Secure, Efficient API Plane Traversal for Compute Resources on Exascale Super Comput...
summary
Cray Shasta uses SPIRE to replace long‑lived service account OIDC tokens with short‑lived workload identities, integrating with Kubernetes, Keycloak, Vault, cert‑manager and OPA and going from idea to production in under 90 days. Current scale tests reach about ~8,000 nodes and expose a thundering‑herd boot problem from heartbeat traffic. Node attestation still relies on joint tokens today; roadmap items include X.509/TPM or ACME attestation, federation of fabric controllers, and API‑driven automatic workload registration.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:04System Management Model
- 3:58Hardware Management
- 6:15Basic Api Interaction
- 10:17Api Driven Workload Registration
- 10:39Federation
- 17:43Heartbeat Mechanism
related talks
37mKubernetesception: How to run a 1000 control planes
39mCloud Native Threat Intelligence for...
38mScaling Kube-Apiserver to Thousands of Tenants – Lessons Learned From kcp
24mNavigating the Maze of Multi-Cluster Istio: Lessons Learned at Scale
31mAn Adventure in Multi Cloud with Kubernetes and Distributed Data
50mScale Kubernetes to Manage 60K Nodes Through Architectural Extension
27mEvolving and Scaling Ray for the Next Generation of AI Workloads
20mAdvancing HPC The Hybrid Scheduler Approach at the D.E.Shaw Group