KubeCon + CloudNativeCon + Open Source Summit + AI_dev China 2024

With the deployment of service mesh technologies like Istio, reducing latency overhead caused by data plane proxy architecture has become a critical concern for mesh providers. In this conference, Zhong Hu and Song Yang will propose a fresh solution for the service mesh data plane from an operating system perspective. By leveraging eBPF + kernel enhancements, they enable native traffic governance capabilities in the OS. Unlike other solutions, this approach significantly simplifies the forwarding path of the mesh data plane, resulting in a 60%+ reduction in data plane forwarding latency. In addition, it features low resource overhead and secure isolation. The project redefines the mesh data plane, with Istiod as the control plane, and Huawei is currently conducting internal verification. Furthermore, they will discuss the future evolution of service mesh and exploring the potential of sidecarless architecture in diverse deployment scenarios.

随着像Istio这样的服务网格技术的部署，减少由数据平面代理架构引起的延迟开销已成为网格提供商的一个关键关注点。在本场演讲中，钟虎和宋洋将从操作系统的角度提出一种全新的服务网格数据平面解决方案。通过利用eBPF +内核增强功能，他们在操作系统中实现了原生流量治理能力。与其他解决方案不同，这种方法显著简化了网格数据平面的转发路径，导致数据平面转发延迟降低了60%以上。此外，它具有低资源开销和安全隔离的特点。该项目重新定义了网格数据平面，以Istiod作为控制平面，华为目前正在进行内部验证。 此外，他们将讨论服务网格的未来演变，并探索在不同部署场景中无边车架构的潜力。

RISC-V has got noticed from many areas apparently. But in the real world there are the existing challenges for running workload on RISC-V based targets. From cloud to edge you can see the trend of deploying workloads on such sandboxed microservice platforms - containers, k8s, etc. Actually the underlying sandbox technologies are also evolving with something new like WebAssembly that's been considered as the future computing. In the real world we start running WebAssembly as an alternative lightweight runtime side-by-side with Containers and VMs. Here we'd like to review if-how we can build this multi-runtime platform on RISC-V where WebAssembly and container coexists. We will enable to deploy {WebAssembly, Docker} to RISC-V Linux running on a real RISC-V target, and further enable other open source utilities to RISC-V Linux distribution in order to help fit workload into WebAssembly and containers on RISC-V for next explore accelerating open software ecosystem on RISC-V.

RISC-V 显然已经引起了许多领域的关注。但在现实世界中，在基于 RISC-V 的目标上运行工作负载存在着现有的挑战。从云端到边缘，您可以看到在这种沙箱化微服务平台上部署工作负载的趋势 - 容器、k8s 等。实际上，底层的沙箱技术也在不断发展，出现了一些新技术，比如被认为是未来计算的 WebAssembly。在现实世界中，我们开始将 WebAssembly 作为一种轻量级运行时的替代方案与容器和虚拟机并存。在这里，我们想要审查如何在 RISC-V 上构建这种多运行时平台，其中 WebAssembly 和容器共存。我们将使 {WebAssembly，Docker} 能够部署到运行在真实 RISC-V 目标上的 RISC-V Linux，并进一步使其他开源实用工具能够适配到 RISC-V Linux 发行版，以帮助将工作负载适配到 RISC-V 上的 WebAssembly 和容器，以便探索加速 RISC-V 上开放软件生态系统的可能性。

Edge Computing makes the connection broader, faster and more agile, meanwhile it also brings the threat of cyberattacks to the edge of the network, which also puts forward higher requirements for the safety at the edge side. In addition, due to any forms like Internet, 5G, WIFI and other forms are possible, the network environment will be complex and the quality can't be guaranteed in the edge scnee. Therefore, supporting weak network environments which is also a challenge at edge site. KubeEdge is a cloud-edge collaborative architecture project for Kubernetes native edge computing. KubeEdge uses its own trusted tunnel to ensure the security of data transmission, it verifies, encrypts and authenticates all communications in this tunnel. This tunnel ensures data accessibility through QoS and provides a QUIC protocol to improve the performance of network reordering in weak networks. We will share how the tunnel of KubeEdge achieves these goals in this session.

边缘计算使连接更广泛、更快速、更灵活，同时也将网络威胁带到了边缘，这也对边缘安全提出了更高的要求。此外，由于互联网、5G、WIFI等各种形式可能存在，边缘场景中的网络环境将变得复杂，质量无法保证。因此，支持弱网络环境也是边缘场景中的一个挑战。 KubeEdge是一个针对Kubernetes原生边缘计算的云边协作架构项目。KubeEdge使用自己的可信隧道来确保数据传输的安全性，它验证、加密和认证该隧道中的所有通信。该隧道通过QoS确保数据可访问性，并提供QUIC协议来改善弱网络中的网络重排序性能。在本场演讲中，我们将分享KubeEdge隧道如何实现这些目标。