Cloud Foundry Container Runtime (CFCR) & Production Kubernetes
•Download as PPTX, PDF•
0 likes•1,407 views
This document discusses Cloud Foundry Container Runtime (CFCR) and how it can be used to deploy and manage production Kubernetes clusters. It describes how CFCR leverages BOSH to provide fault tolerance, auto-scaling, health checking, self-healing, and rolling upgrades to Kubernetes clusters. These capabilities ensure high availability, scalability, and security of workloads running on CFCR-managed Kubernetes.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cloud Foundry Container Runtime (CFCR) & Production Kubernetes
Similar to Cloud Foundry Container Runtime (CFCR) & Production Kubernetes (20)
More from VMware Tanzu
More from VMware Tanzu (20)
Recently uploaded
Recently uploaded (20)
Cloud Foundry Container Runtime (CFCR) & Production Kubernetes
- 1. Cloud Foundry Container Runtime (CFCR) & Production Kubernetes MERLIN GLENN
- 2. Cloud Foundry Container Runtime (CFCR) & Production Kubernetes
- 3. 3 3 K8s Cluster WorkerWorker kube-proxy Master & ETCD kube-proxy Service: nodeport | ingress | LB POD POD Master & ETCD Master & ETCD “Forget it, Donny, you're out of your element!”
- 4. 4 4 • K8s Cluster HA • Scaling K8s • Healing K8s • K8s Upgrades • CVE PatchesK8s Cluster WorkerWorker kube-proxy Master & ETCD kube-proxy Service: nodeport | ingress | LB POD POD Master & ETCD Master & ETCD “You are entering a world of pain”
- 5. 5 IT Operator – Operate – Agility – Reliability – Develop Value – Comply Application Dev/Ops Owner Platform Reliability Engineer “His dudeness, duder, or el dudorino” K8s Cluster WorkerWorker kube-proxy Master & ETCD kube-proxy Service: nodeport | ingress | LB POD POD Master & ETCD Master & ETCD
- 6. 6 6 BOSH “I won't say a hero, 'cause what's a hero?” CLOUD CONFIG CPI Availability Zone IaaS / Cloud Provider Availability Zone Availability Zone
- 7. 7 7 BOSH CFCR BOSH RELEASE CLOUD CONFIG CPI Availability Zone IaaS / Cloud Provider Availability Zone Availability Zone “I won't say a hero, 'cause what's a hero?”
- 8. 8 8 BOSH CFCR BOSH RELEASE CLOUD CONFIG BOSH STEMCELL CPI Availability Zone IaaS / Cloud Provider Availability Zone Availability Zone “I won't say a hero, 'cause what's a hero?”
- 9. 9 9 BOSH CFCR BOSH RELEASE CLOUD CONFIG DEPLOYMENT MANIFEST BOSH STEMCELL CPI Availability Zone IaaS / Cloud Provider K8s Cluster Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD Availability Zone Availability Zone “Careful man, there’s a beverage here!” • K8s Cluster HA
- 10. 10 10 BOSH “Laughable, man - ha!” CFCR BOSH RELEASE CLOUD CONFIG DEPLOYMENT MANIFEST BOSH STEMCELL CPI Availability Zone IaaS / Cloud Provider K8s Cluster Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD Availability Zone Availability Zone K8s Cluster Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD DEPLOYMENT MANIFEST(s) BOSH Agents BOSH Agents Health Monitor • Scaling K8s (Many)
- 11. 11 11 BOSH CFCR BOSH RELEASE CLOUD CONFIG DEPLOYMENT MANIFEST BOSH STEMCELL CPI Availability Zone IaaS / Cloud Provider K8s Cluster Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD Availability Zone Availability Zone K8s Cluster Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD DEPLOYMENT MANIFEST(s) BOSH Agents BOSH Agents Health Monitor Worker Node Worker Node Worker Node Worker Node Worker Node Worker Node workers=9 “Don’t be Fatuous” • Scaling K8s Out
- 12. 12 12 BOSH “from La Jolla to Leo Carrillo and... up to... Pismo” CFCR BOSH RELEASE CLOUD CONFIG DEPLOYMENT MANIFEST BOSH STEMCELL CPI Availability Zone IaaS / Cloud Provider K8s Cluster Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD Availability Zone Availability Zone K8s Cluster Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD DEPLOYMENT MANIFEST(s) BOSH Agents BOSH Agents Health Monitor • Self Healing Worker Node Worker Node Worker Node Worker Node Worker Node Worker Node
- 13. 13 13 BOSH CFCR BOSH RELEASE CLOUD CONFIG DEPLOYMENT MANIFEST BOSH STEMCELL CPI Availability Zone IaaS / Cloud Provider K8s Cluster - > 1.9 Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD Availability Zone Availability Zone K8s Cluster -> 1.9 Master & ETCD Worker Node Worker Node Worker Node Master & ETCD Master & ETCD DEPLOYMENT MANIFEST(s) BOSH Agents BOSH Agents Health Monitor Worker Node Worker Node Worker Node Worker Node Worker Node Worker Node cfcr=1.9 • K8s Upgrades “Sometimes you eat the bear and sometimes, well, the bear eats you.”
- 14. Vulnerability in Cluster Vulnerability in Image 14 • CVEs & Patching “Sometimes you eat the bear and sometimes, well, the bear eats you.”
- 15. Vulnerability in Cluster Vulnerability in Image Re Create Pods Application Dev/Ops Owner Platform Reliability Engineer 15 Scanned image w/ clair “Sometimes you eat the bear and sometimes, well, the bear eats you.” • CVEs & Patching
- 16. PKS Stemcell Vulnerability in Cluster Vulnerability in Image Re Create Pods Application Dev/Ops Owner Platform Reliability Engineer Patched Stemcell 16 BOSH Scanned image w/ clair “Sometimes you eat the bear and sometimes, well, the bear eats you.” Patched CFCR Rel • CVEs & Patching
- 17. 17 BOSH CFCR BOSH RELEASE BOSH STEMCELL PKSControlPlane(API) Application Dev/Ops Owner Platform Reliability Engineer Self Serve CRUD K8s Clusters Ops Manager “The Dude abides…”
- 18. 18 BOSH CFCR BOSH RELEASE BOSH STEMCELL PKSControlPlane(API) NSX-T Application Dev/Ops Owner Platform Reliability Engineer Self Serve CRUD K8s Clusters Ops Manager Container Registry GCP Service Broker “The Dude abides…”
- 19. 19 BOSH CFCR BOSH RELEASE BOSH STEMCELL PKSControlPlane(API) Container Registry GCP Service Broker NSX-T Application Dev/Ops Owner Platform Reliability Engineer Self Serve CRUD K8s Clusters Ops Manager NamespaceNet NamespaceNet NamespaceNetNamespaceNet NamespaceNet NamespaceNet “The Dude abides…”
- 20. 20 Fault-tolerance for masters, workers, and etcd nodes Auto-scaling of masters, workers, and etcd nodes Routine health checks and self- healing of cluster LCM includes rolling upgrades to ensure workload uptime & application of CVEs ScalingHigh Availability Health Checks & Healing Lifecycle Management “It's good knowin' he's out there. The Dude”
- 21. @cloudnativeapps #vmwcna #vmwpks vmware.github.io Thank You! Cloud Foundry Container Runtime (CFCR/Kubo) Pivotal Container Services (PKS) blogs.vmware.com/cloudnative 21
Editor's Notes
- Harbor can provide a necessary layer in detection of CVE’s. In the layers presented in the slide: Hypervisor vulnerability scanning & patches are provided by VMware VM vulnerability scanning & patches of stemcells are provided by Pivotal & VMware Container Image vulnerability scanning is provided by Harbor, allowing patch resolution to occur before images are deployed into production If CVEs are patched at any layer above Worker, simply ‘rebuild or restart’ the containers Hypervisor CVE rarely cause container downtime
- Harbor can provide a necessary layer in detection of CVE’s. In the layers presented in the slide: Hypervisor vulnerability scanning & patches are provided by VMware VM vulnerability scanning & patches of stemcells are provided by Pivotal & VMware Container Image vulnerability scanning is provided by Harbor, allowing patch resolution to occur before images are deployed into production If CVEs are patched at any layer above Worker, simply ‘rebuild or restart’ the containers Hypervisor CVE rarely cause container downtime
- Harbor can provide a necessary layer in detection of CVE’s. In the layers presented in the slide: Hypervisor vulnerability scanning & patches are provided by VMware VM vulnerability scanning & patches of stemcells are provided by Pivotal & VMware Container Image vulnerability scanning is provided by Harbor, allowing patch resolution to occur before images are deployed into production If CVEs are patched at any layer above Worker, simply ‘rebuild or restart’ the containers Hypervisor CVE rarely cause container downtime