Kubernetes IoT Edge Working Group, 12 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: KubeEdge: From Fixed Location To Movable Edge, Latest Updat...Zefeng (Kevin) Wang, Huawei & Yin Ding

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

KubeEdge: From Fixed Location To Movable Edge, Latest Updates And Future - Zefeng (Kevin) Wang, Huawei & Yin Ding, Google

KubeEdge is an open source edge computing framework that extends the power of kubernetes from central cloud to edge. Since last met, KubeEdge has made big progress on user adoption, community development, cross-community collaborations. In this talk, Kevin and Yin will cover: 1. latest user adoptions in several new industries, including: cloud native satellite, smart vehicles, offshore oil fields, etc; 2. development updates, including: significant scalability improvement, brand new device mapping interface, 3. Project roadmap, TSC, SIG and subproject updates. 4. Community Security updates including: security audit report, threat model and security protection analysis. 5. Useful informations on how new contributors to get involved. There will be an open Q&A for attendees to ask questions.

A

uh Hi everyone yeah, thank you for coming. Let's get started. We are right on time so uh today, uh first myself, uh my name's in ding I'm from Google I'm, the founder and maintainer of Cooper Edge. Today we are talking about the Cooper Edge, so I will give a few updates about the community security and scalability test.

A

So this is our agenda. We have about 35 minutes. I will try to finish it in 25 to 30 minutes, then the rest time I can leave for the questions.

A

So today, I'm going to talk about the introduction, the briefly introduction of our project and give the community update the security update and the performance getability test uh final. We are talking about a little bit. The roadmap and the community building, so Edge Computing I will try to get a brief, uh the intro, because everybody uh hopefully already expert on this one. So there's a different Edge. So we're talking about the near side edge. Basically, it's very close to the device or everybody else. Then we have the cth the original Edge.

A

Then we reach out to our Central Cloud. So each Edge they have a different usage. I mean they have a different typical kitchen, so for the near side we do a lot of AI inference arvrs, but in the regional level we are typical, is a CDN arer and also we do the pick, uh the not only the render the rendering and also the video transcoding.

A

So in the Cloud we assume we have unlimited computing power, so most of the training will build in the cloud and we are using the computer power from the central Cloud. However, in Cooper Edge we have our Edge seek, so we have the cedina sub project. They are trying to do the collaborated or Federated learning. So that means the training not only exists in the cloud, but also in the edge side. We are going to have a look.

A

So here is the kuberge architecture, so you can see the main part. The cloud part is based on the pure kubernetes control plane, so you can miss, you can miss, deploy Cloud, node and Edge node Edge node, we I mean expanded on the bottom. So basically, our system supports you can mix, deploy both Cloud node and Edge nodes, and we have the special part called Cloud. Core is this: is the our kind of APs server our to the all the new Edge node in Edge node?

A

We have a counterpart is The Edge core, so we are using the websocket long connections or we also support quick. So this part we can have a 2v duplex communication between the edge and the cloud, so typically The Edge may be deploy. Edge node may be deployed behind a firewall. Through these connections we can, across the firewall, like the cloud directly control the edge node. So you can have a cloud controlled, Edge So within the edge we support, CSI CRI CRI. We can do uh and also the cni.

A

The CRI will support not only container D crio, all kind of uh standard uh container provision we support, and also we are using this uh mosquito to connect all the devices. So I want this one, because we already talked about this before I will spend more time on our update.

A

So a quick update uh our journey, so we launched this product in 2018 and we donated to cncf and become a Sandbox product in 2019 March, and we graduated to incubation in 2020 around 2021 uh 2020 September, and currently we have a more than uh 5 800 Stars. We have uh more almost 2 000 Forks and you can see the contribution. Contributors are really Diversified. We have more than one thousand contributors from 880 more than 80 organizations So. Currently we are doing the quarterly release. We support not only x86 but arm 32, arms, 34, 64.

A

and the uh the new updates they say we set up based on after we into the incubation, we set up a. We recently created our TSC, the technical steering committee and uh based on all these six already existed. The new one will be the signaled here. The link will show you the proposal or the scope of the seek. Basically it's very similar to kubernetes Signal.

A

It's mainly focused on the lifecycle management for the agile, the connections, anything related to the runtime in the node and also cover the cloud node, because we support a mixed deploy of a cloud node and Edge node.

A

Here you can see uh for last year this uh very Diversified, the contributors, 36 percent are individual contributors. So it's we have the consistent code, very active project.

A

So here is our community. Basically, we have a community government follow the CNF rules. We have the TSC, we set up a TLC, we have a different six and the work groups. So talking about on the different topics and the technical companies, we hire a few ambassadors to help us to do the marketing and the evangelists, and we have the user group. That's the for the industrial Partners talking about the user cases and give the cases and all the problems they have when they adopt corporate coverage.

A

So another good update, important update, is the training we collaborate with the cncf foundation because we are cncf project and also the Linux foundation training we are going to start. Our training sessions is about 23 24 sessions will last two or three months, and here is the link. We are talking about all the proposals. uh What's the each topic and thank you for seeing yourself supporting us we're going to have a formal training and for the TSC we have our Charter here, that's new uh the current this current membersville.

A

Until we are going to have an another election on September October frame in 2024, that's a two years term of TSC numbers. So the members must come from a different Organization. No organization have more than two TSE members.

A

Now the important update so basically uh I'm going talking about the security update. So first is about the supply chain. Security supply chain security. You can see, especially for the container side when you develop a new and when developer, developer, new features until release the software there's a few stages of the source build and the packaging, and also you are in when you build the your product, you pull in a lot of dependencies. You can see there's a lot of landmark there that could be potential risk and potential attack attack.

A

So we pair with a cncf. We did our audit in June. So we are one of the first CSF project uh reached the level of insurance by uh as llsa LSA is the open. Ssf project is Major. You build the dependency Source all the dimensions.

A

So this is a cross industry, Cross organization, vendor neutral group, so they do a really good audit, so they provide an industry standard, recognize the agree upon level of protection and compliance. We in the source build and the common parts we all reach in the level Insurance The L4 the full report. You can hear the QR code, you can get our full security auditor report, you can see all the dimensions they measured, all the all the detail and also uh there's a one at that time.

A

It's not available it's a province, so we did our Improvement follow up the security update uh after the audit.

A

And another one we do the we integrate the following, so you can see here. The news we are one of the sincere projects are being filed continuously by the OSS files. Here is the news, so you can see the principle is by the fast fighting test. You create your first input. Then you enter your system. Do the fighting test, so we are continuously tested by the fuzzing test.

A

So we are the first of the 18 I think currently 18, since their product is being fast. So we are one of the first batch.

A

So another one will be the thread modeling and the production analysis, so we did our based on our audit report. We find out this potential attack will be one two three four five, that's of different attack, I, don't want to. We don't have time to go and elaborate everything. However, you can still download the the full report and you can download the report on on the previous page. I posted a QR code here is our analysis.

A

Does a policy that, on the GitHub, another part will be based on the audit report? So we have this a full report here and we set up our main policy and one Innovative management procedure. You can see uh for the cloud part we collaborate with our Upstream kubernetes security response team. We listen to the SRC from kubernetes and for the edge part we run our security, Sig maintenance. We listened and watch for the old vulnerability assessment and then and all the CVS when it's coming.

A

We do that validation and assessment. Then we as simultaneously do the solution and apply the cve. Then we we after the Embargo period, we release the recommendation and the release. The security advisory, so basically that will split in the five parts reporting confirming then remediation, then we do. The Embargo is the restricted, is coder then publish this closure. So this time we allow our industry partners and user group can take that patch and do the fix.

A

Now, I'm talking about the performance test, so this topic are covered in the Europe. So basically, what we do is say. Basically, we test our SLO service level objective test, so we test our latency throughput, scalability, CPUs region memory, usage and also for the you see the scenario of usage of Google Edge. We especially covered unstable cloud and Edge networking part because we are a cloud native ad product. That means the from Edge to cloud is different. The connection is different from inter data center.

A

That means it's not stable, it could be disconnected or long delays and also we have a restricted bandwidth. So before we go in deep into that, I will briefly cover. So here is a borrow from kubernetes community, so the scalability doesn't only means how many nodes you're going to support. How many part there's a few Dimensions. You need to think about it, the how many secret the secret number we have I think currently a 3000 secret per cluster does.

A

If we I mean even in Google gke, we may have increased this secret number. We not all vendors support enough number of a secret and also how many services do you support. Backend. The important note is only well. This is the Pod per node and also uh the ingressive supporters of a incoming traffic. It's not working part. So this you can see. There's multiple Dimensions! You need to measure for reach the real scalability. You cannot have one.

A

If you miss one dimension, it will I mean block you from your skill up here. This is what how we did our security test. So we have a cluster loader, so it generates a load and we have our load balancing to load up. So here is our data, so we test our 10 000, sorry 100 000 of a note and one Million Parts. So that's we are trying to that's our config here is our test results. So here is the data, the visualization.

A

Let me hear it's more readable here, so you can see the Pod startup. So 50 is about a 86.

A

Is 16 is 1.6.

A

And 99 is less than 5 Seconds, so it's reached. Our SLO is about 5000 milliseconds, five, basically five seconds, and here is the create to schedule, because this our tools doesn't allow. uh It shows zero. Actually, it has a number because it's the based on the standard, it doesn't support it's a sub second or a sub mini. Second, it cannot display here is only displayed at zero, but it's a number there, but 99 will be a one second uh scheduled to run it's all. One sec, 1, 000 millisecond run to watch is from 50.

A

Percentile is it's about one second and 99 is.

A

2.2 second and scheduled to watch is a 1.6 second and 99. Percentile is 30 seconds so from the test results we have this conclusions. Coverage can support 100, Southern, Edge, node and meantime we deploy a one Million Parts on the on the cluster, so you can get a during the kurbo Khan Europe I only talk about the the test setup.

A

At that time. We don't have the full result report here now we have the full report released, so you can download our report from here.

A

So here is a few links. Our website, uh GitHub page select Channel meetings and docs, so you can either ping us from select Channel or through our mailing list or from Twitter. So we have our maintainers on the channels and also we have a weekly meetings. We have a two time setup. One is more U.S friendly, as in the U.S 7 PM Pacific time, the other one will be more European friendly.

A

It's a European afternoon time so yeah. We have about 20 minutes here, so cool yeah.

A

Any thank you. Everyone uh here is the QR code. You can post the question or feedback and I'm open to any questions.

A

uh You mean the image Hub, the harbor right.

A

So you sorry I.

A

Didn't return uh that one which we publish in the in the Dark Link but feel free to, let me know we published some uh all the reference in this documented link. Yes,.

A

uh Let me just quickly show you we and also it's published in our GitHub page.

A

And I didn't talk about it. In the node group, we are going to support a Windows container. That's planned for the next year.

A

So we do have our Javier support list so that also posts in our user group, so our industry Partners. They also have their user examples published there.

A

Let me know if you cannot find it. You ping me in the slack Channel or Twitter, so I will find it. Thank you.