United States Product and Service K3s Advancing the Tactical Edge with K3s and SUSE RGS 2 www.susergs.com Advancing the Tactical Edge with K3s and SUSE RGS Introducing Booz Allen Hamilton Booz initiatives. The company is delivering technology solutions that give warfight- ers the information edge on the battlefield. Booz Allen is transforming military opera- tions in complex and remote locations conditions is, more often than not, the difference be- tween life and death. Booz Allen’s innova- tive edge computing solution, SmartEdge, addresses the increasing need to gather data in real time and perform

Kubernetes for Edge Computing across Inter-Continental Haier Production Sites Jiyuan Tang & Xin Zhang zhangxin@caicloud.io tangjiyuan@caicloud.io 关于我们 • 开源技术创新者 • 从 Kubernetes 到 Kubeflow • Google

Controller • Control everything by Controller • Level driven, not edge driven edge level Image: https://speakerdeck.com/thockin/edge-vs-level-triggered-logic Controller • The heart of Kubernetes orchestrator want to have a Network object into k8s API • I want a controller to handle add/update/delete of all Network instances • onAdd: create Neutron network • onDelete: delete Neutron network • onUpdate: onUpdate: update Network object status • https://github.com/openstack/stackube/blob/master/pkg/network- controller/network_controller.go Pattern 2: Gode Generator • client-gen: generate typed Kubernetes AP

compatible with GKE Built for Day 2 Operations PKS simplifies Day 2 operations with built-in network security—powered by NSX, high availability, logging, monitoring, analytics, and automated health K8s-2 n=3 #pks create-cluster K8s-3 n=3 #pks resize K8s-3 n=5 Architecture NSX-T Bosh PKS Admin Network NCP POD 1 POD 4 POD 2 POD 3 POD 5 POD 6 T0 kube-system PODs – Logical Switch Namespace Worker ‘VM’ Pod 5 Pod 6 T1 T1 T1 T1 VMware vSphere NSX Manager NSX Controllers T1 NSX Edge Cluster Architecture NSX-T • NSX Container Plugin: NCP is a software component provided by VMware

Ordinal Index（有序的索引） 对于⼀个有N个副本的StatefulSet，StatefulSet中的每个Pod将被分配⼀个整数序号，范围[0，N），并且唯⼀。 Stable Network ID（稳定的⽹络ID） StatefulSet中的每个Pod，从StatefulSet的名称和Pod的序数派⽣其主机名。 构造的主机名的模式是 $(statefulset name)-$(ordinal) io/memory-pressure ：Node内存有压⼒。 node.kubernetes.io/disk-pressure ：Node磁盘有压⼒。 node.kubernetes.io/network-unavailable ：Node的⽹络不可⽤。 node.cloudprovider.kubernetes.io/uninitialized ：当kubelet以外部cloud pr Node：Kubernetes集群中的单个虚拟机或物理机。 Cluster：⼀组位于互联⽹防⽕墙之后的Node，这是Kubernetes管理的主要计算资源。 Edge router：为集群强制执⾏防⽕墙策略的路由器。这可能是由cloud provider或物理硬件管理的⽹关。 Cluster network：⼀组逻辑或物理链接，可根据 Kubernetes networking model 实现集群内的通信。集群⽹络的示 例包括诸如

� 开源的云、边协同边缘计算框架 Why KubeEdge——CNCF & Kubernetes & KubeEdge� Central Cloud� Edge 1� Edge n� Edge 2� Cloud� Edge� Kubernetes Cluster� CNCF社区⾸首个基于Kubernetes的边缘计算平台KubeEdge Why KubeEdge——华为公有云智能边缘平台IEF KubeEdge实战——从云端分发应⽤用到边缘Demo演示� K8S API Server� KubeEdge Cloud� KubeEdge Edge� Wait for pod update� Send added pod to edge� Kubectl create� Create result� Send pod update to cloud� Update pod�

Builder • 不同集群版本、类型、场景动态定制检测报告 • 不同检测点动态定制检测策略 Report cluster.version > 1.16.1 and cluster.type = Edge and report.type = upgrade Policy cluster.addon.terway.version > 1.0.9.14 Checkpoint terway.version

Node GKE On-Prem Node Control Plane Node Hybrid Use Cases Legacy Software Local Execution Edge / IoT Cloud bursting Ecommerce site Catalog, ERP Warehouse Factory Branch Augmented Services

Amazon Confidential Amazon VPC CNI plugin Elastic network interface Secondary IPs: 10.0.0.1 10.0.0.2 10.0.0.1 10.0.0.2 Elastic network interface 10.0.0.20 10.0.0.22 Secondary IPs: 10.0 / DX Pod Outbound Traffic SNAT EKS worker node Primary elastic network interface Pod Secondary elastic network interface Pod – 100.64. 0.200 © 2019, Amazon Web Services, Inc. or its Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential Service load balancer: Network Load Balancer apiVersion: v1 kind: Service metadata: name: nginx namespace: default labels:

Chaos Mesh 的结构 以 NetworkChaos 为例 ● Controller 向 chaos-daemon 发送请求 ● [Pod network namespace] 设置 ipset 和 iptables ● [Pod network namespace] 设置 qdisc Chaos-daemon loss/delay/dup/c orrupt netem ipset+iptables bandwidth tbf NetworkChaos 实现方法 如何进入目标 Pod 的 Network Namespace ● setns 系统调用 ● nsenter 命令 或在其他进程中 setns ○ 开发、测试更加方便 ○ 使用起来更加简单 ● SideCar 共享 Network Namespace ○ 范围和权限更加可控 Chaos Mesh 使用案例 以 TiDB