JAPAN CONTAINER DAYS V18.12 （セッション 2E5）の講演資料です。 https://containerdays.jp/

1. NoOps Japan
@yokawasa
Japan Container Days V18.12
NoOps Japan
@OkaHiromasa
NoOps

6. Ops …

7. Ops …
NoOps =
No “Unconfortable” Ops
” ”

9. NoOps Meetup
https://www.slideshare.net/irix_jp/the-noops-strategy-and-tactics

11. SRE

18. NoOps
Failure

19. (Resiliency)
(VM)

20. (Resiliency)
(VM)

24. Layer 1
Layer 2
Layer 3
Layer 4
Layer 5
Layer 6
Layer 7
: Gabe Monroy on Twitter: "Strata of the Container Ecosystem
https://twitter.com/gabrtv/status/539805332432637952
https://trends.google.co.jp/trends/explore?date=today%205-
y&q=Kubernetes,Mesosphere,Docker%20Swarm

25. 2013
Docker
2008
LXC
2014 2015 2016 2017 2018
Google
k8s
CNCF
2013.3
2014.6
k8s1.0
2015.7
Docker
Swam
2014.12
Mesosphere
DC/OS
2016.4
Docker
k8s
2017.10
k8s1.10
2018.3
EKS, AKS
GA
2018.6
k8s
( Docker & Kubernetes )

26. CNCF (Cloud Native Computing Fundation)
•
• Container network interface (CNI)
• Container Storage interface (CSI)
• k8s Kubernetes

28. Pod Phase, restartPolicy
Liveness & Readiness Probe
Rolling Update
Horizontal Pod Autoscaler
Cluster Autoscaler

29. Open Service Broker• Rook
• NATS
• Operators
etcd, HPA, PVC, MySQL,
Postgres, Mongodb,
Redis, Jaeger, Envoy,
Kafka, Prometheus, etc.
StatefulSet
DaemonSet Service Catalog

30. • Helm
• Draft
• Skaffold
• Spinnaker
• Jenkins X

31. Container
Runtime
•
•
SAST/DAST
RBAC
CIS benchmarks
Namespace
RBAC
Pod Security Policy
Network Policy
Runtime
Runtime
• cri-o
• gVisor
• Kata containers
Orchestrator
Runtime Environment

32. Logging
Observability
Tracing Visualization
Monitoring
Observability

36. Service Mesh
Data Plane
Control Plane
Envoyproxy Blog: Service mesh data plane vs. control plane
https://blog.envoyproxy.io/service-mesh-data-plane-vs-control-plane-2774e720f7fc
Control Plane
Data Plane Mesh
Data Plane
① Control Plane Data Plane

37. • Pilot:
• Mixer:
• Citadel:
https://istio.io/docs/concepts/what-is-istio/

38. Service Mesh
②

39. PodPodPod
https://docs.microsoft.com/ja-jp/dotnet/standard/microservices-
architecture/implement-resilient-applications/implement-circuit-breaker-pattern
PodPodPod
PodPodPod

40. PodPodPod
PodPodPod
PodPodPod
Service Breaker Destination Rule (Istio)
https://istio.io/docs/tasks/traffic-management/circuit-breaking/
Service Mesh

41. Discovery & Load Balancing
round robin, random, weighted least request
Traffic Splitting
A/B testing, canary rollouts, staged rollouts
Traffic Control
Handling Failures
circuit breakers, timeouts, and retries
Fault Injections
delays or abort
Rate Limiting
Distributed Tracing
Collecting Logs & Metrics
Service Graph
Authentication Policy
Mutual TLS Authentication
Istio RBAC
https://istio.io/docs/concepts/what-is-istio/

42. k8s Service Mesh
Knative - https://github.com/knative/docs

43. NoOps

44. NoOps

50. Ops

53. The Network is the computer.

62. Istio multicluster

63. https://www.slideshare.net/CiscoSP360/introducing-application-engineered-routing-powered-by-segment-routing

64. https://www.slideshare.net/Templarad/141022-java-hot-spot-vm-gc#5 https://www.slideshare.net/hiromasaoka/noops-88082246

65. API
OpenStack
Mongo,Cassandra…

68. NoOps
3.

69. NoOps
3.

70. https://istio.io/docs/concepts/security/

72. Figure 1-1. Traditional network security architecture

73. • Zero Trust Control plane vs Data plane
• Zero Trust Control plane
• Zero Trust Data Plane: Control Plane

75. k8s Service Mesh

77. ž Boundary
ž
Managed K8s

78. ü
ž (Resiliency) NoOps
ü
ž
ü
ž Firewall Zero Trust

79. ü
ž (Resiliency) NoOps
ü
ž
ü
ž Firewall Zero Trust
The Network is the Computer.

80. Ø
Ø
Ø
NoOps = No Boundary