Scaling a Multi-Tenant k8s Cluster in a Telco Pablo Moncada October 28, 2020 About MasMovil group ● 4th telecom company in Spain ● Provides voice and broadband services to +12M customers ● Several complexity Scalability Availability Observability Security Reliability Messaging Analytics Multi-tenancy caveats ● Single underlying infrastructure ● Reduce operational complexity ○ Infrastructure Services +3k CPU +2k Mem +5TB Nodes +300 kube-proxy replacement NetworkPolicy logging Multi-cluster DNS Aware NetworkPolicy Increased Istio security External Services TLS visibility Performance

systemd 0 poweroff.target 关机 1 rescue.target 单用户模式 2 multi-user.target 多用户的文本界面 3 multi-user.target 多用户的文本界面 4 multi-user.target 多用户的文本界面 5 graphical.target 多用户的图形界面 6 reboot 用 ln 命令把 多用户模式目标文件链接到/etc/systemd/system/目录： [root@linuxprobe~]# ln -sf /lib/systemd/system/multi-user.target /etc/systemd/system /default.target 如果有读者之前学习过 RHEL 5/6 系统，或者已经习惯使用 service、chkconfig 2-5 timedatectl 命令中的参数以及作用 status 显示状态信息 list-timezones 列出已知时区 75 set-time 设置系统时间 set-timezone 设置生效时区 查看系统时间与时区的方法如下： [root@linuxprobe~]# timedatectl status

stomization-with-docker Container customization with Docker 3 rock-images/multi-node-configuration-with-docker-compose Multi-node configuration with Docker-Compose 2 Software 3 package-management Package 2 Samba 3 samba-active-directory Join Active Directory 3 samba-file-server Set up a file server 3 samba-print-server Set up a print server 3 samba-share-access-control Share access controls 3 samba-apparmor-profile how it works, and what it’s capable of. Core tutorial In our core tutorial, you will learn how to set up an Ubuntu Server; from installing using a bootable USB device, to navigating the Server installer

10.2 Shell 的变量功能 10.2.1 什么是变量？ 10.2.2 变量的取用与设置：echo, 变量设置规则, unset 10.2.3 环境变量的功能：env 与常见环境变量说明, set, export 10.2.4 影响显示结果的语系变量 （locale） 10.2.5 变量的有效范围 10.2.6 变量键盘读取、阵列与宣告： read, declare, array 10 环境配置文件:login, non-login shell, /etc/profile, ~/.bash_profile, source, ~/.bashrc 10.4.4 终端机的环境设置： stty, set 10.4.5 万用字符与特殊符号 10.5 数据流重导向 （Redirection） 10.5.1 何谓数据流重导向？ 10.5.2 命令执行的判断依据： ; , &&, || 10.6 default.target 进入开机程序分析 19.1.4 systemd 执行 sysinit.target 初始化系统、basic.target 准备系统 19.1.5 systemd 启动 multi-user.target 下的服务：相容的 rc.local,getty.target 启动 19.1.6 systemd 启动 graphical.target 下面的服务 19.1.7 开机过程会用到的主要配置文件

CPU 架构， 分别是：精简指 令集 （RISC） 与复杂指令集 （CISC） 系统。下面我们就来谈谈这两种不同 CPU 架构的差异啰！ 精简指令集 （Reduced Instruction Set Computer, RISC）：[5] 这种 CPU 的设计中，微指令集较为精简，每个指令的执行时间都很短，完成的动作也很单纯，指令的执行性能 较佳； 但是若要做复杂的事情，就要由多个指令来完成。常见的 ） 等，几乎都是使用 ARM 架构的 CPU 喔！ 老实说，目前世界上使用范围最广的 CPU 可能就是 ARM 这种架构的 呢！ [6] 复杂指令集（Complex Instruction Set Computer, CISC）：[7] 与RISC不同的，CISC在微指令集的每个小指令可以执行一些较低阶的硬件操作，指令数目多而且复杂， 每条 指令的长度并不相同。因为指令执行较为复杂所以每条指令花费的时间较长， 的简写，是个无穷循环！ 另外， 这个计划是由自由软件基金会 （Free Software Foundation, FSF） 所支持的！ 两者都是由 Stallman 先生所发起的！ 何谓多用户 （ Multi-user ） 多任务 （ Multitask ）？Multiuser 指的是 Linux 允许多人同时连 上主机之外，每个使用者皆有其各人的使用环境，并且可以同时使用系统的资源！Multitask

the system. You can import SSH keys from Launchpad or Github but a password is still required to be set, as this user will have root access through the sudo utility. • The final screen shows the progress "Configure the network manually". • Next, the installer asks for the system's hostname. • A new user is set up; this user will have root access through the sudo utility. • After the user settings have been more information see Section 4, “Aptitude” [p. 32]. • Finally, the last step before rebooting is to set the clock to UTC. If at any point during installation you are not satisfied by the default setting

默认目录的安全上下文查询与修改 sendmail 著名电子邮件服务器 seq 以指定增量从首数开始打印数字到尾数 service 控制系统服务的实用工具 sesearch 查询SELinux策略的规则详情 set 显示或设置shell特性及shell变量 setfacl 设置文件访问控制列表 setpci 查询和配置PCI设备的使用工具 setsebool 修改SElinux策略内各项规则的布尔值 setsid mkkickstart、modinfo、 modprobe、mouseconfig、ntsysv、passwd、pwconv、pwunconv、rdate、resize、 rmmod、rpm、set、setconsole、setenv、setup、sndconfig、SVGAText Mode、 timeconfig、ulimit、unalias、unset adduser、chfn、ch /etc/runlevels # runlevel 45. apk add openrc # use openrc for init system 46. rc-update add xxx # set to start on 47. rc-service xxx start # equal -> /etc/init.d/xxx start 48. rc-status 49. 50. adduser

Component Overview Terminology Networking Network Security eBPF Datapath Kubernetes Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Security Bugs Operations System Requirements Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain these new BPF powers. Hubble can answer questions such as: Service dependencies & communication map What services are communicating with each other? How frequently? What does the service dependency

Overview Terminology Networking Network Security eBPF Datapath Observability Kubernetes Integration Multi-Cluster (Cluster Mesh) Getting Help FAQ Slack GitHub Training Enterprise support Security Bugs Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain these new eBPF powers. Hubble can answer questions such as: Service dependencies & communication map What services are communicating with each other? How frequently? What does the service dependency

Operations Istio Other Orchestrators Concepts Component Overview Terminology Address Management Multi Host Networking Security Datapath Failure Behavior Architecture Datapath Scale Kubernetes Integration Automatically run unit tests on code changes BPF and XDP Reference Guide BPF Architecture Instruction Set Helper Functions Maps Object Pinning Tail Calls BPF to BPF Calls JIT Hardening Offloads Toolchain This means that each host can allocate IPs without any coordination between hosts. The following multi node networking models are supported: Overlay: Encapsulation-based virtual network spanning all hosts