Go Programming Pattern in Kubernetes Philosophy Harry Zhang @resouer Contents • What I will talk? • Kubernetes basic in 1 min • For Kubernetes developers: • The Golang programming patterns of interface design in Kubernetes (CRI as example) • For Kubernetes users: • Effective pattern of programming based on Kubernetes • ⼴广告（Don’t worry, it’s not that kind of AD） • What I will not talk? • https://github.com/google/lmctfy • Now think about a C/C++ based Kubernetes? • And, well designed programming patterns with powerful extensibility Understand Kubernetes in 1 min Container Pod Deployment

in the clear in memory ü leak ALL DEKs ü leak ALL secrets ü trust collapse! • DEK decryption interfaces invoked by fake users Motivation: K8s Secrets Protection • Kube-on-Kube [1] ü Components => Host (KMS provider) compromise Ø leak DEKs Ø leak Secrets • Fraudsters calling DEK decryption interfaces TEE-based Kubectl • Address security threats • Client compromise Ø kubeconfig maliciously reused SGX servers deployed w/ sgx-device- plugin daemonset [1] • kms-plugins deployed as deployment • Interfaces • https + connection reuse • certificate: similar to apiserver ó etcd (X.509) • Version-based

Creates virtual IP for external access • Interfaces with local iptables • Load-balance interface for Pods • Creates virtual IP for external access • Interfaces with local iptables The Kubernetes Runtime Containers Ÿ Kubernetes: Manage Container workload, Desired State Management, Decouple Service Interfaces & Backedn Workload Ÿ PKS: Manage Kubernetes Lifecycle & Underline Infrastructure Summary Modern

• Declarative system • Manage resource to final state continually • kube-apiserver oriented programming • CustomResourceDefinition (CRD) • Built on Kubernetes APIs • Kubernetes repo support • Agile

Service Account virtlet solution Virtlet Pros define VM as Pod supports using multiple interfaces SR-IOV NFV Environments Virtlet Cons limited storage options more configurations VM actions

a bare minimum of centralized management of these services, which may be written in different programming languages and use different data storage technologies. " (Martin Fowler) 什么是微服务架构? 单体 – 微服务

show #查看网桥（虚拟交换机） bridge name bridge id STP enabled interfaces cni0 8000.9e3551d62fed no veth57d7a776 docker0 8000.0242f0503f0d