containerPort: 88 hostPort: 88 - name: nbiot-udp protocol: UDP containerPort: 9092 hostPort: 9092 resources: kubernetes-dashboard namespace: default spec: ports: - name: https port: 443 protocol: TCP targetPort: 443 sessionAffinity: None type: ExternalName externalName: io/component: backup spec: type: ClusterIP ports: - port: 9999 targetPort: 9999 protocol: TCP name: http selector: {{- include "influxdb.selectorLabels" . | nindent 4 }} ---

1000m，这个m是mili（千分之一）的意思 ports: #端口暴露，仅作提示信息 - name: h�p containerPort: 80 protocol: TCP env: #给容器传递的环境变量 - name: TZ value: Asia/Shanghai #securityContext: ports: #端口暴露，仅作提示信息，无实际影响 - name: h�p containerPort: 80 protocol: TCP env: #给容器传递的环境变量 - name: TZ value: Asia/Shanghai podlable: ds-pod #与目标pod的labels相同，如果目标pod有多个，则自动实 现负载均衡 type: ClusterIP ports: - protocol: TCP #默认为TCP， port: 1380 # service ip 的port targetPort: 80

apiVersion: v1 metadata: name: my-service spec: selector: app: MyApp ports: - protocol: TCP port: 80 targetPort: 9376 使⽤此⽂件，即可创建⼀个名为“my-service”的新 Service 对象，该对象会代理那些使⽤TCP端⼝9376，并且 在以上这些情况下，您可以定义不带选择器的Service： kind: Service apiVersion: v1 metadata: name: my-service spec: ports: - protocol: TCP port: 80 targetPort: 9376 因为该Service没有选择器，所以不会创建相应的 Endpoint 对象。可⼿动将Service映射到指定的 namespace: prod spec: type: ExternalName externalName: my.database.example.com 当查找主机 my-service.prod.svc.CLUSTER 时，集群DNS服务将会返回⼀条值为 my.database.example.com 的 CNAME 记 录。访问这样的Service与访问其他Service的⼯作⽅式相

id is passed to IPVS module • Ip_vs_new_conn() inserts eBPF map • Key: (protocol, cip:cport , rsip:rsport) • Value: (protocol, lip:lport, rsip:rsport) • Ip_vs_conn_unlink() deletes entries in eBPF map

Business Wavefront By VMware SaaS-Based Metrics Monitoring and Analytics Platform Constant Compatibility Between PKS and Google Container Engine (GKE) 33 CONFIDENTIAL Google Container Engine (GKE)

path value: "/" applicationScopes: - my-vpc-network - componentName: backend instanceName: database applicationScopes: - my-vpc-network vpc-3a1p8n container- 8q93re slb-7yt83n rds- 1uy31m OAM 运维 研发 监控报警 灰度发布 日志 扩缩容 负载均衡 web backend Trait Promethus Operator Elasticsearch Operator database Component OpenKruise RDS operator …… • OAM • Helm/CNAB • GitOps • Rollout • Workload Controller

尽量将大部分代码放在eBPF中，方便升级和维护。 • eBPF loader 创建eBPF map时，将map的id 传给IPVS内核模块 • 在ip_vs_new_conn 时，插入eBPF map • (protocol, clientip:cport -> targetip:dport) • 在ip_vs_conn_unlink时，删除eBPF map • 由于eBPF中没有timer机制 IPVS 如何做SNAT？

{SECRET}DEK + {DEK}KEK Envelope Source for crypto notation: https://en.wikipedia.org/wiki/Security_protocol_notation KMS 1.10 Envelope Encryption Sequence Master kube-apiserver etcd kms-plugin SECRET

'php:latest' env: - name: OAM_TEXTURE value: texture.jpg ports: - containerPort: 8001 name: http protocol: TCP $ kubectl get deployment NAME REVISION AGE frontend-c8bb659c5 1 2d15h $ kubectl get components

Node IP: 192.168.10.10 IP: 10.2.3.14 DNS: service1.cluster.local Port: 9443 NodePort: 31233 Protocol: TCP Port: 9443 SACC2017 K8s Cluster ReplicaSet.yaml ContainerImage1 Replicas: 3