Oracle Cloud Hangout Cafe(おちゃかふぇ)のセッションスライドです。 #ochacafe
(セッションの録画) https://youtu.be/Yh8upp12Ls8
(イベントページ) https://ochacafe.connpass.com/event/203362/
Oracle Cloud - Cloud Native 2021Oracle Cloud NativeKyotaro Nonaka / Takuya Niita / Shuhei KawamuraOracle Corporation JapanMarch 10th, 2021
View Slide
2 Copyright © 2021, Oracle and/or its affiliates.1. Oracle Cloud Native2. Container - by3. API/FaaS - by4. Messaging - by
••• EC• OCHaCafe 5• fitbitCopyright © 2021, Oracle and/or its affiliates.3@non_kyonfitbit……………………..
Copyright © 2021, Oracle and/or its affiliates.4
• API•OSS DIY•••••Copyright © 2021, Oracle and/or its affiliates.5
•OCI• DIYEnd to End••OSSCopyright © 2021, Oracle and/or its affiliates.6InclusiveManaged Open
7Monitoring EventsStreamingObservability + MessagingAPI GatewayContainerEngine forKubernetesResourceManagerCloudInfrastructureRegistryFunctionsNotificationsApplication Development + OperationsLoggingOCIOracle FunctionsCopyright © 2021, Oracle and/or its affiliates.
and more…Copyright © 2021, Oracle and/or its affiliates.8API GatewayContainerEngine forKubernetesCloudInfrastructureRegistryFunctions Streaming
Container編Takuya NiitaOracle Corporation JapanMar 10, 2021Copyright © 2021, Oracle and/or its affiliates.9Oracle Cloud Hangout Cafe Premium #3 Oracle Cloud – Cloud Native 2021
••• SIer• Oracle• Cloud Native•• OCHaCafe 4Copyright © 2021, Oracle and/or its affiliates.10@takuya_0301
Oracle Container Engine for Kubernetes(OKE)• 2•• VCN API ServerEndpoint Private• OCI LB Canal (CNI)• Service OCI LoadBalancer( )• OCI LB IngressController• SC/PC/PVC OCI FSS Block Volume• OCI IAM OCI Audit• OCI Service Broker• HPA/VPA/Cluster AutoscalingOracle Cloud Infrastructure Registry(OCIR)• Docker Registry HTTP API V2 docker•• OCI•Copyright © 2021, Oracle and/or its affiliates.11
KubernetesOracle Container Engine for Kubernetes (OKE)Copyright © 2021, Oracle and/or its affiliates.12/ /HPCVisual Builder Studio CI/CDOracle Cloud Service• OCI Registry (OCIR)OKEServiceBrokerObjectStorageStreamingEventsDatabaseSystemContainer EngineFor KubernetesVirtual MachineLoadBalancerContainer RegistryContainer EngineFor Kubernetes
••• Kubernetes• v1.18.10/v1.17.13/v1.17.9/v1.16.15/v1.16.8(2021/3 )• Worker Node• Private Subnet• Public Subnet•• VM/BM/HPC CPUflexible shape••• 50GB• 32TBOracle Container Engine for Kubernetes(OKE)Copyright © 2021, Oracle and/or its affiliates.13
•• etcd• OCI Vault Key• Pod Security Policy(PSP)• VCN• OKE VCN• Load Balancer Subnet• Kubernetes (Cluster IP) CIDR• Pod IP CIDR• Master Node(API Server) Endpoint(Private/Public)• OS•Oracle Container Engine for Kubernetes(OKE)Copyright © 2021, Oracle and/or its affiliates.14
OKE• Service type: Load BalancerOCI LoadBalancer (TCP/HTTP)•• HTTPS• LoadBalancer shape• 10Mbps/100Mbps/400Mbps/8000Mbps• Flexible Shape(LB )• Ingress Controller NGINX IngressController for Kubernetes• flannel• Network Policy Calico(Canal )Oracle Container Engine for Kubernetes(OKE)Copyright © 2021, Oracle and/or its affiliates.15metadata.annotation
Block Volume Persistent Volume• OKE build-in CSI(ContainerStorage Interface) ”oci-bv”• Persistent VolumeClaim(PVC)• 50GBOracle Container Engine for Kubernetes(OKE)Copyright © 2021, Oracle and/or its affiliates.16FSS Persistent Volume• FSS• StorageClass(SC)/PesistentVolume(PV)• SC mount target• PV NFS• Persistent Volume Claim(PVC)
HPA(Horizontal Pod Autoscaling)• HPA• HorizontalPodAutoscaler••CPU• Pod• PodVPA(Vertical Pod Autoscaling)• VPA•• https://github.com/kubernetes/autoscaler/tree/master/vertical-pod-autoscaler• Resource RequestCluster Autoscaling• OKE ClusterAutoscaling Pod•Oracle Container Engine for Kubernetes(OKE)Copyright © 2021, Oracle and/or its affiliates.17[opc@oke-client ~]$ kubectl apply -fhttps://github.com/kubernetes-sigs/metrics-server/releases/download/vx.x.x/components.yaml
OCI• Kubernetes RBAC Authorizer OCI IAMOCI OKE• manifest kubectl OCIOCID ID• Ex) Pod••• OKE• Role• RoleBinding• OCI Audit API ServerOracle Container Engine for Kubernetes(OKE)Copyright © 2021, Oracle and/or its affiliates.18RoleRoleBindingID( OCID)
OKE Roadmap• Kubernetes v1.19• OCI Monitoring/OCI Logging• OCI IAM Kubernetes RBAC Authorizer• OCI IAM RBAC• Worker Node• Worker Node GPUOracle Container Engine for Kubernetes(OKE)Copyright © 2021, Oracle and/or its affiliates.19
Copyright © 2021, Oracle and/or its affiliates.20Docker KubernetesDocker v2OKEOracle Cloud Service• Oracle Container Engine for Kubernetes (OKE)ContainerRegistryOKEContainer EngineFor KubernetesVirtual MachineContainer Registry
OCIR• Docker Registry HTTP API V2• docker• docker login• docker pull• docker push• API• docker login•• docker login nrt.ocir.io• OCI•• OCIR••Oracle Cloud Infrastructure Registry(OCIR)Copyright © 2021, Oracle and/or its affiliates.21
OCIR•••• pull•••••• 1Oracle Cloud Infrastructure Registry(OCIR)Copyright © 2021, Oracle and/or its affiliates.22
OCIR Roadmap• IP••• pushOracle Cloud Infrastructure Registry(OCIR)Copyright © 2021, Oracle and/or its affiliates.23
Oracle Container Engine for Kubernetes(OKE)• 2•• VCN API EndpointPrivate• OCI LB Canal (CNI)• Service OCI LoadBalancer( )• OCI LB IngressController• SC/PC/PVC OCI FSS Block Volume• OCI IAM OCI Audit• OCI Service Broker• HPA/VPA/Cluster AutoscalingOracle Cloud Infrastructure Registry(OCIR)• Docker Registry HTTP API V2docker•• OCI•OCICopyright © 2021, Oracle and/or its affiliates.24
Copyright © 2021, Oracle and/or its affiliates.25
Oracle Cloud Native• https://github.com/oracle-quickstart/oci-cloudnative• Microservices Architecture on OKE• Autonomous Database Object Storage1 Click• OCI Resource ManagerCopyright © 2021, Oracle and/or its affiliates.26
Copyright © 2021, Oracle and/or its affiliates.27
• Gatling HTTP• https://gatling.io/• Edge-Router•• Mushop URL( Load BalancerURL)•• 100 / 1OKE HPA(Horizontal Pod Autoscaler)Copyright © 2021, Oracle and/or its affiliates.28
FaaS, API編Shuhei KawamuraOracle Corporation JapanMar 10, 2021Copyright © 2021, Oracle and/or its affiliates.29Oracle Cloud Hangout Cafe Premium #3 Oracle Cloud – Cloud Native 2021
Copyright © 2021, Oracle and/or its affiliates.30• (Shuhei, Kawamura)••• 2020/10/15•• ( ) ( )• Cercle, King Gnu• etc.• : !!@shukawam shukawam shukawam
Oracle Functions••• Logging Function• (Notifications Function)•API Gateway••• OpenAPI 2.0 & 3.0• JWT ( )•Copyright © 2021, Oracle and/or its affiliates.31
FaaS(Oracle Functions)• Managed• FaaS•• Inclusive•• Open• OSS Fn Project (https://fnproject.io/)Docker•••API Gateway• Managed• API•• Inclusive•• Open• OpenAPI (2.0 & 3.0)Copyright © 2021, Oracle and/or its affiliates.32
OSS Fn ProjectDocker• OCI• Events• OCI Logging• Notification• …• Function (FDK)• Java, Python, Go, Node.js, RubyCopyright © 2021, Oracle and/or its affiliates.33Oracle CloudInfrastructureOracle CloudInfrastructureEvents OracleFunctionsAPI Gateway StreamingMobile WebAppIoTPLANNED!!!
Copyright © 2021, Oracle and/or its affiliates.34Oracle Cloud InfrastructureOracle FunctionsApplicationVirtual Cloud NetworkFunctionDefinitionInstanceIAM User + PolicyDynamic Group + PolicyOracle CloudInfrastructureRegistry (OCIR)schema_version: 20180708name: fn-hello-javaversion: 0.0.1runtime: java11build_image: fnproject/fn-java-fdk-build:jdk11-1.0.118run_image: fnproject/fn-java-fdk:jre11-1.0.118cmd: com.example.fn.HelloFunction::handleRequestfunc.yamlDocker, Fn CLI, Runtime etc.$ fn deploy --app Set functions def.Image pushImage pullInstance/Container createInvoke Events:• Events, Notifications• HTTP• Fn CLI• Oracle Cloud Infrastructure SDK
https://speakerdeck.com/oracle4engineer/lets-dive-serverless-worldCopyright © 2021, Oracle and/or its affiliates.35
• IAM Policy Builder Functions• Function 2 5• Function Application• UC••• PAYG••• Oracle Cloud Infrastructure Logging• Logging Function(Service Connector Hub)• Notifications Function( )Copyright © 2021, Oracle and/or its affiliates.36
••• /• (SQL )••• Functions Object Storageetc.Copyright © 2021, Oracle and/or its affiliates.37LoggingVCNFlow LogsApplication Object StorageAuditingOracle FunctionsStreamingObjectStorage
• Service Connector Hub(SCH)Function• Function•• OCI••• 3rd party•• …Copyright © 2021, Oracle and/or its affiliates.38LoggingFunctionsOracle FunctionsSCHInvokeOCI Resources{"data": {"applicationId": “ocid.fnapp.oc1…",// ..."message": “Logging Test"// ...}// ...}Functions ( )
MonitoringPub/SubEmail Delivery, Functions, PagerDuty, Slack,HTTPsCopyright © 2021, Oracle and/or its affiliates.39NotificationsNotificationsEventsMonitoring NotificationsTopicEmail DeliveryOracle FunctionsServiceApplicationOracle Cloud ServiceEvents, Monitoring, Oracle Functions, APIGateway, Email DeliveryHTTPsEndpoint
• OCI Notifications Function• Service Connector Hub• Notifications•• Service Connector Hub••• Monitoring VM•• …Copyright © 2021, Oracle and/or its affiliates.40NotificationsNotificationsTopicOracle FunctionsFunctions( )
• Streaming Triggered Functions• Service Connector Hub Streaming Functions• Scheduled Functions• Functions••• Cold Start…Copyright © 2021, Oracle and/or its affiliates.41
APIAPI Gateway (OracleFunctions/OKE/ API/ )REST API••• JWT• CORS• API••• GUI/JSON Gateway•• OpenAPI 2.0/3.0Copyright © 2021, Oracle and/or its affiliates.42Internet(Public/Private)Other PublicAPI ServicesLoadBalancerOKEOracleFunctionsOn-PremAPI ServerDynamicRoutingGatewayAPI GatewayOracle CloudInfrastructureAuthentication
• OpenAPI 2.0 & 3.0• TLS• Logging•• JWT ( )Copyright © 2021, Oracle and/or its affiliates.43
• API Gateway OpenAPI (2.0 & 3.0)• API• API → Gateway•• OpenAPI API Gateway• Path, Method, Status Code• (examples)• ( etc.)Copyright © 2021, Oracle and/or its affiliates.44openapi: '3.0.2'info:title: Employee APIversion: '1.0'servers:- url: https://oci-api-gateway-hostpaths:# .../employee:get:responses:'200':description: return all employee.# ...examples:OpenAPI(JSON/YAML)APIAPIAPI Gateway API
”Authorizer Functions” ”JWT Validator”Authorizer Functions• HTTPAPI GatewayOracle FunctionsAPI•JWT Validator• HTTP Identity ProviderJWT API GatewayAPI•Copyright © 2021, Oracle and/or its affiliates.45Client API Gateway API DeploymentsOracle FunctionsClient API Gateway API DeploymentsIDCSIdentity Provider
Copyright © 2021, Oracle and/or its affiliates.46Client BackendAPI GatewayAuth Server認証トークン取得トークンの検証 [^1](署名の検証& クレームの検証)検証失敗:HTTP 4xx検証成功: API RequestAPI Response API Response公開鍵の取得JWT Validator[^1]: トークンの改ざん検証に使用する公開鍵について1. APIの実行時に動的に公開鍵を取得し、使用する2. あらかじめ発行されている公開鍵(静的キー)を使用するリクエストヘッダ/クエリパラメータにトークンを含めてリクエスト
OpenID Connect1. IDCS (ID Token, Access Token)2.API3. API Gateway Access Token• JWT• (API)••4. Access Token scope API GatewayscopeAPI5. …Copyright © 2021, Oracle and/or its affiliates.47IDCSClientAPI GatewayIDCS1. OpenIDConnect2. API Request3. &ID TokenAccess Tokenuserscopelist,create,update,delete4. scopeOracle Functions(A)Oracle Functions(B)VSCode(REST Client)Access Tokenscope: listscope: dummyScope
••••…Copyright © 2021, Oracle and/or its affiliates.48
Oracle Functions• IAM Policy BuilderFunctions• Function 2 5• Function Application• Oracle Cloud Infrastructure Logging• Logging Function(Service Connector Hub)• Notifications Triggered FunctionAPI Gateway• OpenAPI 2.0 & 3.0• TLS• Logging•• JWTCopyright © 2021, Oracle and/or its affiliates.49
Copyright © 2021, Oracle and/or its affiliates.50Oracle Cloud Hangout Cafe Premium #3 Oracle Cloud – Cloud Native 2021
Oracle Cloud Infrastructure Streaming Service (Streaming)• Streaming• Streaming• Producer Consumer/Consumer Group• Streaming••Copyright © 2021, Oracle and/or its affiliates.51
Web/Mobile IoTStreamingPub/SubStreaming API SDK• Kafka APICopyright © 2021, Oracle and/or its affiliates.52IoT Mobile/WebActivitiesAppKafkaClientEvents API GatewayDatabaseSystemObjectStorageFunctionsStreamingOracle Cloud Service• Events ( )• Oracle Functions ( )• API Gateway
Streaming• Stream : Partition Message• Stream Pool : Stream•• Message : Base64 (Key Value )•• Key : Message Key Message Partition530 1 2 3 4 5Partition00 1 2 3 4Partition10 1 2 3 4 5 6Partition2StreamMessage(Key Partition )Stream PoolCopyright © 2021, Oracle and/or its affiliates.
Streaming• Offset : Partition Message••• Cursor : SDK Stream Massage••• Partition : Stream Message••540 1 2 4 5 7PartitionStreamOffsetCursorCopyright © 2021, Oracle and/or its affiliates.
• Stream ※• Stream Pool••• Message• Partition (= )••Copyright © 2021, Oracle and/or its affiliates.55
Producer : Message (Publish)• Key Message Partition•• Key Partition Key (first-in/first-out)Consumer : Message (Subscribe)• Message Message•• Message Offset560 1 20 10StreamProducer 1PutMessage API GetMessage APIProducer 2Producer 3Consumer 1Consumer 2Consumer 3Partition0Partition1Partition2Key0ValueKey2ValueKey1ValueKey2ValueKey0ValueCopyright © 2021, Oracle and/or its affiliates.
Stream API (Produce)• Stream OCI APIMessage (Consume) Cursor• Offset Cursor Partition• Cursor Partition Message• Cursor Message NextCursorProduce/Consume• Kafka API• Kafka Connect57 Copyright © 2021, Oracle and/or its affiliates.
OCI SDK StreamingAPI• StreamingKafka API• Kafka•Kafka Connect•MessagingService Connector Hub• OCI• StreamingCopyright © 2021, Oracle and/or its affiliates.58OCI SDKKafkaConnectServiceConnectorHubKafkaAPI
• InstancePrincipals (https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/callingservicesfrominstances.htm)• StreamClient Endpoint RegionCopyright © 2021, Oracle and/or its affiliates.59
• key(partition) value()• Stream OCID streamIdrequestCopyright © 2021, Oracle and/or its affiliates.60
• ConsumeCursor• Type(https://docs.oracle.com/en-us/iaas/Content/Streaming/Tasks/using_a_single_consumer.htm#usingcursors), partition, streamIdCopyright © 2021, Oracle and/or its affiliates.61
• ConsumeCursor• Type(https://docs.oracle.com/en-us/iaas/Content/Streaming/Tasks/using_a_single_consumer.htm#usingcursors), partition, streamIdCopyright © 2021, Oracle and/or its affiliates.62
• Cursor streamId Consume• Response Message NextCursorCopyright © 2021, Oracle and/or its affiliates.63
•• Kafka Connect• OCI API(Streaming API) Kafka API• APICopyright © 2021, Oracle and/or its affiliates.64Kafka ConnectProducerKafka ConnectConsumerStreamingStreaming APIKafka API
Copyright © 2021, Oracle and/or its affiliates.65
Copyright © 2021, Oracle and/or its affiliates.66Stream pool Kafka APIKafka
Copyright © 2021, Oracle and/or its affiliates.67
Copyright © 2021, Oracle and/or its affiliates.68
Oracle Kafka Connector• Oracle Cloud Infrastructure Object Storage(S3 API )••• Oracle Integration Cloud• Oracle Database (Kafka Connect JDBC )• Oracle GoldenGateCopyright © 2021, Oracle and/or its affiliates.69Kafka Connect
Oracle CloudInfrastructure•••Copyright © 2021, Oracle and/or its affiliates.https://blogs.oracle.com/cloud-infrastructure/oracle-cloud-infrastructure-service-connector-hub-now-generally-available70
DB StreamingFunctions• DB•OCR +• Functions ( 5 )•Copyright © 2021, Oracle and/or its affiliates.71ServiceConnector HubFunctionsStreamingAutonomousDatabaseDatabaseSystemServiceConnector HubFunctionsStreamingGPUHPCData Flow(Spark)
Flexible Streaming:• Re-Partitioning – Partition /• Fatter Partitions – Partition /• Autoscaling – Partition Vertical/Horizontal• Unlimited Data RetentionIntegrations:• Native integration with Oracle Autonomous database• Native integration with OCI DataFlow (Serverless Spark)• Integration with OCI Data Catalog (Schema registry)Copyright © 2021, Oracle and/or its affiliates.72
Copyright © 2021, Oracle and/or its affiliates.73
OCI SDK Kafka API• Message Produce OCI SDK Streaming API publish• Partition 0 OCI SDK Streaming API consume• Partition 1~3 Kafka API consumeCopyright © 2021, Oracle and/or its affiliates.74ProducerConsumerStreamingStreaming APIKafka APIKafkaConsumerpartition0partition1partition2partition3partition1partition2
75 Copyright © 2021, Oracle and/or its affiliates.
Our mission is to help people seedata in new ways, discover insights,unlock endless possibilities.