Intro: SIG VMware what is the SIG and what’s going on right now Steve Wong, Fabio Rapposelli Co-chairs VMware SIG Engineers VMware Cloud Native Applications Business Unit December 11, 2018 2 Open Community Relations Engineer VMware Active in Kubernetes storage community since 2015. Chair of Kubernetes VMware SIG. GitHub: @cantbewong Staff Software Engineer VMware Fabio is responsible for many Vagrant, Docker, Kubernetes and VMware. Chair of Kubernetes VMware SIG. GitHub: @frapposelli Steve Wong Fabio Rapposelli Presenter Bios 3 Abstract Join the SIG VMware introduction session to learn

VMware SIG Deep Dive into Kubernetes Scheduling Performance and high availability options for vSphere Steve Wong, Hui Luo VMware Cloud Native Applications Business Unit November 12, 2018 2 Open Source Community Relations Engineer VMware Active in Kubernetes storage community since 2015. Chair of Kubernetes VMware SIG. GitHub: @cantbewong Software Engineer VMware First open source project was was to enable GPU on Kubernetes with vSphere. Also actively contributing to kubelet, device manager, device plugin area. GitHub: @figo Steve Wong Hui Luo Presenter Bios 3 Abstract ​Kubernetes allows

VMware SIG Deep Dive into Kubernetes Scheduling Performance and high availability options for vSphere Steve Wong, Michael Gasch KubeCon North America December 13, 2018 2 Open Source Community Relations Relations Engineer VMware Active in Kubernetes storage community since 2015. Chair of Kubernetes VMware SIG. GitHub: @cantbewong Application Platform Architect VMware Supports enterprises with architectural architectural guidance, and works closely with VMware R&D, and member of CTO Ambassador staff. GitHub: @embano1 Steve Wong Michael Gasch Presenter Bios 3 Abstract Kubernetes allows using topology

Kubernetes – Software Platform for the Future Michael Chen VMware 4 Developer • Hello World! • Containerize Applications • Micro Services Applications • Scalable Kubernetes Applications • Scalable multiple OS on the same hardware Application Operating System Physical Infrastructure Containers VMware Hypervisor VMs Docker Containers User Cases 9 •Ready-to-go development •Self-service portal in VM App packaged in Container Platform Evolution 11 Confidential │ ©2018 VMware, Inc. 11 Confidential │ ©2018 VMware, Inc. The “App” Docker and Kubernetes Kubernetes Orchestrating Multiple Containers

Kubernetes支援Ceph、NFS、雲端儲存、NetApp、vSphere、 FlexVolume及PureStorage. • Red Hat Openshift支援Ceph/Rook、Red Hat OpenShift Data Foundation、 GlusterFS、NFS、Cinder及Flexvolume • SUSERancher支援GlusterFS、NFS、vSphere及Longhorn 12. 監控及作業管理 Services(AWS)、Google Cloud Platform(GCP)及 Microsoft Azure。 15.原生Openstack/VMware整合 至於在私有雲方面，三種Kubernetes發行版本均能與OpenStack及 VMware原生整合。 16.裸機部署及自動化 並非所有工作負載都適合虛擬化，而企業有時需要直接在裸機伺服器部署 Kubernetes。雖然這三種發行版本 邊緣支援 單節點版本 – 託管Kubernetes方案 – 容器執行階段即登錄檔 聯網 儲存 監控及作業管理 多元部署 原生AWS/GCP/Azure 整合 原生Openstack/VMware 整合 裸機部署及自動化 GPGPU支援加速工作負載 安全性 支援的架構 價格 $ $$$$$ $$$ Canonical RedHat Rancher 9 摘要 Canonical

©2019 VMware, Inc. 1 ©2019 VMware, Inc. 唐資生 Jason Tang, VMware 資深架構師 Kubernetes安全求生指南 ©2019 VMware, Inc. 2  您的Kubernetes環境夠安全嗎?  Kubernetes安全最佳實務  VMware Enterprise PKS平台如何實踐K8s與容器的安全強化 PKS平台如何實踐K8s與容器的安全強化  最困難的部分其實是....  總結 本日議程 3 ©2019 VMware, Inc. 您的Kubernetes環境夠安全嗎? ©2019 VMware, Inc. 4 ​整個Kubernetes運作環境是相當不安全的....  原生Kubernetes在安全設計上就有許多改善空間  公版Kubernetes許多預設值是不適當的  關於網路層級的安全實際上還有許多地方並未涵蓋  設計上並不特別考慮企業多團隊/多應用的分工與隔離  有非常多層次例如: 容器/映像/作業系統/基礎架構也須涵蓋 您知道嗎? ©2019 VMware, Inc. 5 ​但是....  您知道所謂 “安全”的“標準”是什麼?  這些“標準”涵蓋範圍夠嗎? 足夠讓我們安心推上生產嗎?  我們具體該怎麼做來強化安全?

KubeOperator 的整体架构 KubeOperator NFS / vSAN / Ceph 等 Flannel / Calico / NSX-T 等 负载均衡 / CoreDNS 等 物理理机 / vSphere / OpenStack / FusionCompute 等 Ansible / Terraform CentOS / RHEL / EulerOS 集群规划 集群部署 集群运维 集群升级 物理理机；vSphere 平台：⽀支持⾃自动创建主机（使⽤用 Terraform）；OpenStack 平台：⽀支持⾃自动创建主机 （使⽤用 Terraform）； FusionCompute 平台：⽀支持⾃自动创建主机 （使⽤用 Terraform）； 存储⽅方案 独⽴立主机：⽀支持 NFS / Ceph RBD / Rook Ceph / Local Volume；vSphere 平台：⽀支持 平台：⽀支持 vSphere Datastore （vSAN 及 vSphere 兼容的集中存储）；OpenStack 平台：⽀支持 OpenStack Cinder （Ceph 及 Cinder 兼容的集中存储）；FusionCompute 平台：⽀支持 OceanStor； ⽹网络⽅方案 ⽀支持 CoreDNS；⽀支持 Flannel / Calico ⽹网络插件；⽀支持 ingress-nginx

for multiple Kubernetes clusters, no matter where Single Pane of Glass across GCP & On-Prem ● vSphere 6.5 for Alpha ● Simple CLI installation ● Online and Offline installation ● Private container registry be saved? [/Users/karangoel/my-test-cluster/]: Where do you want to install your cluster? [1] vSphere v6.5 Please enter your numeric choice [1]: 1 What version of GKE On-Prem do you want to install 1.9.2) [3] 1.8.3 (Uses K8s 1.8.3) Please enter your numeric choice [1]: 1 Pulling gke-on-prem-vsphere-1.10.3... DONE Path to kubeconfig for the GKE On-Prem Admin Control Plane (leave empty to create

数据盘：80GB 3 台作为 k8s node CPU：2 核, 内存：16GB, 系统盘：40GB, docker 数据盘：40GB, ceph 数据盘：1TB *下面是 vSphere 上创建虚拟机的步骤： A1. 创建 k8s-master CPU：2 核, 内存：8GB，系统盘：40GB，docker 数据盘：80GB step1. 从模板上新建虚拟机

使用Kubernetes部署超级账本Fabric 张海宁（Henry Zhang) VMware中国研发现先进技术中心技术总监 SACC2017 自我介绍 • VMware中国研发先进技术中心首席架构师、技术总监 • Harbor开源企业级容器Registry项目创始人 • Cloud Foundry中国社区最早技术布道师之一 • Hyperledger Cello项目贡献者