Cloud Native Computing Foundation KubeCon + CloudNativeCon China 2018 (Shanghai), 26 Nov 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Intro: Kubernetes Policy WG - Zhipeng Huang & Hui Wang, Huawei

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Intro: Kubernetes Policy WG - Zhipeng Huang & Hui Wang, Huawei

The introduction session of the Kubernetes Policy WG will focus on the progress update of the prirority PRs for the 2018 Fall Cycle.

To learn more click here: https://sched.co/FuLD

A

Now, that's not.

B

A

You very much for attending days talk when we usually are very sleepy, so I hope that the afternoon presentation for me well not pretty in to sleep, so my name is one way. You can also call me leo under standard engineer at way. I made you responsible for the new business, including a big data edge computing.

B

Autonomous driving.

A

Source exploration.

C

A

Of relevant standards, so today I'd like to briefly introduce the kubernetes policy workgroup. What are the progresses? We have.

B

Made before I start.

A

I'd like to say that it's just be co-presented by me and my colleague dr. Holm, but because he needed to attend other conferences.

C

A

I couldn't cover those details. Please forgive me.

B

A

Is the what is the initial.

B

Attention intention so.

A

We already established electro for Cuban edges and six in each of.

B

A

B

A

Have the relevant policy definitions, for example, the storage policy, networking policy, certification policy.

A

Identifies the following issues.

B

The first one for each other.

A

In their own sub domain, some meetings.

C

For Sofia development.

A

Between us defend some.

B

A

Cannot have a consistent.

B

A

Different subdomains: we need to maintain a consistent semantics and we also lack of the.

B

A

And management for those different policies.

B

A

Second part.

B

A

Like to induce the positioning of.

B

A

Already have defined how much of the policies already.

B

Defined once we do to.

A

Reinventing those wheels best on the existing.

B

A

Policies we need to come.

B

Up with general framework- and we also need to focus on the end-to-end.

A

Policy definitions.

B

We'll also have the.

A

Incremental improvement.

B

A

Is the history of the workgroup last year the cube con someone the rest of my.

B

A

Know, certification and beautiful process. We cannot to reach a very satisfied researcher, so some people had a discussion and they proposed that.

B

A

On the certifications, we can have a policy.

B

Definition and states were groping.

C

A

Established in January this year.

B

A

Also have to work play booty meetings in a community. The major.

C

Purpose of the.

A

Routine meeting is.

B

To have some basic proposals.

A

Or initiations.

A

B

A

Every search day, mating time, we will have a meeting if you're interested. You can take a look at the agenda and minutes of the conference.

B

A

Now we have been joined by a lot of the members, including Google IBM Arab, had.

B

A

Of those members have been engaged in our work.

B

A

Does it operate.

B

A

Operates in three ways: first of all, the policy work.

B

A

Been cooperating with the other work group.

B

A

Cuba notches six and project some are in sight and some are outside the cabinet chess communities. So we coordinated.

B

Lay promotes the.

A

Policy definition.

B

Of the cuban antes projects- and secondly, we.

A

Are driven by the community.

B

A

Of the designs and discussions are completely open and.

B

Hospital 'is the development cycle.

A

For the workroom.

B

Is cover year and.

A

B

Each of the cycle, we will define.

B

A

Mvp development and a review.

B

A

B

A

B

A

Were first to collect the demand for the policies from a.

B

Different part and.

A

Then we which integrated estimation into.

B

A general solution here, I, have listed three use.

A

Cases discussed in.

B

His community, the first one, is.

A

The compliance of.

B

A

The second part I used.

B

The word capacity, but you.

A

Can understand it as the quota and the third one is about your cluster management compliance. You must have heard of gdpr.

B

A

Of the existence of GPR a lot of the companies where about whether the cluster were to support or be compliant to management or PCI, some of the other data classification standard. Second challenge.

B

A

Or workload distribution, how to define.

C

A

To define the priorities of the resource allocation.

B

A

Are the tenants.

B

A

Capacities and when do they need it to work load immediately from time to time, and how can we guarantee dynamic and adjustment of.

B

A

The cluster management.

B

A

A business department you.

B

Need to guarantee a.

A

Consistent application of those problems.

B

A

I like to go through these challenges, one by one.

B

The data compliance I.

A

Have listed some cases.

B

A

The left hand side you can see there are.

B

A data compliance officer, the data controller.

B

A

Can call them DC.

B

A

B

A

A first occurrence to.

B

Capture some metrics associated with.

A

B

A

Ensure that the policies can be implemented.

B

And for the second, is the OD.

A

Co2 once some violations.

B

B

A

Compliance happens, then we can send it Alert for.

B

B

B

A

B

Other histories based.

A

On a compliance policies for the DCO can gather some gdpr data.

B

A

The data controller.

B

A

Can create a policy or review.

B

A

B

A

In this, meaningful progress of managing the policies and data or DC can define a process for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures.

A

By doing so, she can also ensure the security of the data.

B

A

I have introduced the data compliance issues, then I found to the capacity.

B

A

Also have some use cases to show with you the first one.

A

Needs to some capacity reservations for a different business, and then he also need to set.

B

A

B

Different this.

A

Is the first scenario.

B

In the second scenario, based.

A

On the resource, consumption.

B

At different pipelines for.

A

A

Smaller resource.

B

A

We can have interdepartmental.

B

Resource sharing or the.

A

Priority of different resources.

B

A

Third use case for.

B

A

B

A

Can treat the infrastructures equally no.

C

A

The private clouds or.

C

B

We can ask a unified deployment.

A

B

A

Maybe for some of the business lights.

B

We do not allow you to run on the public cloud, stand.

A

That we can those policies to regulate what kind of a business can.

B

Be run and the.

A

Fourth use case.

A

B

A

Example, by what time, during what period of retirement you can have to resource allocation, and this is for the prevention of the high concurrency or to improve the resource utilization, the last thing is for capacity.

B

For each of the projects, we have different amount.

A

Of for the resource occupations, we need to satisfy the demands of Jeff, intercept projects.

B

A

The third challenge is.

B

About cluster management.

A

France and France needs to set her.

B

A

B

Network between different.

A

Departments in the large-scale company.

B

A

To be independent, the.

B

Certification also needs.

A

To be independent, how can you use the relevant policy.

B

A

Realize the access control.

B

Among different departments under.

A

Second, Tuesday's.

B

A

Isolation of the network.

B

A

And bifold between different.

B

Departments we.

A

Should have isolated network.

B

A

Some privilege to work on, we cannot run.

B

It in production, because.

A

We have some administrator operations which may.

B

Damage the production last.

A

A use case is the standardization.

B

A

The policies such as the lifecycle management, and how can we apply those policies to newly established resources such as a new namespace.

B

A

We have introduced some use cases in the communities.

B

And next I like to.

A

Introduce some.

B

Proposals, the.

A

First, one is the scheduling policy.

B

A

B

A

Isolation, we aren't do an initial stage for some of the features such as celebration and priority.

B

A

Including Note.

B

2 selector those features cannot.

A

Be supported if I have cuban address.

B

A

Macro surgery, so a new.

B

A

The community scheduling policy, the purpose.

B

Define a new resource.

A

Toleration notice Lecter can be packaged.

B

A

Like to briefly introduce the functions but as for the detail, sense of realizations.

B

From this link, if you're interested this.

A

Is written by an expert in the community.

B

A

Second proposal is the topology surface.

A

Topology is mainly related with network and service.

B

A

That interest evoluted.

B

A

The ingress API- and this is the transfer.

B

Network Kim wrote for.

A

The business department.

B

A

It's cross AC within the same IC when.

B

We are making a deployment, the.

A

Preferred situation is you use the doko services.

B

A

B

A

The services the know, the local that.

B

Is to create a topology for networking services? By doing so when you create a service.

B

A

The current mechanism of giving edges is to randomly deploy it on a note, but if we can create a topology, then we can transfer or run the services based on your.

B

A

B

A

B

A

You can see more backgrounds, because I not too specialized in this, so I cannot to give you more detailed introductions, but if you're interested you can go through those links to take a look at those proposals.

C

And the thick resources security profile. As for this one is PC use policy in security control.

B

C

These aspects, the first one, is about the cluster bootstrapping configuration, for example, at the command line, flags file, permissions, etc, and also for access to the documentation as well and then for cluster. We also have our policy configuration.

C

For example, we have the power security policy here as the concept and also we have the namespace scoped policy objects. For example, like the network policy.

B

C

The right you can see the spec, the resource name is newsfeed Kempton.

B

C

All the three aspects of just mentioned, we talked about the policy in networking security as well as deployment, and also we have other proposals in other areas, and here.

B

C

B

C

Talked about the three use cases in data control from some quality audit, as well as compliance in the second one is about the resource policy.

C

That is the resource allocation policy and.

B

C

Have two pages later to talk about our findings: the irreversibility of deletion as an issue, and also how we're going to do the co2 control in a multi-tenant quota policy, environment and, lastly, policy working girls.

B

C

Actually generate a holistic architecture which builds upon these proposals and.

B

C

For deletion irreversibility such an issue.

C

Is communities when an issue proposed by the man explained that there's an incubator, which is called service incubator, that is, to integrate a third party systems, for example the cloud service? And we can do that through the component of Cisco and then we, through SBC Kat, will be able to do the check up for the resources. It's just like the service management, and that's where each of the requirement were demand for q8 has various concepts.

C

We have to include information of the users, for example the verification information, the audit information and our this amount of this comes to us. For us, it might reject the information sent from the source for some for the failure of education and as for the service, it involves some of the demand in business world. In so on.

B

C

A serf, spook brokers turns down the request.

B

C

We wouldn't be able to know whether the demand is accepted or rejected.

B

C

B

C

The verified verification mechanism, if we want to resolve it, then we'll have to use the kubernetes verification mechanism a little bit at the moment, and we have the RB easy rules and admission controller as well.

C

And here are some examples for broker if it rejects for updated measures, it's reversible, because the users can still update this back to enable the rolling back well, as for operation, is problematic because for deletion, it's irreversible if we just figure it alike, delegation and then I just regret, then I'll have to bring it back and that's really impossible at the moment.

B

B

C

The operation of just talked about the controller will also supervise.

B

C

B

C

Will also link to the irreversible operation.

B

C

This question has been discussed. I feel like it's an initiative to make full use of the mechanism at the present to resolve this issue. First of all, if with the rbac at the moment, we cannot really map all dynamic, complex business because for being our BAC, we don't really have the.

C

Resources were logic for the dynamic, complicated issues, and we cannot just bring that to the rbac rules and, as for the second one, its admission controllers for this option. Generally speaking, there is no dry run operation available.

C

In most cases, it's not available for us to use, even if it was, we still need to do with the real operation.

B

C

The other one is shadow resources.

C

In this way, the kubernetes users interact with the shadow resource. Therefore, some of the fail delete requests will be able to recreate. We can resolve this issue this way, but it's really complicated what at the same time,.

B

C

The controllers are watching their shadow resources, they may lead to new and other irreversible actions, and it's were the last two ones that is to use deleting custom delete.

B

C

This kind of mechanism that is.

B

C

Make a ballista delete request a flack.

B

C

B

C

Be able to do the definition for the time stamp and that can help us to resolve the issue of whiskey with visibility for custom delete it's similar, but the difference is that the it will forbid the use of delete functions.

B

C

Some of the examples of just mentioned, I want to make the point that.

B

C

Are some ways to resolve the elite issue and try to achieve the rolling back and next one will have the policy working group claiming.

B

C

This picture, you can see, be working group members.

B

C

Actually, from different companies.

B

C

What we are doing at the moment.

B

C

Work for the version, 1.1 3, basically two parts here, the first one is the running items as you can see on the screen altogether: seven items of them.

B

C

B

C

Could refer to the links to see how it will be implemented.

B

C

Also there some of the recommended policy resource format.

C

Yes, it's a format.

B

C

Keeping its policy group.

B

C

B

C

With the Seif sa Fe working group.

B

C

Establish the since FC working group and as for this working group.

B

C

Basically, for the sake of security and also the production of these safety issues, police control and safety for operators, administrators and developers, and as for the members of this working group, they are the companies listed on the screen.

B

C

Tomorrow, 14:20 still in the same venue, there will be another colleague of me who will dive into the policy working group, as for today's session, obviously do a brief introduction. As for tomorrow's session, we'll have three speakers with us who will respectively talk about the status quo, as well as say, detailed information about the policy working group here.

B

C

As for tomorrow, to be specific tomorrow evening,.

B

C

Is a Chris walls which Spanish restaurant will have a small scale meet up there and if you are real interested in it, please feel free to join us.

C

As for online communication, we have already established a wee chat group and there's a QR code on the screen. If you're interested, please get it and join.

B

B

C

English WeChat group, we can exchange our views in terms of the policy, the issues and also some of our requirements in technologies.

C

And basically, that's it for my speech today. Do you have any questions at the moment.

C

Is it because after deletion and you got a catalogue- and you cannot do you cannot reverse it for.

C

Cuban AIDS after we trigger the.

C

Deletion then the state of it will be deleted if the SERPs route. We checked that, then the entire request will be turned down and will not coming back and there's no way for us to change the state of delete it to the normal state and that's it for updated.

B

C

Can manually send another request.

C

If there's no more question, then that's it for my speech. Thank you.