►
From YouTube: From Mesos to Kubernetes - Yin Sun, Xiaomi Inc.
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
From Mesos to Kubernetes - Yin Sun, Xiaomi Inc.
Our team use Mesos for three years. Now we choose Kubernetes instead of Mesos. There are some tips to help the others like us to use Kubernetes. Nine topics for this speech: Background, Container Network, ELB, Login & Audit, Security, Monitor, Log, Stateful Service Package and The Future. All of our architectures and solutions are designed as decoupling systems, so we can use the same way to adapt every orchestration system. We solve the problem of network performance in our own way. We support kinds of packages, tools, plugins to help user to deploy jobs, and at the same time we support monitor and log collection. So, how the parts of system work together? To help better the ecosystem, we will share what we meet and how we slove these problems.
To learn more click here: https://sched.co/FuKm
A
Good
afternoon,
everyone,
my
name-
is
Sun
yang
from
Xiaomi,
so
today,
I'm
going
to
talk
about
from
messes
to
you,
kubernetes,
actually
actually
the
main
content
of
my
speech
today.
So
maybe
it's
actually
not
like
related
to
you
masses
of
kubernetes,
because
most
of
my
content
will
be
more
about
the
container
based
architect
and
how
shall
we
built
our
architect
and
how
shall
we
build
the
frameworks
of
our
architect
and
also
the
credibility
of
our
architects?
A
A
In
the
future,
so
all
the
infrastructure
here
that
the
thing
that
we
focus
on
is
such
and
the
value
added
capability
that
we
have
based
on
the
pass
and
also
the
boundary
scaling
that
we
have
during
this
process
and
also
in
the
master
Sarah.
What
did
we
do
so?
The
containment
network?
We
know
that
container
network
is
important
in
the
past
network
and
also
for
the
container
network
that
when
we
actually
run
that
online,
we
have
to
actually
huge
like
two
ways
that
we
ran.
It
is
one
mr.
A
Matt
rely
and
we
for
each
fiscal
container.
We
have
a
physical
IP
and
these
we
have
the
tag
and
route
the
strip
and
allocated
so
we
to
connect
with
the
physical
platforms.
So
when
we
applied
these
structured
with
at
the
end
of
2015,
we
didn't
have
many
good
OMA
truer
solutions
for
container.
At
that
time
it
was
quite
advanced
and
it
so
he
could
have
us
to
connect
to
all
the
physical
networks
and
it
was
quite
stable
in
terms
of
the
physical
networks
and
also
for
the.
It
was
quite
an
efficient
at
that
time.
A
But
after
some
time
of
the
because
we
did
the
scale
of
our
project,
it
went
up,
so
we
encountered
two
major
problems.
The
fun
is
that
if
the
configuration
got
more
complicated
so
it
wouldn't,
we
have
a
new
node.
We
need
a
new
configuration
and
because
we
Scout
up
and
then
it
got
more
complicated,
and
the
second
issue
was
that,
because
these
plans,
actually
when
we
create
it's
the
container,
we
need
like
real-time
allocation
of
the
IP.
So
this
brought
an
issue
that
if
we
would
I
own
this
DSP
the
central
look
at
the
architecture.
A
If
it
had
any
problem,
then
the
whole
container
system
would
result
in
like
a
big
problem.
So
in
order
to
find
like
a
more
convenient
and
more
reliable
container
Network,
we
actually
looked
at
a
lot
of
investigations
and
we
had
a
lot
of
demo
and
see,
for
instance,
to
see
an
a
scene
I
plug
in
and
or
calico,
and
also
the
coulomb
based
of
EVP
and
all
those
projects.
Actually,
we
couldn't
avoid
one
problem.
A
We
need
real-time
allocation
of
IP
when
we
run
the
container,
so
these
we
have
rely
on
this
central
system.
So
if
the
central
platform
has
a
problem,
then
the
whole
system
were
getting
in
trouble,
so
we
in
the
end
will
choose
to
fly
now,
so
we
used
fly
no
host
gateway
and
these
kind
of
PC
Mario.
So
actually
the
theories
behind
those
platforms
were
almost
the
same.
So
we
like
have
these
preset
IP
and
we
can
allocate
the
IP
routes.
A
She
was
specific
to
the
switch
server
and
then
also
T
of
a
perceived
gateway.
So
through
this
way
we
can
actually
get
all
the
container
networks
connected
sort
of
container
network
and
the
physical
network
can
coexist
on
one
platform,
so
it
can
be
optimized
also
the
storage
architecture
so
for
the
dark
card
inside
the
darker.
So
we
have
these
storage.
B
A
We
have
several
basic
requirements,
so
we
found
that
inside
okay,
we
need
the
readwrite
capacity,
so
can
retrieve
the
I/o
capacity
similar
to
the
physical
disk
and
secondly,
we
want
the
disk.
Space
can
be
isolated,
so,
for
instance,
I
we
allocate
100
gigabits
like
disk
space
and
those
can
be
isolated
and
the
oscillation
can
be
used
as
an
resource
in
the
storage
architecture.
Then
it
can
be
cold
when
we
need
to
know
also.
A
The
third
requester
that
we
had
was
actually
because
we
have
some
debugging
lot
of
debug
logging
and
when
we
talk
about
the
logging,
we
need
some
like
transfer
mechanism.
So
when
the
container
looked
like
it
out,
we
we
don't
want
to
do
just
to
clean
the
storage
that
we
used
to
for
the
container.
So
we
wonder
a
synchronous
cleanup,
so
the
plan
that
we
had
at
the
end
is
all
we
had
divided
into
two
spaces
for
the
storage.
A
So
one
is
the
darker
and
at
the
back
end
we
have
so
each
time
we
created
to
the
container
will
have
this
volume
and
have
this
LVM.
So
we
use
this
LVM
to
actually
expand
the
storage
and
also
can
in
combination
with
the
root
storage
and
all
those
get
together
for
a
new
storage
architecture.
So
these
enabled
us
to
have
a
better
allocation
for
the
storage
and
abetik
or
the
resources.
These
also
in
helped
us
to
ensure
the
I/o
capacity
of
our
disk.
A
So
when
you
just
want
to
use
this,
so
you
can
distribute
image
inside
and
then
then
compare
them
together
to
you
like
form
this
kind
of
operating
environment
he
or
she
desires,
and
also
we
have
these
SMD
we
fixed
achieve
docker
and
then,
when
we
initiate
the
docker,
this
can
be
used
to
as
the
tour
at
the
dock,
the
doc
Anette.
So
actually
the
zoo
Connect
is
a
inside
the
Linux
operating
system.
We
have
this
OS
that
duck
energy
processing,
but
inside
a
container
that
is
in
Ladakh
India.
A
We
need
to
write
it
ourselves,
so
we're
at
the
beginning.
We
had
this
tool,
so
it
would
be
responsible
for
the
processing
initiation
and
the
managing
inside
their
container,
and
we
are
also
responsible
for
like
connecting
with
a
lot
of
systems,
and
we
were
kind
of
hoping
that
these
kind
of
like
we
can
control
some
of
the
behaviors
inside
a
container
and
we
have
these
switch
system
and
it
can
inject
the
things
into
the
container.
A
So
a
brief
thing
that
are
kind
of
like
like
so
we
have
a
deep
mud
like
mode
so
inside
the
the
container,
so
this
kind
of
like
dynamic
environment
when
the
user
releases
a
task
or
job
so
because
of
like
maybe
like
an
environment
like
all
other
issues
that
those
process
could
have
restarted.
So
those
like
debug
will
be
quite
difficult.
So
we
had
this
debug
mode.
So
it's
quite
simple.
A
Actually
so
when
we
run
the
testing,
so
it's
kind
of
like
a
conch
shell
and
it's
kind
of
like
and
like
a
like,
empty
shell
that
we
to
run
the
image
and
reporter
to
in
the
cluster.
But
it's
not
the
process
that
we
need
to
have,
but
it's
kind
of
like
an
empty
shell.
So
this
is
the
debug
mode,
oh,
that
we
designed
and
also
the
air
for
a
pass
platform
when
we
have
to
put
it
into
practice.
A
So
a
lot
of
companies
use
your
house
and
the
DB
house
so
to
do
their
own
traffic
nach
and
also
about
the
balancing
anaphor
so
Anselmi.
We
also
have
a
problem
that,
after
we
can
terrorised,
so
the
energy
was
also
containerized
and
we
have
a
dynamic
of
praise.
So
how
can
we
like
detector
lb?
So
we
have
these
rel
server,
dynamic
changes
and
to
you
to
have
this
real-time
detection.
So
we
have
this
service.
It's
called
an
email
me
or
b
so,
for
I,
like
a
private.
B
A
We
did
a
lot
of
things,
firstly,
that
we
have
an.
We
have
automatic
allocation
for
the
MFP,
these
based
on
the
operators,
and
we
will
have
different
domain
name
to
actually
decide
to
bridge
in
the,
for
instance,
food,
china,
mobile
users,
who
were
tracked
or
we're
actually
redirect
the
traffic
to
the
china
mobile
and
for
the
Unicom
users
who
will
redirect
the
traffic
to
the
their
server.
A
So
the
advantage
is
that
we
can
actually
help
the
users
to
make
their
kind
of
like
have
a
more
reasonable
allocation
to
save
the
kind
of
lab
bandwidth
and
we
used
on
enter
and
ELB
services
to
choose
services
running
together
to
to
do
the
RV
real
server
automatic
operate.
So
the
design
purpose
is
that
to
guarantee
the
ERV
service.
When
we
have
like
any
problem,
we
will
have
something
else
to
have
the
backup
so
to
make
it
more
reliable
so
for
the
Clarke
clusters
cloud
vendor
clusters,
so
we
so
for
their
network.
It's
quite
restricted.
A
So
if
we
need
I
will
be
services
for
a
cloud
vendor
cluster
that
can
be
connected
to
not
network
that
I
just
mentioned.
So
we
add
one
more
layer,
you
have
proxy,
so
it's
kind
of
like
a
proxy
for
our
traffic,
so
it's
kind
of
like
something
that
we
need.
A
lot
of
maintenance
work
to
be
done,
so
these,
like
the
layer
adage,
means
that
we
have
more
chances
for
like
encountering
problems.
A
A
We
have
these
kind
of
like
delayed
recovery,
so
enable
then
log
to
send
it
completely
and
then
to
recover
the
container
afterwards,
and
also
we
will
define
a
log
regulation
for
our
ad
or
directory
for
our
users
specifications
and
they
can
realize
these
self
discovery
so
like
this
automatic
process
will
enable
them
to
find
which,
like
parts
need
to
be
reported,
and
also
we
have
different
labels
and
like
the
drug
name
and
there
also
to
classify
it
and
for
different
scenarios.
These
actually
bring
a
lot
of
challenges.
A
So
when
use
as
a
lookup
learn
lock,
they
use
keywords,
they
type
in
keywords
and
then,
when
we
reported
it
to
the
es
and
all
the
data
basically
almost
like
they,
they
use
different
ways
to
do
the
searching.
So
it's
kind
of
like
a
challenge
in
terms
of
the
performance
so
for
the
secure
private
login.
A
So
we
hope
that
we
have
these
a
system
that
is
in
line
with
the
physical
or
the
physical
system,
so
at
Xiaomi.
So
we
have
this
secure,
login,
it's
in
actually
in
line
with
the
service
tree
node
inside
shell
me.
So
if
we
have
an
authorization
for
the
service
tree
node,
then
you
can
log
in
through
these
toodle
kind
of
like
a
container
so
inside
the
container
as
I
mentioned,
ladakh
enter.
A
So
this
is
what
we
used
and
the
dock
enter
were
used
to
IP,
to
register
yourself
in
the
service
tree
and
to
use
the
secure
login.
So
the
result
that
we
have
here
is
that
you
have
the
authorization
for
your
personal
account,
it's
kind
of
like
the
physical,
most
physical
physical
machine,
so
you
can
use
to
secure
login,
then
the
dynamics
of
security.
So
when
we
talked
about
it
in
terms
of
the
physical
environment,
we
had
like
a
lot
of
services.
A
Can
be
so
they're
in
on
the
white
list
and
the
SDK
will
be
watched
automatically,
and
so
if
the
IP
Chan
changes,
so
the
SDK
will
sense
the
changes
and
it
will
automatically
upgrade
the
whitelist,
and
these
will
help
to
achieve
the
dynamic
server
them
economic
service
security
that
we
required
so
for
the
DB
proxy.
So
we
actually
impact
the
SDK
to
have
these
kind
of
dynamic
server
security
capability.
A
B
A
Together
to
defend
against
rosita
failure,
so
we
have
so,
if,
like,
if
there's
a
ZK
encounters
any
failures
of
we
can
use
drop
names,
you
can
exit
we
so
for
the
monitoring.
So
we
have
an
open
circle.
It's
a
note:
it's
a
open
resource
monitoring,
so
we
have
these
dynamic
environments
and
for
all
the
data
that
we
monitored.
We
use
the
Falcon
agent
to
push
us
to
Falcon
server.
So
it's
kind
of
like
a
push
collection
so
for
the
container
it
has
actually
huge
Vantage's.
A
The
first
thing
is
that
it's
more
like
better
integrated
with
the
dynamic
environment,
so
it's
kind
of
like
this
automatic
collection
for
the
push
data,
and
the
second
advantage
is
that
we
can
actually
use
it
to
enable
a
more
strategic
self
discovery.
It's
kind
of
like
a
motive,
automated
discovery
and
don't
so.
What
exactly
is
these
kind
of
like
automatic
discovery,
so,
for
instance,
for
the
disk
that
we
only
have
for
the
remaining
space
that
we
have
so
the
tack
here?
A
So
we
have
like
the
tag
here
to
describe
the
matrix
that
we
had
that
for
the
mount
so
whether
it's
like
home
or
them
like
data
part
of
it.
So
we
have
this
mechanism
so
whether
it's
like
inside
to
contain
a
node
where
they
add
a
new
container
node
or
have
incited
a
node,
have
a
dynamic
phonetically,
add
a
like
a
different
part
of
it.
A
So
we
actually
have
have
this
metric
monitoring
can
be
detected
automatically
so
inside
the
container.
Whether
you
experience
any
dynamic
changes,
we
only
need
one
policy
to
actually
detect
the
remaining
space
we
have
in
the
disk.
So
through
the
monitoring
system
through
the
servicers
numbers
and
also
the
pass
the
code
design
can
make
it
simpler
or
easier
for
the
container.
B
B
We
do
not
highly
rely
on
masses,
therefore,
the
transformation
towards
cuban
natives,
a
lot
of
a
lot
of
solutions,
can
be
adapted
when
transformation,
so
it
becomes
easier
when
transforming
this
is
a
double
engine,
because
the
cluster
of
the
clusters
of
mesas
for
show
me,
we
actually
have
eight
clusters
and
some
of
them
are
cuba
native
some
of
them
Mesa's.
So
we
need
to
have
this
capability.
B
So
the
role
of
adapter
in
this
solution
is
basically
for
the
transformation
and
migration
of
our
code,
including
API
and
including
processing
events.
These
two
main
things
for
adapters,
that
is
because
of
the
Cuba
natives
and
masses.
We
have
significant
difference,
for
instance,
for
API.
You
cannot
just
linearly
connect
in
one
to
another.
B
B
B
B
Under
D
cos,
the
container
engine
is
very
important,
but
it's,
it
does
not
mean
everything.
So
when
building
TC
OS
OS,
we
have
actually
done
a
lot
of
past
expanding
or
you
can
say
that,
based
on
that,
we
have
expand
a
lot
of
sass
capabilities,
for
instance
this
component
service.
We
have
this
installation
package
within
the
plugins,
but
it's
just
for
the
progress
and
files,
but
with
under
the
DC
OS
content.
We
actually
can
treat
these
plugins
as
our
installation
package
and
install
them
into
our
clusters.
B
B
B
B
B
B
This
is
called
chaos
simulation,
it's
proposed
by
net
fleet,
the
meaning
behind
that
is.
We
all
know
that
many
issues
are
peers
from
the
developers
code.
It's
not
healthy
or
it's
not
complete
enough.
So
if
the
code
is
unreliable,
then
even
if
you
do
a
lot
of
things
during
the
dev
ops
and
the
infra,
you
can't
actually
make
significance
difference,
but
only
through
human
communication.
We
cannot
achieve
that
level
of
completion.
So
we
have
this
mechanism
to
build
up
a
system
that,
through
this
system's
mechanism,
we
can
achieve
this
level
of
completion.
B
B
We
can
also
clean
out
a
resource-
that's
not
been
used
and
to
clean
out
the
service
that
we
that
we
do
not
need
and,
of
course,
we
can
find
our
vulnerabilities
and
kick
them
out
and
to
solve
the
issues.
We
can
also
lie
down
our
policies.
For
instance,
we
can
ante
release,
we
can
ban
the
release
of
the
mechanism,
so
these
policies
can
be
applied.
The
security
and
the
reliability
of
online
production.
B
B
It
is,
we
need
to
seek
for
strong
a
better
control
capability
under
DCOs
and
under
that
capability.
We
will
wish
to
have
the
automatic
control
abilities
under
that,
because,
if
human
we
need
to
do
this
manually,
then
we
can
have
a.
We
can
have
a
missed
decision.
We
have
a
bad
decision,
so
we
can
have
this
DC
brain
scenario.
For
this
scenario,
we
do
not
offer
a
lot
in
it
and
I'm
only
going
to
talk
about
two
scenarios.
One
is
the
reason
analysis
on
our
left
hand,
side
that
is
in
a
domain.
The
domains
reliance.
B
B
The
service
a
is
wrong,
running
based
on
some
host
and
the
host
is
depend
on
switches.
So
if
we
have
alert
from
one
domain
and
at
this
time
we
can
make
our
decisions
from
this
decision
tree,
whether
when
we
can
check
out
what
is
the,
what
is
the
endpoint
of
this
alert?
Now
we
can
seek
for
the
issue.
B
B
There
are
something
very
difficult
to
achieve.
First
of
all
that
each
dimensions
when
we
banking
on
the
topology
there
is
they're
not
at
the
same
point,
they're,
not
a
flat
surface,
so
we
need
to
break
through
the
barriers
between
them.
In
the
last
point,
I'm
going
to
mention
is
the
mail
function
self
curing
system.
B
B
In
the
lower
part
of
the
systems
we
have
already
connected
with
the
system's,
the
upper
part
is
our
lock
system
and
monitoring
system
and
the
lower
part
of
it
is
our
mainframe
management,
developed,
system,
domain
and
other
systems.
So
in
the
future
we
would
like
to
strengthen
our
this
trigger
system
for
Auto
curing.
So
this
will
be
the
end
of
speech,
and
this
is
our
public
account
of
show
me.