Cloud native ecology Weekly Vol 16 |. CNCF archive rkt, container runtime "ancient" of the war veterans dying

List of Authors: Su wood, stone face, get to, etc.

Industry News

1. Security-2019-9512 vulnerability CVE
Attack
CVE-2019-9514 vulnerability HTTP2 of DOS, if successful, will run out of server cpu / mem, resulting in service is unavailable.
Related Links:https://discuss.kubernetes.io/t/security-release-of-kubernetes-v1-15-3-v1-14-6-v1-13-10-cve-2019-9512-and-cve-2019-9514/7596/1

2.CNCF of rkt archiving project

rkt CoreOS company is in the early CNCF donated container runtime project. That time Docker heady, Missing Piece, the open source community has been hoping for more Docker can listen to the voice of the community at that time but could Docker is a container runtime (open source) is the only choice. rkt appear to the user community and a Alternative, provides a justification for access later CRI standards such as container operation. However, with the container runtime harmonization of standards (CRI, CSI, CNI, etc.), rkt community activity is greatly reduced, some of CVE has been slow to repair, so CNCF decided to archive rkt. At present there are two container CNCF running the project: containerd and CRI-O.
Related Links:https://www.cncf.io/blog/2019/08/16/cncf-archives-the-rkt-project/

3.GitHub supports the use of CI / CD functions on Azure, the public will have free use of warehouse development, related features include: authorization, application deployment way, way container deployment, K8s of deployment, etc. (azure / actions (login ), azure / appservice-actions, azure / container-actions, azure / k8s-actions).

Significant progress upstream

Support kube-apiserve r of service, Kubernetes can support clusterIP and externalName, let kube-apiserver can be accessed directly FQDN other Pod.
KEP link:

https://github.com/kubernetes/enhancements/pull/1216
related to similar PR:
A.https://github.com/kubernetes/kubernetes/pull/47588
b.https://github.com/kubernetes/kubernetes/pull/79312

2.request-faireness documentation updates, mainly KEP modify the document based implementations.
. a progress tracking:https://github.com/kubernetes/kubernetes/issues/76846
. b design and implementation:https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/20190228-priority-and-fairness.md#design-details
c this PR. : //github.com/kubernetes / enhancements / pull / 1214

3. The number of Metric be revised. The main content:
a.cAdvisor: label indicators "pod_name", "container_name" to "POD", "Container";
b.API Histogram buckets Latency: 125ms before is to 8s, support range [0.01 0.005 0.025 0.05 0.1 0.25 0.5 10. 5 2.5. 1];
c.kubelet: promethues modified metrics as histograms and other types of summary, becomes second units;
d.kube-Scheduler: unit becomes second;
e.Kube-Proxy: unit becomes second, delete indicators: DeprecatedNetworkProgrammingLatency;
f.kube-apiserver: apiserver_request_latency_seconds window becomes larger, follow-up can be more refined;
g.Convert Latency / latencies in metrics name to DURATION;
h.Client-Go: workingqueue renamed indicators, monitoring indicators in line with specifications.

Open source projects recommended

1.k3sup: easy access kubeconfig of tools from a machine.
link:https://github.com/alexellis/k3sup

2.Gatekeeper: Policy Controller for Kubernetes, OPA's K8s a policy configuration tool is different.
link:https://github.com/open-policy-agent/gatekeeper

3.ktop: A visualized monitoring dashboard for Kubernetes , K8s visual monitoring of a dashboard.
link:https://github.com/ynqa/ktop?utm_sq=g3i5hm4xyz

4.System-validators. This is a new project that aims to provide a preflight check of the installation is Kubeadm, private environment that seems to help deploy K8s save a lot of time, staff in related fields will be of great help.

link:https://github.com/kubernetes/system-validators

This week Recommended Reading

1.OPA Gatekeeper: Policy and Governance for Kubernetes. This blog describes how to use OPA Gatekeeper the rules and policy configuration K8s in. (For example: How to configure the operating rights in line with company policy for users?)
https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/
. A still another article about the OPA Recommended: How to enforce custom policies on Kubernetes objects using OPA. link:https://www.openpolicyagent.org/docs/latest/kubernetes-admission-control

2.The Case for Virtual Kubernetes Clusters. Virtualization K8s cluster is the technical community and the program is currently of great concern to many users, the main source of demand is multi-tenant. If you are in this area is not very understanding, reading this article will help.
link:https://thenewstack.io/the-case-for-virtual-kubernetes-clusters/?utm_source=tuicool&utm_medium=referral

Learn ACK container services, check https://www.aliyun.com/product/kubernetes
Ali cloud container service China the best, enter Forrester report strong performance Quadrant