Kubernetes for Edge Computing across Inter-Continental Haier Production Sites Jiyuan Tang & Xin Zhang zhangxin@caicloud.io tangjiyuan@caicloud.io 关于我们 • 开源技术创新者 • 从 Kubernetes 到 Kubeflow • Google

00a714f1a60d680c1ad8，即：将 Calico降级到3.1.3。 参考⽂档： Kubespray – 10 Simple Steps for Installing a Production-Ready, Multi-Master HA Kubernetes Cluster：https://dzone.com/articles/kubespray-10-simple-step local ，这意味着如果容器只使⽤ ，则它将解析为Namespace本地的服务。 这对在 多个Namespace（例如Development、Staging以及Production）中使⽤相同的配置的场景⾮常有⽤。 如果要跨越 Namespace，请使⽤完全限定域名（FQDN）。 译者按：FQDN是fully qualified domain name的缩写，即：完全限定域名 示例Label： "release" : "stable" , "release" : "canary" "environment" : "dev" , "environment" : "qa" , "environment" : "production" "tier" : "frontend" , "tier" : "backend" , "tier" : "cache"

Kubernetes Secrets Agenda • K8s Secrets: Overview • TEE-based K8s Secrets Protection: Solution • Production Experience @ Ant Group • Demo • Summary & Plan K8s Secrets: Overview Background: K8s Secrets Financial TEE-based Secrets Protection: Solution Confidential Computing A Trusted Execution Environment (TEE) is • a secure area protected by the processor (aka. Enclave) Example: Intel SGX • Strong decryption of DEKs / Secrets • Introducing mutual (remote / local) attestations between entities Production Experience @ Ant Group KMS Plugin • Workflow • Encryption • Decryption • Engineering decisions

development and operations ● Automating everything ● Been handling Kubernetes clusters in production for 2 years Jan-Erik Revsbech CTO Key Qualifications ● 20+ year of experience in web-development good performance with GoLang Scaling and orchestration Containerized development and production environment Cloud orchestration with Kubernetes Hosted on AWS Deployment, CI and CD Local development

Foundation) Kubernetes offering. K3s is a super-lightweight Kubernetes distribution, designed for production workloads in unat- tended, resource constrained, remote envi- ronments. This is the story of how time and performing analysis at the point of collection. Whether it’s a camera scanning the environment or biometrics that are tracking the state of an individual’s health, all these sensors capture which data was passed via an operations center, by which time the target may have moved or the environment altered. Outcomes have been transformed as a result. What’s Next For the team, the priority

Docker context generate Extended Configuration JVM flags credentials labels environment variables extra files ... github.com/GoogleContainerTools/jib Demo $ git clone container configuration Tarball A Tarball B Tarball C /bin /usr /tmp /var /jdk /app.jar Environment variables, entrypoint, etc. Container configuration github.com/GoogleContainerTools/jib { Tarball C /bin /usr /tmp /var /jdk /app.jar Tarballs A, B, C, and the configuration Manifest Environment variables, entrypoint, etc. Container configuration github.com/GoogleContainerTools/jib {

1(Kubernetes) Background: Cluster Scale • Production environment: • Dozens of Cluster • 5k+ Nodes / Cluster • 10k+ Nodes / largest Cluster • Testing environment • Hundreds of Cluster for CI/CD • 500+

标签选择器可以类比SQL语句中的where查询条件，例如name=redis-salve 表示只查询名字为redis-salve的资源对 象。 env != production: 匹配所以不具有标签 env = production 的资源对象 name in（redis-master，redis-salve）：匹配所有带有标签name=master或者name=salve的资源 name not

Staging Job IT Test Staing Job Merge Preview Branch Step2 Deploy Preview Job Merge Production Branch Branch preview change 流量镜像 一键压测  接入层（TCPCopy）  支持流量放大、缩小  一键批处理压测 服务网格

• Containers • CI/CD • Autoscaling • A/B testing and canary release of Models • Comparing Production accuracy vs expected accuracy when possible • Rolling-updates • … Resources • Source code