Building a Secure and Maintainable PaaS Leveraging eBPF to Scale Security and Improve Platform Support Bradley Whitfield October 28, 2020 2 Dragon - Internal Platform as a Service TIP: To change

CI/CD 流水线 K8s PaaS K8s 但是，K8s PaaS 正面临着“能力困境” 研发与运维人员日益增长的应用管理诉求 PaaS 有限的、不可扩展的专有API 与能力 K8s 生态“无限”的应用基础设施能力 而且，PaaS 还面临着严重分化 PaaS A Kubernetes PaaS B PaaS C 研发效率 学习成本 同一个公司内数个 PaaS on Kubernetes 个内部 PaaS/Serverless • 烟囱化：互相之间完全独立， 没有可互操作性 • 用户不友好：大量基础设施层 语义泄露 • 封闭：不能利用 K8s 生态能力 Gateway Route Traffic Rollout Job Infra Ops Developers Operators Deployme nt Route Service Job PaaS A PaaS PaaS B Serverless C 案例：过去的阿里巴巴应用管理平台 Traits/Scopes Scale: - 10,000 nodes/cluster - 100,000 apps/cluster - 1,000,000 containers/cluster Applications: - 100,000 deploys/day - 500~1000 replicas/app

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 43. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform-as-a-service) providers. These providers tend to require that you `bring your own container'; Spring Boot Reference Guide 1.1.7.RELEASE Spring Boot 100 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform-as-a-service) providers. These providers tend to require that you `bring your own container'; Heroku. Spring Boot Reference Guide 0.0.9.M1 Spring Boot 98 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform-as-a-service) providers. These providers tend to require that you `bring your own container'; Spring Boot Reference Guide 0.0.9.RELEASE Spring Boot 98 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to