顾静, 阿里云 邓隽, 阿里云 Kubernetes 异常配置检测框架 我们来自阿里云容器服务 • 顾静，研发工程师 • 邓隽，技术专家 我们参与打造 • 容器服务（ACK/ASK） • 容器镜像服务（ACR） • 服务网格（ASM） • … 1 Kubernetes 典型异常 2 检测框架演进 3 生产实践 4 总结 Kubernetes 使用日常 • 应用部署 • Kernel 仅能检测 Kernel 相关问题 要求熟悉 bpftrace 语言 1 Kubernetes 典型异常 2 检测框架演进 3 生产实践 4 总结 我们的目标 实现 Kubernetes 集群异常检测框架 支持集群多维度异常检测能力 支持集成开源检测组件 检测框架 Ver.1 { 自动化 Ver.1 自动化 Autopilot Engine Command Policy 边缘集群、GPU 集群 各类检测场景 • 节点、组件、配置等 • 集群升级、集群巡检 版本差异 * 类型差异 * 场景差异 检测项 Ver.1 优化点 检测代码在膨胀 检测能力迭代需要加速 检测框架 Ver.2 { 动态定制 动态扩展 Ver.2 DSL DSL (Domain-Specific Language) • 领域特定语言指专注于某个应用程序领域的计算机语言 • 目标受众为非程序员、业务员或最终客户

Amazon EKS - EKS Support for K8s version 1.13 + ECR AWS PrivateLink - EKS-optimized AMI metadata SSM parameter - IAM for Pods - New Amazon EKS Regions: Ningxia 研发中 - Amazon EKS on Fargate - Managed

tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

SaveS- tate The VM state is being saved and the service must save relevant information using the SSM API (VBox/ssm.h). pfn- Load- State The VM is being restored from the saved state and the service must load

provides a tree structure which holds configuration set- tings for the VM and all emulated devices. • SSM (Saved State Manager), saves and loads VM state. • VUSB (Virtual USB), a USB layer which separates VERR_SVM_UNEXPECTED_EXIT while intercepting debug register accesses (AMD-V only; bug #12481) • VMM: fixed a VERR_SSM_STRUCTURE_MAGIC error when trying to load a saved state made with VBox 4.3.4 when VT-x/AMD-V is disabled when a machine had immutable or writethrough storage attached (bug #5727) • Saved state: fixed VERR_SSM_LOADED_TOO_MUCH error when loading DisplayScreen- shot(bug #6162) • VBoxManage: add restorecurrent

provides a tree structure which holds configuration set- tings for the VM and all emulated devices. • SSM (Saved State Manager), saves and loads VM state. • VUSB (Virtual USB), a USB layer which separates VERR_SVM_UNEXPECTED_EXIT while intercepting debug register accesses (AMD-V only; bug #12481) • VMM: fixed a VERR_SSM_STRUCTURE_MAGIC error when trying to load a saved state made with VBox 4.3.4 when VT-x/AMD-V is disabled when a machine had immutable or writethrough storage attached (bug #5727) • Saved state: fixed VERR_SSM_LOADED_TOO_MUCH error when loading DisplayScreen- shot(bug #6162) • VBoxManage: add restorecurrent

provides a tree structure which holds configuration set- tings for the VM and all emulated devices. • SSM (Saved State Manager), saves and loads VM state. • VUSB (Virtual USB), a USB layer which separates for handling certain MSRs on ancient CPUs without VT-x support for MSR bitmaps • VMM: fixed VERR_SSM_LOAD_CPUID_MISMATCH errors when restoring a saved state with SMP guests on hosts without the CPUID/HTT VERR_SVM_UNEXPECTED_EXIT while intercepting debug register accesses (AMD-V only; bug #12481) • VMM: fixed a VERR_SSM_STRUCTURE_MAGIC error when trying to load a saved state made with VBox 4.3.4 when VT-x/AMD-V is disabled