DevOps Solution • Architecture and Features • CRD and operator design • Pipeline / Stage/ Task / Task Template / Version Control • Logging, monitoring, autoscaling, high availability • Extensibility or persisted [] Resources - Resource requirement ActiveDeadlineSeconds Timeout of build task Lifecycle - Actions defined for postStart/preStop Kubernetes Capabilities/Advantages the running build tasks, default: 12 hours backoffLimit Maximum retry count before mark the build task as failed, default: 6 ttlSecondsAfterFinished Time to clean up finished build tasks after if finishes

Job preemption p Fair-share scheduling p Queue scheduling p Resource reservation p Binpack p Task topology p Zone aware scheduling p … Volcano: A Kubernetes native batch system Gaps for spark Pod metadata: annotations: scheduling.k8s.io/group-name: job-1574739729783- podgroup volcano.sh/task-spec: spark-driver createTimestamp: “2019-11-27T09:33:19Z” labels: spark-app-selector:spark- 6 share via DRF Namespace faire share namespace1 namespace2 Solution: resource fair-share Solution: Task-topology + Binpack Node1 Driver Driver Node2 Executor Executor Executor Node3 Executor Executor

� ����� � ������ ������������ ��������������������������� ������������ pod pod pod pod pod task task task kubelet agent YARN-NM Apiserver Scheduler Co-location YARN-RM NODE Online service Console

controller provides declarative updates for Pods and ReplicaSets. • Stands for a long running task, can be exposed as K8s services • In OpenWhisk, usually, we deploy those core components’ dependencies ensures that a specified number of them successfully terminate. • Job stands for a short running task • In OpenWhisk, we used to deploy package installation and tasks like catalog installation as

可访问 可复制 长久运行 Server √ √ √ Singleton Server √ × √ Worker × √ √ Singleton Worker × × √ Task × √ × Singleton Task × × × apiVersion: core.oam.dev/v1alpha1 kind: Component metadata: name: nginx annotations:

支持集群多维度异常检测能力 支持集成开源检测组件 检测框架 Ver.1 { 自动化 Ver.1 自动化 Autopilot Engine Command Policy Executor Task Node Node Node Global Job Custom Job Node Script Image 1. 根据集群类型、版本、场景生成检测策略 2. 根据策略执行检测任务 机语言 • 目标受众为非程序员、业务员或最终客户 典型的 DSL • 正则表达式 Ver.2 动态化 Dynamic Engine Command Policy Executor Task Node Node Node Global Job Custom Job Node Script Image Report Builder Report Executor Autopilot

approach to enhance container isolation gVisor is special Machine-level virtualization Rule-based execution gVisor Technology landscape DEMO

Chen, Ant Financial TEE-based Secrets Protection: Solution Confidential Computing A Trusted Execution Environment (TEE) is • a secure area protected by the processor (aka. Enclave) Example: Intel

Control Plane Node GKE On-Prem Node Control Plane Node Hybrid Use Cases Legacy Software Local Execution Edge / IoT Cloud bursting Ecommerce site Catalog, ERP Warehouse Factory Branch Augmented Services

- name: task-pv-storage mountPath: /usr/share/nginx/html 17-StatefulSet 71 volumes: - name: task-pv-storage persistentVolumeClaim: claimName: task-pv-claim