Installing a Single-Node Instance of Cassandra 2 Checking for a Java Installation 2 Installing the DataStax Community Binaries on Linux 3 Configuring and Starting a Single-Node Cluster on Linux 4 Installing 8 Understanding the Cassandra Architecture 8 About Internode Communications (Gossip) 8 About Cluster Membership and Seed Nodes 9 About Failure Detection and Recovery 9 About Data Partitioning in Cassandra About Read Requests 21 Planning a Cassandra Cluster Deployment 22 Selecting Hardware 22 Memory 22 CPU 22 Disk 23 Network 23 Planning an Amazon EC2 Cluster 23 Capacity Planning 24 Calculating Usable

Deployment: Cloud Layout ● Multiple K8s Clusters in an AZ ○ Each K8s cluster ~ 200 - 5,000 nodes ○ Upto 100,000 Pods in a cluster ○ 10,000+ K8s services - including prod, pre-prod, staging, etc. applications from a single region or AZ in a worst-case scenario Region R1 AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster Region Rn failures to AZ boundary AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster AZ Control Plane AZ Control Plane AZ Control Plane

Internal Load Balancers (ILBs) for Kube DNS, Pilot, Mixer and CA ○ Generate configs for VMs, incl. `cluster.env`, DNS config, Istio authN secrets etc. ○ Setup dnsmasq, Istio components in the VM and verify 1. Dnsmasq accepts DNS queries 2. Access the built-in Kube DNS (exposed by ILB) 3. Obtain the Cluster IP resolved 4. Traffic intercepted by the sidecar proxy 5. xDS ■ Traffic forwarded to ingress A K8s Service and Pods Two separate object with distinct lifecycles Before Workload Entry, a single Istio Service Entry object combined the lifecycles of both the service and the workloads implementing

of the initial license purchase; The end time is the date the license expires; Number of users: single user or multiuser for group licenses; The support period is the period you have access to the internal configure SSL Kubernetes Configure Kubernetes settings if your database is hosted within a Kubernetes cluster. Setting Description Connection Assign a specific name to the connection for easier identification separate connections for SQL Editor and/or metadata read. If you choose option, then DBeaver will use single connection - no new connections will be opened. Never Default option means that DBeaver will create

of the initial license purchase; The end time is the date the license expires; Number of users: single user or multiuser for group licenses; The support period is the period you have access to the internal configure SSL Kubernetes Configure Kubernetes settings if your database is hosted within a Kubernetes cluster. Setting Description Connection Assign a specific name to the connection for easier identification separate connections for SQL Editor and/or metadata read. If you choose option, then DBeaver will use single connection - no new connections will be opened. Never Default option means that DBeaver will create

of the initial license purchase; The end time is the date the license expires; Number of users: single user or multiuser for group licenses; The support period is the period you have access to the internal configure SSL Kubernetes Configure Kubernetes settings if your database is hosted within a Kubernetes cluster. Setting Description Assign a specific name to the connection for easier identification. You can separate connections for SQL Editor and/or metadata read. If you choose option, then DBeaver will use single connection - no new connections will be opened. Never Default option means that DBeaver will create

Ozone to be a drop-in replacement for HDFS • Strict S3 compatibility was opt in/out for the whole cluster – Is /volume/bucket/dir1/..///dir2/key1 • The literal name of a key? • A path to resolve to / an FSO bucket 33 © 2022 Cloudera, Inc. All rights reserved. DEMO Bucket types in a live Ozone cluster 34 © 2022 Cloudera, Inc. All rights reserved. Q&A Contribute! https://github.com/apache/ozone Incremental analytics 37 © 2022 Cloudera, Inc. All rights reserved. OBJECT VERSIONING VS SNAPSHOTS ● A single object - multiple versions ● A group of objects as a unit ○ Consistent with each other ○ Point

and Surfaces Istio is both a collection of security controls and an attack target. Workload Cluster Edge Operations Workload Data Exfiltration Man-In-The-Middle Denial of Service Privilege Escalation Escalation Application Compromise Control Plane Service mesh security architecture Cluster Workload Edge Operations Ingress Policies Egress Policies WAF / IDS Firewall User AuthN/Z Data Completeness Service mesh security best practices 2 Cluster security Edge security Workload security Operation security Mesh security Edge Security Cluster security Service Proxy Ingress 1

tenants. • Knative has knative-ingress-gateway for external access and knative-local-gateway for cluster local access. They use Istio gateway service istio-ingressgateway as its underlying service. Knative blue.51ch62kjrnd.svc.cluster.local http: route: - destination: host: {revision-3}. 51ch62kjrnd.svc.cluster.local weight: 10 - destination: host: {revision-2}. 51ch62kjrnd.svc.cluster.local weight: 90 Knative multiple shard k8s clusters, each cluster should support 1000 sequential (interval 5s) Knative service provisionings with route ready time <= 30s. Type Info K8s Cluster Capacity 12 nodes in 3 zones, 16

mTLS ● API and feature promotion ○ Networking/Security APIs ○ Virtual Machine expansion/Multi cluster mesh https://istio.io/latest/blog/2020/tradewinds-2020/ #IstioCon Impact on users https://thenewstack Enhancement workflow ○ CNI ○ IPv6 ○ Dual-stack (IPv6/IPv6) ○ Virtual Machine Expansion ○ Multi cluster mesh ○ Helm v3 life-cycle management ● Evaluate current feature status and fix gaps https://istio improvement areas ● Native Kubernetes API integration ○ Kubernetes Service APIs ○ Kubernetes Multi-cluster APIs ● Adopt & drive innovation in Envoy community ○ Delta xDS ○ HTTP2 tunnels https://istio