Building a Secure and Maintainable PaaS Leveraging eBPF to Scale Security and Improve Platform Support Bradley Whitfield October 28, 2020 2 Dragon - Internal Platform as a Service TIP: To change

API 对象 基础设施层能力 业务运维 平台工程师 业务研发 扩容策略 发布策略 分批策略 访问控制 流量配置 应用管理平台 （Openshift、Cloudfoundry、阿里内部、腾讯内部 …） 应用 CI/CD 流水线 K8s PaaS K8s 但是，K8s PaaS 正面临着“能力困境” 研发与运维人员日益增长的应用管理诉求 PaaS 有限的、不可扩展的专有API 与能力 与能力 K8s 生态“无限”的应用基础设施能力 而且，PaaS 还面临着严重分化 PaaS A Kubernetes PaaS B PaaS C 研发效率 学习成本 同一个公司内数个 PaaS on Kubernetes 思考： 1. 基于 Kubernetes 2. 用户友好、高可扩展 3. 统一、标准化 理想中的应用管理平台 目标一：一个面向用户，应用为中心 CI/CD 流水线 Pod Deployment Service Node Custom Resource 业务运维 业务研发 按需绑定 关键词：用户友好，应用层语义和抽象 平台工程师 Controller 目标二：一个高可扩展的应用管理平台 关键词：可插拔，可扩展，模块化，没有抽象程度锁定 应用 Deployment Knative Service Function 抽象程度：高 抽象程度：低

打通业务与数据、从数字化到智能化转 型 • Clever: 基于容器的 AI PaaS 平台（AI Devops、资 源管理任务调度） 工业互联网平台 - 制造业大势所趋 • 全球工业互联网平台数量 > 150 国家 研究内容 代表成果 政策扶持 工业互联网综合平台，采用数据流打通与 数据分析衍生价值的结构 Predix平台 GE联合AT&T, CISCO, IBM, INTEL等企业组建工业互联网 面的系统集成和数据融合，打破数据孤岛 Mindsphere平台 德国联邦政府支持相关行业协会建设工业4.0平台，负 责工业4.0国家战略的宣传推广，标准制定，人才培养 和技术研发。 以工业大数据为驱动，以云计算，大数据， 物联网技术为核心的工业互联网开放平台， 实现产品，机器，数据，人的全面互联互 通和综合集成 INDICS平台 根云平台 COSMOPlat平台 … 2017年11月，国务院印发了《关于深化“互联网+先进 2017年11月，国务院印发了《关于深化“互联网+先进 制造业”发展 工业互联网的指导意见》(以下简称: 《指导意见》)，明确将打造平台 体系作为七大任务之 一，提出构建工业互联网标准体系，实施标准研制及 试验验证工程。 • GE 波音 罗克韦尔 IBM INTEL CISCO 微软 AT&T PTC HP DELL EMC • SAP 博士 SIEMENS ABB 英飞凌 • 海尔 三一 航天科工 徐工 美的 华为 阿里云 •

允许非集群管理员安装 OPERATOR 4.9. 管理自定义目录 4.10. 在受限网络中使用 OPERATOR LIFECYCLE MANAGER 4.11. 目录源 POD 调度 4.12. 管理平台 OPERATOR （技术预览） 4.13. TROUBLESHOOTING OPERATOR 的问题 第 第 5 章 章 开 开发 发 OPERATOR 5.1. 关于 OPERATOR SDK OPERATOR 5.12. 验证 OPERATOR 捆绑包 5.13. 高可用性或单节点集群检测和支持 5.14. 使用 PROMETHEUS 配置内置监控 5.15. 配置领导选举机制 5.16. 为多平台支持配置 OPERATOR 项目 5.17. 基于 GO 的 OPERATOR 的对象修剪工具 4 4 4 5 6 6 7 23 25 64 66 68 70 79 79 80 90 处理、负载均衡、服务发现、自动扩展。 为什么使用 什么使用 Kubernetes API 和 和 kubectl 工具来管理您的 工具来管理您的应用程序？ 用程序？ 这些 API 功能丰富，所有平台均有对应的客户端，并可插入到集群的访问控制/审核中。Operator 会 使用 Kubernetes 的扩展机制“自定义资源定义 (CRD)”支持您的自定义对象，如 MongoDB，它类似于 内置的原生

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 43. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform-as-a-service) providers. These providers tend to require that you `bring your own container'; Spring Boot Reference Guide 1.1.7.RELEASE Spring Boot 100 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform- as-a-service) providers. These providers tend to require that you `bring your own container'; DataSource; it also lets you use Spring Cloud with Heroku. Chapter 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform-as-a-service) providers. These providers tend to require that you `bring your own container'; Heroku. Spring Boot Reference Guide 0.0.9.M1 Spring Boot 98 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to

Part VI. Deploying to the cloud Spring Boot’s executable jars are ready-made for most popular cloud PaaS (platform-as-a-service) providers. These providers tend to require that you `bring your own container'; Spring Boot Reference Guide 0.0.9.RELEASE Spring Boot 98 45. Heroku Heroku is another popular PaaS platform. To customize Heroku builds, you provide a Procfile, which provides the incantation required which then uses it when it starts up. The $PORT environment variable is assigned to us by the Heroku PaaS. Heroku by default will use Java 1.6. This is fine as long as your Maven or Gradle build is set to