ClusterName }}: domainNameServers: AmazonProvidedDNS {{ if eq Region "us-east-1" }} domainName: ec2.internal {{ else }} domainName: {{ Region }}.compute.internal {{ end }} vpcDHDCPOptionsAssociation/{{ ClusterName }}: domainNameServers: AmazonProvidedDNS {{ if eq Region "us-east-1" }} domainName: ec2.internal {{ else }} domainName: {{ Region }}.compute.internal {{ end }} vpcDHDCPOptionsAssociation/{{ ClusterName }}: domainNameServers: AmazonProvidedDNS {{ if eq Region "us-east-1" }} domainName: ec2.internal {{ else }} domainName: {{ Region }}.compute.internal {{ end }} vpcDHDCPOptionsAssociation/{{

itself? How about the fleet Kubernetes running on? Onboard •Rack •NetworkDevice •ComputeAsset •Region/AZ •NetworkScope Provision •OS •Flavor •ComputeNode Configuration •Kernel params •Environment your controller based on list/watch ● ebay uses Kubernetes to model and operate it’s datacenter Region, AvailabilityZone, NetworkZone, L2Domain Rack, NetworkDevice, ComputeAsset SaltMaster, SaltMinion

expand horizontally more quickly and flexibly 4 Region1 How do you manage so many clusters ,resources and businesses Cluster1 Cluster2 Cluster2 … Region N … Cluster1 Cluster2 … Cluster2 Business 1

for public IP space in VPC - Amazon EKS: Deep Learning Benchmarking Utility - New Amazon EKS Region: Paris, London, Mumbai - CNI v1.5.0 - New Regions: Hong Kong 即将发布 - Service linked role for reserved. Amazon Confidential Worker Worker Master Worker Worker Master Auto Scaling group AZ1 Region AZ2 Auto Scaling group CloudWatch Logs Elasticsearc h Kiban a Fluentd DaemonSet Kubectl

kubernetes.io/hostname failure-domain.beta.kubernetes.io/zone failure-domain.beta.kubernetes.io/region beta.kubernetes.io/instance-type beta.kubernetes.io/os beta.kubernetes.io/arch Affinity 含Namespace的），Pod Label上的Label Selector必须指定选择器要应⽤的Namespace。 概念上，X是⼀个拓扑域， 如Node、机架、云提供商Zone、云提供商Region等。您可以使⽤ topologyKey 表示它，该key是系统⽤来表示拓扑域 的Node标签，例如参⻅上⾯ Interlude: built-in node labels 中列出的键。 与Node io/hostname 被解释 为“所有拓扑”（“所有拓扑”在这⾥仅限于 kubernetes.io/hostname 和 failure-domain.beta.kubernetes.io/region 的 组合）。 4. 除上述情况外， topologyKey 可以是任何合法的标签key。 除 labelSelector 和 topologyKey 外，还可以选择指定 labelSelector

鉴权方式：白名单（允许调用），黑名单（拒绝调用） • 签名校验 • 审计日志 Agent 用户 1. 配置访问控制规则 配置中心 2. 写入token和规则 购物车服务 服务鉴权: 保护你的敏感业务 AZ 标 Region 标 压测标 版本标 场景标 自定义标 标签路由 金丝雀发布 全链路流控 场景链路 同 AZ 优先路由 容灾路由 全链路压测 自定义标 tag1 tag2 Provider