AWS EKS平台技术概述

1、AWS EKS平台技术概述技术创新 变革未来Amazon Elastic Container Service for Kubernetes 51%of Kubernetes runs on AWS today Cloud Native Computing Foundation3x Kubernetes masters for HAKubernetes on AWSAPIserverCloud controllerController managerSchedulerAdd-onsKubeDNSKubernetes ControllerAvailability Zone 1ControllerE

2、tcdControllerEtcdControllerEtcdAvailability Zone 2Availability Zone 3Availability Zone 1EtcdControllerEtcdControllerAvailability Zone 2Availability Zone 3EtcdController“ Run Kubernetes for me.” “ Give us an upstream experience.” “ Please don t fork.” “ Make sure it s compatible” AM AZ O NEL AST I CC

3、 O N TAI N ERSER VI C EF O RKU BER N ET ES (Amazon EKS) Tenet 1EKS is a platform for enterprises to run production-grade workloads Tenet 2EKS provides a native and upstream Kubernetes experience Tenet 3If EKS customers want to use additional AWS services, the integrations are seamless and eliminate

4、undifferentiated heavy lifting Tenet 4EKS team actively contributes to the Kubernetes projectAvailability Zone 1Availability Zone 2Availability Zone 3ControllerEtcdControllerEtcdControllerEtcdCustomer AccountAWS ManagedEKS WorkersKubectlAmazon EKSAZ 1AZ 2AZ 3Your AWS account/awslabs/amazon-eks-amiAW

5、S IAM Authenticator/kubernetes-sigs/aws-iam-authenticatorAn open source approach to integratingAWS IAM authentication with KubernetesKubectl3) Authorizes AWS Identity with RBACK8s API1) Passes AWS Identity2) Verifies AWS Identity4) K8s action allowed/deniedAWS AuthIAM Authentication + Kubectl Native

6、 VPC networking with CNI pluginPods have the same VPC address inside the podas on the VPCSimple, secure networkingOpen source and on Github/aws/amazon-vpc-cni-k8sJava PodENISecondary IPs:Nginx Pod Veth IP: Veth IP: ENINginx Pod Veth IP: 0Java Pod Veth IP: 2Secondary IPs: 02ec2.associateaddress()VPC

7、Subnet /24Instance 1Instance 2Kubernetes Network Policies enforce network security rulesCalico is the leading implementation of the network policy APIOpen source, active development (100 contributors)Commercial support available from TigeraST AG ESEP AR A T I O N“T E N A N T ”SEP AR A T I O NF I NE

8、- G RA I NE D F I R E W A LLS CO M P L I A NCE E.g., typically use namespaces for different teams withina companybut without network policy, they are not network isolatedReduce attack surface within microservice-based applicationsIsolate dev, test, and prodE.g., PCI, HIPAAMaster access and visibilit

9、yAmazon CloudWatchAWSCloudTrailMasterUpgrade Strategy: “On-Demand Updates”Kubernetes Upgrades 1.9.11.9.2Version1.9Version1.10Kubernetes Upgrades Auto Scaling - ApplicationHorizontal Pod Autoscalerscales pods in response to K8s generated metrics (CPU)Has support for custom metricsAuto Scaling Cluster

10、 Two options: Native Auto Scaling, K8s Cluster Auto ScalerCluster Autoscaleris reactive AWS Auto Scaling Groups work as usualWill $(thing) work on Amazon EKSAmazon EKS is Kubernetes CertifiedAmazon EKS and Open SourcePacker scripts: /awslabs/amazon-eks-amiCNI plugin: /aws/amazon-vpc-cni-k8sAWS IAM authenticator: /kubernetes-sigs/aws-iam- authenticatoreksctl: Create EKS cluster with one CLISIG AWSALB Ingress controller: /kuber