Containers and BPF: twagent story Andrey Ignatov, Facebook October 28, 2020 1 ● a daemon ● runs on every Facebook server ● manages all Facebook containers ● a part of the bigger TW system, see the Should affect only task state, not host ● Rules auto-cleanup on task stop is important ● Has to be integrated with service discovery, etc Solution: ● Use BPF_CGROUP_INET_{EGRESS,INGRESS} ● If use-case allows drop, log (via perf buffer) ● Filter by local/remote IP, IP prefix, port, protocol, TCP flags ● Integrated with service discovery: can filter by service name (dynamic set of IP:port endpoints) Container

培训服务介绍 VMware vSphere：优化和扩展 培训方式  讲师指导培训  实时在线培训 课程用时  为期五 (5) 天的讲师指导课堂培训  听课时间占 60%，动手实验时间占 40% 目标学员 经验丰富的系统管理员和系统集成人员 课程适用对象 ☒ 管理员 ☐ 专家 ☒ 工程师 ☒ 高级用户 ☐ 架构师 ☐ 专业人员 专业人员 ☐ 初级用户 先决条件 修完以下其中一门课程：  VMware vSphere: Install, Configure, Manage [V5]  VMware vSphere: What’s New [V5]  VMware vSphere: Fast Track [V5] 或者具备同等的 ESX/ESXi 和 vCenter Server 知识及管理经验 VMware vSphere® 个人用户，讲授 有关配置和维护高度可用、高度可扩展的虚拟基础架构的高级技 能。本课程基于 VMware vSphere® ESXi™ 5.0 和 VMware® vCenter Server™ 5.0 讲授。 课程目标 课程结束后，您应能胜任以下工作：  配置和管理大型成熟企业的 ESXi 网络和存储系统。  管理 vSphere 环境变更。

A Multithreaded, Transaction-Based Locking Strategy for Containers Bob Steagall CppCon 2020 K E W B C O M P U T I N GCopyright © 2020 Bob Steagall K E W B C O M P U T I N G Overview • Sharing a container STO-based solution • Summary CppCon 2020 - A Multi-threaded, Transaction-Based Locking Strategy for Containers 2Copyright © 2020 Bob Steagall K E W B C O M P U T I N G Sharing a Container • Sometimes a container is easier (?) than ever CppCon 2020 - A Multi-threaded, Transaction-Based Locking Strategy for Containers 3Copyright © 2020 Bob Steagall K E W B C O M P U T I N G Sharing a Container – Avoiding Race Conditions

What is the VMware SIG Purpose, Projects managed, How to join The Roadmap Moving “Out of Tree” : vSphere cloud provider + storage (CSI) How to Get Information on an ongoing basis The VMware SIG How to related to new CRDs, plug-ins and KEPs that allow the vSphere platform to supplement and support Kubernetes How to Join 6 SIG Sponsored projects vSphere cloud provider (In-tree and Out-of-tree) • A cloud Kubernetes project of this dependency, the cloud-controller-manager was introduced. CSI provider for vSphere • Container Storage Interface (CSI) is a standard API allowing a storage provider to write just

Platform 4.6 在 vSphere 上安装 安装 OpenShift Container Platform vSphere 集群 Last Updated: 2023-02-27 OpenShift Container Platform 4.6 在 vSphere 上安装 安装 OpenShift Container Platform vSphere 集群 Enter your 法律通告 法律通告 Copyright © 2022 | You need to change the HOLDER entity in the en- US/Installing_on_vSphere.ent file |. The text of and illustrations in this document are licensed by Red Hat under a Creative community. All other trademarks are the property of their respective owners. 摘要 摘要 本文档提供在 VMware vSphere 上安装和卸载 OpenShift Container Platform 集群的说明。 . . . . . . . . . . . . . . . . . . . . . . . . . .

VMware SIG Deep Dive into Kubernetes Scheduling Performance and high availability options for vSphere Steve Wong, Hui Luo VMware Cloud Native Applications Business Unit November 12, 2018 2 Open @cantbewong Software Engineer VMware First open source project was to enable GPU on Kubernetes with vSphere. Also actively contributing to kubelet, device manager, device plugin area. GitHub: @figo Steve zones, while still respecting resource access and availability concerns. When Kubernetes runs on vSphere, the hypervisor platform also supports an underlying tier of high availability and automated placement

VKE VIC Beta 5 ©2018 VMware, Inc. vSphere Integrated Containers (VIC) 6 ©2018 VMware, Inc. vSphere Integrated Containers – Enabling the Best of Both Worlds vSphere Integrated Containers Docker registry Familiarity of vSphere No new tooling or technologies Full enterprise-grade power of Software-Defined Data Center 7 ©2018 VMware, Inc. vSphere vSphere Integrated Containers Approach VM Linux Monitoring, Healing and Lifecycle Management Scheduling, Orchestration, Service Creation vSAN vSphere Physical Infrastructure vRealize Suite NSX-T BOSH (K8s LCM) BOSH (cluster LCM) Kubernetes

集成Harbor 4 总结 议程 Harbor开源项目 11 • 开源企业级容器镜像仓库 • 由 VMware 中国团队设计和开发 • 集成到多个企业级产品中:VIC和PKS • Apache 2 使用许可 • https://github.com/vmware/harbor/ Harbor社区的增长 用户和开发者情况 4200+ 星标 镜像分发 审计和日志 记录操作日志以便审计 Restful API 完善的API以支持集成 主要特性 高可用性 高可用性支持 ova@vSphere ova的虚拟机，直接部署在 vSphere上 图形化管理界面 基于开源UI库Clarity构建 提供完备的镜像管理运维能力 增加批处理操作 为镜像库添加描述信息 Harbor 架构 17 Harbor与VIC 27 虚拟容器主机 Docker 容器主机 部署/调度 物理基础架构 C Docker 引擎 Linux 内核 C C Linux 内 核 C Linux 内 核 C Linux 内 核 C Linux 内 核 C C 管理/镜像Registry 安全性 VIC 服务引擎 存储虚拟化

multi-cloud stacks, enterprises are creating new opportunities to unify their IT operations with containers and Kubernetes. The recent Forrester Wave report1 stated that these cloud native technologies organizations to build and modernize their applications and services at scale. The potential of containers and Kubernetes was evident when, in 2020, Gartner2 predicted that more than 75% of worldwide Tanzu product suite that differentiated itself by leveraging Project Pacific, a re-architecture of vSphere with Kubernetes as its control plane. While there are other smaller players in the market, the

Security 5 Image Distribution 6 High Availability of Registry Lifecycle of Containers and Images 5 Images Containers Stop Start Restart Run Commit Dockerfile Build tag tar archive Save Load registry server. • Initiated by VMware China, adopted by users worldwide. • Integrated into vSphere Integrated Containers. • Apache 2 license. • https://github.com/vmware/harbor/ 8 Key Features • Dev/test env – many people can access – Production – a limited number of people can access • Can be integrated with internal user management system – LDAP/Active Directory 19 Example: Role Based Access Control