© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential AWS 中国（宁夏）区域由西云数据运营 AWS 中国（北京）区域由光环新网运营 周琦，AWS 解决方案架构师 Amazon Elastic Kubernetes Service (EKS) 初探秘 © 2019 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential AWS 容器服务概览 镜像仓库 容器镜像保存地址 Amazon Elastic Container Registry 管理 容器化应用的部署，调度，扩 展和管理 Amazon Elastic Container Amazon EC2 AWS Fargate 服务注册发现 云端服务的黄页 AWS Cloud Map 服务网格 服务间通信的基础设施层 © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Confidential Amazon EKS于2018年6月正式发 布，已经度过了1岁生日

kubectl proxy 02-安装单机版Kubernetes 8 访问： http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/#!/overview? namespace=default 参考： https://kubernetes.io/d $ kubectl get pods -l 'environment,environment notin (frontend)' 在API对象中设置引⽤ ⼀些Kubernetes对象（如 services 和 replicationcontrollers ）也可使⽤Label选择器来指定其他资源（例如 pods ）。 Service 和 ReplicationController 使⽤Label选择器定义 authentication and/or authorization 来保护kubelet API。 12-Master与Node的通信 34 apiserver -> nodes, pods, and services 从apiserver到Node、Pod或Service的连接默认为纯HTTP连接，因此不会被认证或加密。可通过将 https: 前缀添加到 到API URL中的Node、Pod、Ser

metadata: name: traefik-ingress-controller rules: - apiGroups: [""] resources: ["services","endpoints","secrets"] verbs: ["get","list","watch"] - apiGroups: ["extensions"] - web routes: - match: Host(`traefik-dashboard.xxx.com`) kind: Rule services: - name: traefik port: 8080 kubectl apply -f 6-dashboard.yaml Step7: - websecure routes: - match: Host(`k8s-dashboard.xxx.com`) kind: Rule services: - name: kubernetes-dashboard port: 443 tls: secretName: k8s-dashboard-tls

the Future Michael Chen VMware 4 Developer • Hello World! • Containerize Applications • Micro Services Applications • Scalable Kubernetes Applications • Scalable Infrastructure for Applications of multiple containers – Docker, Mesos à Kubernetes Support – AWS, Azure, Google à Kubernetes Services $docker run container1 $docker run container2 $docker run container3 $docker run container4 101 at the Highest Level • Container Cluster = “Desired State Management” – Kubernetes Cluster Services (w/API) • Node = Container Host w/agent called “Kubelet” • Application Deployment File = Configuration

latest Kubernetes releases that have been validated and tested by Google ● Access to Container services on GCP such as Cloud Build, Container Registry, Audit Logging, and more. ● Integration with Istio on-prem containers just like GKE in the cloud Consistent operating model with access to GCP services across hybrid environments Single-pane-of-glass for multiple Kubernetes clusters, no matter of Glass Market- place & Service- Catalog Container Registry & Builder Stackdriver GCP Services Securing Your Connection to GCP ● GKE Connect Agent installs in your cluster ● Encrypted connection

record: pod1.clusterdomain pod2.clusterdomain ... Service�Endpoints�� Service ���� API Server Services etcd Pods Endpoints Controller Manager Node Node … Load Balancer Endpoints Controller Iptables��Service���� ��iptables������� IPVS��Service���� Iptables vs. IPVS Iptables�������� • �B������ KUBE-SERVICES������KUBE-SVC-*������service��������� ��������O(N) • �B���� ���� • ���� �������iptables�������/�������kernel to use the -w option? • ��� ��������������������������� Iptables������ ��������k�service�kube-services��1�chain ��Iptables����� • ����ON� Ø ����������)���(�-�������(�-���-������� Ø �������������������(�-���

• Technical Director of TKEx Platform , a Tencent internal Kubernetes platform for Tencent’s services • https://cloud.tencent.com/developer/column/2436 Introduction Challenges with Kubernetes Ø isolation of resources, and improve resource utilization using hybrid deployment of online and offline services. • Support Service Mesh. • Large-scale and high-performance autoscaling capabilities. • Multi-tenant Kubernetes Service) TKE (Tencent Kubernetes Engine) TKEx AI Training Jobs Big Data Jobs Online Services NodeProblemDetector Dynamic Scheduler DynamicQuotaManager MultiClusterManager De-Scheduler

Server Business Logic A Business Logic A File Server Business Logic A Business Logic A Cache 需要多少 Services, Deployments, StatefulSets DaemonSets, CronJobs? 容器编排的困境 Kubernetes 为我们带来了什么？ 1. 提供了多种多样的基础 缺乏统一的依赖管理机制，需要用户自行解决依赖关系 3. 极简的部署方式也给用户带来了新的负担 应用编排架构 应用单元 应用是什么？ = + + 应用 Services Pods Volumes 应用编排架构 应用单元 基于 Kubernetes 的应用单元 Services Volumes + Deployment StatefulSet DaemonSet Job CronJob = 无状态应用 有状态应用

I have many Pod replicas Service I want to proxy my Pod replicas Ingress I want to expose my Services DaemonSet I run as daemon StatefulSet I am stateful Job I only run for once CronJob I run I have many Pod replicas Service I want to proxy my Pod replicas Ingress I want to expose my Services DaemonSet I run as daemon StatefulSet I am stateful Job I only run for once CronJob I run • well-designed architecture for your container workloads • “How can I build distributed micro-services with container?” Programming Pattern • Sidecar apiVersion: v1 kind: Pod metadata: name: test-app

application as a suite of small services, each running in its own process and communicating with lightweight mechanisms, often an HTTP resource API. These services are built around business capabilities fully automated deployment machinery. There is a bare minimum of centralized management of these services, which may be written in different programming languages and use different data storage technologies