Kubernetes for Edge Computing across Inter-Continental Haier Production Sites Jiyuan Tang & Xin Zhang zhangxin@caicloud.io tangjiyuan@caicloud.io 关于我们 • 开源技术创新者 • 从 Kubernetes 到 Kubeflow • Google

Brandon Gul- la, Tim Nicklas, Chris Nuber and the team at SUSE Rancher Government Services (SUSE RGS, formerly Rancher Federal), the Booz Allen team is underpinning its smart, tactical edge platform Kubernetes distribution, designed for production workloads in unat- tended, resource constrained, remote envi- ronments. This is the story of how, alongside the team at SUSE RGS, Booz Allen is delivering SmartEdge infrastruc- ture, containers and Kubernetes were part of the plan from the start. The team began experimenting with Ku- bernetes and early versions of Docker in 2015. They soon became familiar

Kubernetes Secrets Agenda • K8s Secrets: Overview • TEE-based K8s Secrets Protection: Solution • Production Experience @ Ant Group • Demo • Summary & Plan K8s Secrets: Overview Background: K8s Secrets decryption of DEKs / Secrets • Introducing mutual (remote / local) attestations between entities Production Experience @ Ant Group KMS Plugin • Workflow • Encryption • Decryption • Engineering decisions KMS • API server & kms-plugin • Cron job backup for KEKs (from KMS) • Static key configuration support in kms-plugin • One click decryption • Key force update • Liveness probe • Monitoring • Integration

ols/jib Build containers faster with Jib A container image builder for Java applications Our Team Cloud Tools for Java Appu Goundan @coollog @loosebazooka Qingyang “Q” Chen github.com/GoogleContainerTools/jib install -y python-software-properties software-properties-common RUN add-apt-repository ppa:webupd8team/java RUN echo "oracle-java8-installer shared/accepted-oracle-license-v1-1 boolean true" | debconf-set-selections such as a CI/CD pipeline to leverage the same workflow and tooling when moving applications to production. github.com/GoogleContainerTools/skaffold official website code Development Process application

on Kubernetes Brian Redmond • Cloud Architect @ Microsoft (18 years) • Azure Global Black Belt Team • Live in Pittsburgh, PA, USA • Avid marathon runner and outdoors enthusiast • World traveler @chzbrgr71 Rita Zhang • Software engineer @ Microsoft, San Francisco • Azure Cloud Native Compute team • Kubernetes upstream features, Azure Kubernetes Service @ritazzhang OpenAI Scaling Kubernetes • Containers • CI/CD • Autoscaling • A/B testing and canary release of Models • Comparing Production accuracy vs expected accuracy when possible • Rolling-updates • … Resources • Source code

your organization to Kubernetes. In our experience, with only one team working on it, the knowledge becomes siloed within that team only. Centralized and Siloed • Instead of starting with onboarding deployment tool for Go-Jek International Expansion Projects Whiterabbit Kubernetes custom resources to support sharding with Kubernetes namespaces. Barito Log Open source on-demand logging infrastructure – Go-Jek System Team Prashant Mittal – Go-Jek Lambda Team Irfan Shah – Go-Jek Atlas Team Sumit Gupta – Go-Jek International Expansion Team Willem Pienaar – Go-Jek Data Science Team Arief Hermansyah

About Kubernetes Dashboard Dashboard 1.0 launched in 2016 github.com/kubernetes/dashboard SIG-UI Team Piotr Bryk, Google Jeffrey Sica, University of Michigan Jim Angel, General Motors Sebastian Florek since 2016 KubeCon update ● Exec into pod ● Global search ● Login mechanism ● Settings page ● Support for Cron Jobs ● Redesigned resource creation ● ...and much much more. github.com/kubernetes/dashboard/releases running Kubernetes in GCP and on-prem ● Custom Resource Definitions support ● Service topology view ● Mobile device support ● Cost estimates ● CI/CD pipelines ● ...and more! Additional feature

00a714f1a60d680c1ad8，即：将 Calico降级到3.1.3。 参考⽂档： Kubespray – 10 Simple Steps for Installing a Production-Ready, Multi-Master HA Kubernetes Cluster：https://dzone.com/articles/kubespray-10-simple-step local ，这意味着如果容器只使⽤ ，则它将解析为Namespace本地的服务。 这对在 多个Namespace（例如Development、Staging以及Production）中使⽤相同的配置的场景⾮常有⽤。 如果要跨越 Namespace，请使⽤完全限定域名（FQDN）。 译者按：FQDN是fully qualified domain name的缩写，即：完全限定域名 "stable" , "release" : "canary" "environment" : "dev" , "environment" : "qa" , "environment" : "production" "tier" : "frontend" , "tier" : "backend" , "tier" : "cache" "partition" : "customerA"

Kubernetes Contributors opensource.google.com A strong community with corporate and independent support. Independent Google Red Hat Huawei ZTE Corp FathomDB IBM Microsoft HP others 在地高可靠度資料中心 Your First Service in 10 Mins Run your cluster the way Google does GKE On-Prem ● Turn-key, production-grade, conformant Kubernetes with best-practice configuration ● Easy upgrade path to the latest for Alpha ● Simple CLI installation ● Online and Offline installation ● Private container registry support ● Latest 3 versions of k8s ● High-availability control plane ● Auto-repair Installation and Configuration

Background: DC/OS From Sigma 2.0(Swarm) to Sigma 3.1(Kubernetes) Background: Cluster Scale • Production environment: • Dozens of Cluster • 5k+ Nodes / Cluster • 10k+ Nodes / largest Cluster • Testing oriented programming • CustomResourceDefinition (CRD) • Built on Kubernetes APIs • Kubernetes repo support • Agile, flexible and convenient Node-Operator: Overview • User: SREs who can scale & offline