MyApp Container 80 Label: app=MyApp Container Container Replication Controller Label: app=MyApp Replicas: 2 Service <10.0.0.11>:<9376> Label: app=MyApp Endpoints: track backend pod changes <172.17.10.1>:<80> <172

com 10.99.1.61 k8s-node02.cof-lee.com 10.99.1.62 规划Pod网络： 10.244.0.0/16 规划Service网络： 10.7.0.0/16 # pod网络和service网络都要求为16位的地址块，且不能与环境中其他网络地址 段冲突 # hostnamectl set-hostname k8s-master1.cof-lee.com ] } # mkdir -p /etc/systemd/system/docker.service.d # docker info ★docker会修改防火墙规则，导致pod网络不通 # vi /usr/lib/systemd/system/docker.service #在[Service]下的ExecStart=/usr/bin/dockerd -H fd:// 这行下面再添加一行： address=10.99.1.51 \ # api server地址 --pod-network-cidr=10.244.0.0/16 \ # pod容器网段 --service-cidr=10.7.0.0/16 \ # service网段，即cluster ip网段 --ignore-preflight-errors=Swap \ #忽略swap未关闭而导致的检查错误 --image-repository="cof-

○ Healing ○ Discovery/load balancing ○ Scaling Scheduling Scheduler Scheduler Scheduling Scheduler Scheduling color=yellow Discovery Select color = yellow color=yellow Discovery yellow.mycluster Bootkube API Server Scheduler Controller Manager etcd Kubelet Create: Deployment Daemonset Service Secret Bootkube API Server Scheduler Controller Manager etcd Kubelet Pods API Server Scheduler

Containers VMware Hypervisor VMs Docker Containers User Cases 9 •Ready-to-go development •Self-service portal Developer Sandbox • New application development • 12-factor apps, PCF Cloud Native •Simplify Selectors Tags for component grouping and methods to access them Service Discovery An object associated to a label selector to provide a LB and Service DNS ReplicaSets A cluster wide Pod manager providing Pod resiliency, and Day 2 VMware PKS Value Proposition 22 A turnkey solution for enterprises and service providers to provision, operate and manage production grade Kubernetes clusters Fully supported

for ojek service 01 2010 Milestone Go-Jek 1.0 Call-cente for ojek service 01 Mobile App First mobile app was launched 02 2010 2015 Milestone Go-Jek 1.0 Call-center for ojek service 01 Mobile Go-Pay into P2P, withdrawal, etc 03 2010 2015 2017 Milestone Go-Jek 1.0 Call-center for ojek service 01 Mobile App First mobile app was launched 02 More Apps! Incl. growth of Go-Pay into P2P etc. are more effectively utilized in container world than in VMs. Efficiency • Automatic service discovery allows engineers to not maintain any configuration for multi-data center deployments. Easy

成本低 • 极致弹性: 30s 500 pod • 成本优化：按需创建，支持spot和预留实例劵 • Kubernetes兼容性： deployment/statfulset/job/service/ingress/CRD • ALB Ingress: 基于SLB 7 layer • Knative serving on ASK：automatic scaling in knative ASK Cluster Serverless Kubernetes Architecture Cloud-scale Nodeless Kubernetes Etcd Watch Pod, Service, Ingress resource change ECI Two-way sync of resources K8S resources CRUD K8S Client Elastic Elastic Container Instance Pod Viking agent Container Container Pod Get Pod status Service/Ingress DNS Entry SLB Private Zone ASK-Scheduler K8S API Server Metrics API CloudMonitor, Prometheus

Pod: Restart Policies, VolumeMounts, Env, InitContainers，Heath check … • Service: LoadBalancer, Headless, Service Discovery(PrivateZone) • Ingress: Aliyun 7-Layer LoadBalancer • Volumes: emptyDir Attach, Top • Scaling, HPA • Helm 面向Cloud Scale的架构设计 Etcd K8S API Server Viking 侦听 Pod, Service, Ingress等资源变化 ECI SLB DNS 双向同步 IaaS资源状态 K8S资源 CRUD K8S Client ECI Pod Viking

2-0 kubectl-1.18.2-0 --disableexcludes=kubernetes #将 kubelet 设置为开机自启动 systemctl enable kubelet.service E. 部署 k8s master 节点 Step1: kubeadm.yaml vi kubeadm.yaml apiVersion: kubeadm.k8s.io/v1beta2 k8s node 上执行加入到 k8s cluster kubeadm join k8s-master:6443 --token xvxx9v.ugbbvrdncqv061hk \ --discovery-token-ca-cert-hash sha256:c6538b73d36284378aaf0bf312bcd851f30d621d97465bdd5bace528e23e5b2b Step3: drop: - ALL add: - NET_BIND_SERVICE args: - --configfile=/config/traefik.yaml volumeMounts:

- developer-survey.pdf Spring Boot 是开发者构建云原生应用的首选! JAKARTA EE 2019 开发者报告 Config Server Service Discovery Circuit Breaker Gateway Load Balancer Distributed Tracing Messaging Serverless Task Pilot API Server Go App Envo y Node.js APP Envo y Java App Agent Java App Agent MCP Service Mesh xDS xDS • 调用互通 • 监控互通 • 治理互通 xDS xDS 服务治理 无损下线 离群实例摘除 标签路由 服务鉴权 链路跟踪 多语言互通