Kailun Qin, Ant Group Putting an Invisible Shield on Kubernetes Secrets Agenda • K8s Secrets: Overview • TEE-based K8s Secrets Protection: Solution • Production Experience @ Ant Group • Demo • Summary Introducing mutual (remote / local) attestations between entities Production Experience @ Ant Group KMS Plugin • Workflow • Encryption • Decryption • Engineering decisions • apiserver is responsible

https://badoo.com/ 26 / 97 ClickHouse in Production: Badoo HTTP Server Aggregation Services HDFS Storage MR Aggregation Old Events Pusher Events Storage Old Events Database PHP API Client Graphs Browser Mobile App 27 / 97 ClickHouse in Production: Badoo HTTP Server Aggregation Services HDFS Storage MR Aggregation Old Events Pusher Events Storage Old Events Database PHP API Client Graphs Browser Mobile App 28 / 97 ClickHouse in Production: Badoo HTTP Server Aggregation Services HDFS Storage MR Aggregation Old Events Pusher Events Storage Old Events Database PHP API Client Graphs

Series, DataFrame, etc. automatically align the data for you in computations • Powerful, flexible group by functionality to perform split-apply-combine operations on data sets, for both ag- gregating and Grouping By group by we are referring to a process involving one or more of the following steps: • Splitting the data into groups based on some criteria • Applying a function to each group independently Tablewise Function Application: pipe() 2. Row or Column-wise Function Application: apply() 3. Aggregation API: agg() and transform() 4. Applying Elementwise Functions: applymap() Tablewise function application

another way of expressing the same User.select({ User: ['*'], Tweet: [Count('id', 'count')] }).group_by('id').join(Tweet).order_by(('count', 'desc')) # do an atomic update TweetCount.update(count=F('count') SELECT "id", "creator", "name" FROM "blog" WHERE "id" = ? LIMIT 1 PARAMS: [1] To delete an arbitrary group of records, you can issue a DELETE query. The following will delete all Entry objects that are a year equivalent to the following: query = Blog.select({ Blog: ['*'], Entry: [Count('id')], }).group_by(Blog).join(Entry) The resulting query will return Blog objects with all their normal attributes

# another way of expressing the same User.select({ User: [’*’], Tweet: [Count(’id’, ’count’)] }).group_by(’id’).join(Tweet).order_by((’count’, ’desc’)) # do an atomic update TweetCount.update(count=F(’count’) SELECT "id", "creator", "name" FROM "blog" WHERE "id" = ? LIMIT 1 PARAMS: [1] To delete an arbitrary group of records, you can issue a DELETE query. The following will delete all Entry objects that are a year This is equivalent to the following: query = Blog.select({ Blog: [’*’], Entry: [Count(’id’)], }).group_by(Blog).join(Entry) The resulting query will return Blog objects with all their normal attributes

. . . . . . . . . . . . . . . . . . . . . . 295 7.9 In SQLSever and PostgreSQL, why does the aggregation column without alias throw ex‐ ception? . . . . . . . . . . . . . . . . . . . . . . . . . . . name after sharding, or misconducts caused by operations such as pagination, order by or aggregated group by are just the case in point. 3.1. Sharding 10 Apache ShardingSphere document, v5.0.0-beta Cross‐database extract the parsing context, which can include tables, options, ordering items, grouping items, aggregation functions, pagination information, query conditions and placeholders that may be revised. Query

another way of expressing the same User.select({ User: ['*'], Tweet: [Count('id', 'count')] }).group_by('id').join(Tweet).order_by(('count', 'desc')) # do an atomic update TweetCount.update(count=F('count') "id", "creator", "name" FROM "blog" WHERE "id" = ? LIMIT 1 PARAMS: [1] To delete an arbitrary group of records, you can issue a DELETE query. The following will delete all Entry objects that are a year equivalent to the following: query = Blog.select({ Blog: ['*'], Entry: [Count('id')], }).group_by(Blog).join(Entry) The resulting query will return Blog objects with all their normal attributes

# another way of expressing the same User.select({ User: [’*’], Tweet: [Count(’id’, ’count’)] }).group_by(’id’).join(Tweet).order_by((’count’, ’desc’)) # do an atomic update TweetCount.update(count=F(’count’) SELECT "id", "creator", "name" FROM "blog" WHERE "id" = ? LIMIT 1 PARAMS: [1] To delete an arbitrary group of records, you can issue a DELETE query. The following will delete all Entry objects that are a year This is equivalent to the following: query = Blog.select({ Blog: [’*’], Entry: [Count(’id’)], }).group_by(Blog).join(Entry) The resulting query will return Blog objects with all their normal attributes

. . . . . . . . . . . . . . . . . . . . . . 257 Group‐by Merger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259 Aggregation Merger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 308 7.7.20 20. [Other] In SQLSever and PostgreSQL, why does the aggregation column with‐ out alias throw exception? . . . . . . . . . . . . . . . . . . . . . . . . . . . t_order CHECK TABLE t_order SET RESOURCE GROUP group_name DROP RESOURCE GROUP group_name CREATE RESOURCE GROUP group_name TYPE = SYSTEM ALTER RESOURCE GROUP rg1 VCPU = 0‐63 4.1. DB Compatibility 19

. . . . . . . . . . . . . . . . . . . . . . 267 Group‐by Merger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269 Aggregation Merger . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 7.8.23 [Other] In SQLSever and PostgreSQL, why does the aggregation column without alias throw exception? . . . . . . . . . . . . . . . . . . . . . . . . . . . . t_order CHECK TABLE t_order SET RESOURCE GROUP group_name DROP RESOURCE GROUP group_name CREATE RESOURCE GROUP group_name TYPE = SYSTEM ALTER RESOURCE GROUP rg1 VCPU = 0‐63 openGauss The unsupported