Overview of VMware Enterprise PKS

1. ©2019 VMware, Inc.
Run and Operationalize
Kubernetes in Production
VMware Enterprise PKS Overview
February 2019

2. Confidential │ ©2019 VMware, Inc. 22
Enterprises are Embracing Cloud Native Methodology
Container technology is being adopted across all industries
Increase
Developer
Productivity
Deliver Better
Customer
Experiences
Accelerate
Time-to-Market
Gain
Operational
Efficiency

3. Confidential │ ©2019 VMware, Inc. 33Confidential │ ©2018 VMware, Inc.
Kubernetes has Become the De Facto Container Orchestrator
Source: Cloud native Computing Foundation User Survey 2018
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Kubernetes Docker Mesos

4. Confidential │ ©2019 VMware, Inc. 44Confidential │ ©2018 VMware, Inc.
Challenges of Running Kubernetes in Production
Source: Cloud native Computing Foundation User Survey 2018
0%
5%
10%
15%
20%
25%
30%
35%
40%
45%
VMware Enterprise PKS Addresses These Challenges

5. 5©2019 VMware, Inc.
VMware Enterprise PKS

6. ©2019 VMware, Inc.
VMware Enterprise PKS
• Deploy clusters on demand
• Simplified Patching,
Upgrading, Scaling
• Integration with platform
pipeline
Easy to Use and
Maintain
• NSX-T Micro-
segmentation
• Rotate, Repair, Repave
• Image CVE scanning,
Content Trust
Highly Secure by
Default
• Wavefront
• vRealize Log Insight
• Network Insight
• vRealize Automation
• Prometheus, Jaeger,
Grafana, Istio
• Cluster as a unit of
tenancy
• Namespace as a unit
of tenancy
• LDAP/AD Integration
Flexible
Multi-Tenancy
• Health Monitoring and
Self-healing
• Kubernetes manages app
layer availability
• BOSH manages
infra/cluster layer
availability
Highly Available “Dial
Tone” Kubernetes
Highly Integrated
Ecosystem
VMware Enterprise PKS is a turnkey solution for organizations that want to deploy and operate an
integrated, validated upstream Kubernetes footprint

7. ©2019 VMware, Inc. 7
Kubernetes is Only One Layer of the Container Service Stack
Image Registry
Framework Lifecycle Management
Security and Networking
Persistence
Virtual Infrastructure
Physical Infrastructure
Monitoring,Logging,Analytics
Cluster Health Monitoring, Healing and
Lifecycle Management
Scheduling,
Orchestration, Service Creation
vSAN, Hatchway
vSphere
Physical Infrastructure
NSX-T
Enterprise PKS Control Plane
BOSH (cluster LCM)
Kubernetes
Harbor
vRealizeSuite

8. ©2019 VMware, Inc. 8
BOSH
NSX-T
Service Brokers
etcd worker etcd workermaster
PKS Control Plane
Kubernetes Cluster
VMware Enterprise PKS
Security
Container
Registry
master
Kubernetes Cluster
vRealize
Automation
vRealize
Log Insight
vRealize
Operations
vRealize
Network
Insight
Wavefront
by VMware
VMware Enterprise PKS: Marketecture
vSphere
vSAN
Public Clouds
Public Cloud Storage

9. Confidential │ ©2019 VMware, Inc.
Who is VMware Enterprise PKS Built For?
IT
Operator
– PRE (Platform Reliability
Engineering)
– Deploy, Scale, Operate VMware
PKS
– Physical Infrastructure is Operated
– Network & Security Control Policy
is defined
• Developers
– Writes code, code deployed using CI/CD
– Focus on business problems and innovation
• Application Dev/Ops owner
– Automate Everything
– Agile
– Serve developers
• Platform Reliability Engineers
– Platform is Reliable
– Capacity Is planned for
– Platform is Secured & Controlled
– Platform is Auditable
Application
Dev/Ops Owner
Platform
Reliability Engineer
Developers
– Develop, Deploy, Scale,
Monitor Apps
– Innovation of Business
Capability as Cloud native
Apps
– Create K8s cluster, scale
clusters and maintain the
health customers
– Provide developer access
to the cluster

10. Confidential │ ©2019 VMware, Inc. 1010Confidential │ ©2018 VMware, Inc.
A turnkey solution to provision, operate and manage enterprise grade Kubernetes clusters
VMware Enterprise PKS
Latest stable native Kubernetes,
CNCF certified
Production-grade Kubernetes based
container platform
Deep integration with NSX-T for
networking and security
Globally supported on
vSphere, GCP, AWS, and Azure
Secure, enterprise-grade container
registry
Consistent infrastructure for traditional
and modern applications

11. 11©2019 VMware, Inc.
Addressing the Common
Kubernetes Challenges
Complexity
Scaling Deployment
Networking
Storage
Monitoring & Logging
Security

12. Confidential │ ©2019 VMware, Inc. 1212Confidential │ ©2018 VMware, Inc.
• Constant monitoring and self-healing of VMs
• Easy scaling and patching for clusters
• Rolling upgrades to latest Kubernetes release
• High availability and multi-AZ support
VMware Enterprise PKS Simplifies “Day 1” and “Day 2” of Kubernetes Clusters
• Deploy Kubernetes cluster on
demand
• Simple API and CLI interface
Day 2 “Operate”
Day 1 “Build”

13. Confidential │ ©2019 VMware, Inc. 1313Confidential │ ©2018 VMware, Inc.
IaaS
Node
Node
Kubernetes
Cluster Services
API
Cluster3
NSX-T
vSphere
VMware PKS includes:
• VMWare PKS Control Plane,
CFCR
• NSX-T, Harbor, Service Broker
• BOSH Release for Kubernetes
• Configures Day 1 of
- CFCR
- vSphere/Public Clouds
- NSX Integration
- Harbor
• Manages Day 2 of
Kubernetes Clusters
- Scaling
- Patching
- Upgrades
- Failures
CFCR
Kubernetes
(As a BOSH Release)
BOSH
(Deploys/Manages VMs & state)
CPI
CNI
Harbor
Private Container
Registry
The value of BOSH
VMware Enterprise PKS - “How it Works”
Node
Node
Node
Kubernetes
Cluster Services
API
Node
Node
Node
Kubernetes
Cluster Services
API
Node
Cluster1
Cluster2
Service
Broker (s)
API
#pks create-cluster K8s-1 -n 3#pks create-cluster K8s-2 -n 3#pks create-cluster K8s-3 -n 3#pks resize K8s-3 –n 5
VMware PKS Control Plane
VM
VM
VM
VM
VM
VM
VM
VM
VM
Node
Node
Kubernetes
Cluster Services
API
Cluster3 Node
Node
Node
VM
VM
VM
VM
VM

14. 14©2019 VMware, Inc.
Addressing the Common
Kubernetes Challenges
Complexity
Scaling Deployment
Networking
Storage
Monitoring & Logging
Security

15. Confidential │ ©2019 VMware, Inc. 1515Confidential │ ©2018 VMware, Inc.
Best-in-Class Kubernetes Networking with NSX-T
NSX-T is included in VMware Enterprise PKS to enable
• Networking virtualization and automation for Kubernetes
• Complete set of Layer 2 through Layer 7 networking services
• Pod-level networking and micro-segmentation
• Rich set of management and troubleshooting tools
• Layer 4 load balancer (not just layer 7 load balancer) for
supporting a wider range of applications
• Security policy that can apply to both your containers and VMs
workloads

16. Confidential │ ©2019 VMware, Inc. 1616Confidential │ ©2018 VMware, Inc.
Canal
Comparing NSX-T to Open Source Networking Options
L2
L3 (North/South)
L4 – Security Policy
Load Balancing
VM & K8s Connectivity
End-to-End
Configuration & troubleshooting
Ops tools & central stats
Flannel
L2 only (East/West Pod Traffic)
Calico
L3/L4 (IP Tables)
NGINX/HA Proxy
Load balancing
No End-to-End configuration & troubleshooting
New ops tools + Different locations for stats
NSX-T
Only for Kubernetes Networking

17. Confidential │ ©2019 VMware, Inc. 1717
Container Networking & Security Operations
NSX-T Operational
Tools
• Traceflow
• Port Mirroring
• Port Connection
Tool
• Spoofguard
• Syslog
• Port Counters
• IPFIX
17
NSX-T Traceflow
With NSX-T you are gain deep visibility into the container networks, and you can use the same
troubleshooting tools we created for VM based workloads

18. 18©2019 VMware, Inc.
Addressing the Common
Kubernetes Challenges
Complexity
Scaling Deployment
Networking
Storage
Monitoring & Logging
Security

19. Confidential │ ©2019 VMware, Inc. 19
Persistent Storage with Kubernetes
• You need a storage platform with the right Cloud
Provider (Storage Plugin) for Kubernetes
• You must configure the Kubernetes Cluster and all
the nodes
– Configuration Management everywhere
• Available features & functionality dictated by storage
platform keeping up with Kubernetes releases
• Maintaining the “Platform” over time
– Update all your configuration management
– End-to-end Testing (Compatibility of System)
– High risk of snowflakes
Must have available Kubernetes
Cloud Provider
Node
Node
Node
Kubernetes Cluster
Services
API
V
V
V
CP
CP
CP
CP
Storage Platform
VM
VM
VM

20. Confidential │ ©2019 VMware, Inc. 20
VMware Enterprise PKS Provides Persistent Storage for Running
Stateful Apps on Kubernetes
• Entire HCL of storage products under vSphere Supported with Kubernetes
• Operational Consistency - Existing Storage Operations, Tooling, and SPBM
• Self Service Storage provisioning through Storage Class Mapping to SPBM Policies
• VMware Enterprise PKS delivers the consistent, repeatable configuration & maintenance of
Hatchway
Kubernetes Consumption
• Storage Class = Regular
• Storage Class = Fast
• Storage Class = Encrypted
• Storage Class = Dedup
• Storage Class = …
K8s API
SPBM
• Thin
• SSD
• Encrypted
• Dedup
• …
vSphere
Any Supported
Storage on HCL
vSAN|VMFS|NFS
Datastore
Project
Hatchway https://github.com/vmware/hatchway

21. 21©2019 VMware, Inc.
Addressing the Common
Kubernetes Challenges
Complexity
Scaling Deployment
Networking
Storage
Monitoring & Logging
Security

22. Confidential │ ©2019 VMware, Inc. 2222Confidential │ ©2018 VMware, Inc.
Automated deployment & configuration from infrastructure to applications
Monitoring & Logging at Scale with VMware Integration
Infra K8s Containers Apps
Application
Dev/Ops Owner
Platform
Reliability Engineer
vRLI
vRops Wavefront

23. Confidential │ ©2019 VMware, Inc.
Wavefront & VMware Enterperise PKS Integration
K8s Monitoring Integration w/
Wavefront by VMware
• Pre-Integrated with VMware PKS
• Predefined K8s Alerts
• Comprehensive Dashboards
• Self-Service Metrics Analytics for both
Developers and Operators
Platform
Reliability Engineer
Application
Dev/Ops Owner
Troubleshoot Issues
at Cloud Speed
Trend & Alert
on Anomalies
Visualize Cloud Apps
at Hyperscale

24. Confidential │ ©2019 VMware, Inc. 2424Confidential │ ©2018 VMware, Inc.
Wavefront + VMware Enterprise PKS Dashboard

25. Confidential │ ©2019 VMware, Inc.
vRealize Log Insight and VMware Enterprise PKS Integration
K8s Logging Integration w/
vRealize Log Insight
• Configured via VMware PKS Tile
• Aggregates, Tags, & Ships all logs
to vRLI
• Searchable tags:
Cluster, Pod, Namespace,
Container
• SSL Encryption of Data in Transit
• Log Ingestion Rate Limiting
vRLI
Master / Worker
Nodes Logs
K8s Cluster Events
POD StdOut &
StdErr
vRLI Interactive Analytics

26. 26©2019 VMware, Inc.
Addressing the Common
Kubernetes Challenges
Complexity
Scaling Deployment
Networking
Storage
Monitoring & Logging
Security

27. Confidential │ ©2019 VMware, Inc.
VMware Enterprise PKS Provides Container Security at all levels from infrastructure to
Application
Infrastructure
StorageCompute Networking
Container
Mgmt.
NameSpace
vSphere Google Cloud Platform
Hybrid
NameSpace
NameSpace NameSpace
Container
Mgmt.
NameSpace NameSpace
NameSpace
Operator admin
IAM
• Role Based Access
Control (RBAC)
• Identity Management
• Credential Stores
Events &
Monitoring
• Incident Reporting
• Event Management
• Full Stack Monitoring
Build Pipelines
NameSpace
Platform LCM
Kubernetes Cluster Kubernetes Cluster
Apps Apps
Micro-
service
Micro-
service
Micro-
service
Micro-
service
Micro-
service
Micro-
service
Micro-
service
Micro-
service
Platform LCM
• Repair
• Repave
• Rotate
Container
Management
• Vulnerability Scanning
• Content Trust
• Centralized Policy
Control
Infrastructure
• Cluster Segmentation
• Flow Tracing
• NameSpace
Segmentation
LDAP/AD
Integration
IAM
VNFM
WaveFront
vRealize
Operations
Monitoring
VNFM
WaveFront
App Monitoring

28. Confidential │ ©2019 VMware, Inc.
• user management & access control
• role-based access control
• AD/LDAP integration
• Security vulnerability scanning
(Clair)
• content trust - image signing
• policy based image replication
• audit and logs
• Restful API
• open-source under Apache 2
license
Harbor – Enterprise Grade Private Registry
Project Harbor was accepted
into CNCF as its first container
registry open source project

29. Confidential │ ©2019 VMware, Inc. 2929Confidential │ ©2018 VMware, Inc.
Why VMware Enterprise PKS?
Entire Lifecycle of the Kubernetes
Clusters
Latest Stable Open Source
Kubernetes
Multiple Clusters On-Demand
Best-in-Class Kubernetes Networking
End-to-End K8s Infrastructure
Provisioning
Enterprise Private
Container Registry
Persistent Storage
Integrates With VMware SDDC &
Multi-Cloud

30. ©2019 VMware, Inc.
Thank You
Please email any questions to PowerPoint@vmware.com