• A namespace (for names!)
• Delegation of access rights to trusted users from top defined users
• Limits on resource consumption from top delegated resources

• Resources
• Policies
• Constraints

• Resources automatically scoped per OS instance (HM/VM/container)
• Each node manages its own resources, and may voluntarily subordinate by policy
• Resource sharing is managed by individual service (no common user abstraction)

apiVersion: v1
kind: ReplicationController

metadata:
  name: my-nginx

spec:

  replicas: 2

  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx
        ports:
        - containerPort: 80

bundle ReplicationController my_nginx
{
meta:
   "app" string => "nginx";

replica_sets:
   "nginx"
      pod_template => nginx_template,
          replicas => "2";
}

bundle pod_template nginx_template
{
meta:
   "name" string => "nginx";

containers:
   "nginx"
               image => "nginx",
     container_ports => { "80" };
}

apiVersion: v1
kind: Service

metadata:
  name: nginxsvc
  labels:
    app: nginx

spec:
  type: NodePort
  ports:
  - port: 8080
    targetPort: 80
    protocol: TCP
    name: http
  - port: 443
    protocol: TCP
    name: https
  selector:
    app: nginx

---

apiVersion: v1
kind: ReplicationController

metadata:
  name: my-nginx
spec:
  replicas: 1

  template:
    metadata:
      labels:
        app: nginx

    spec:
      volumes:
      - name: secret-volume
        secret:
          secretName: nginxsecret

      containers:
      - name: nginxhttps
        image: bprashanth/nginxhttps:1.0
        ports:
        - containerPort: 443
        - containerPort: 80

        volumeMounts:
        - mountPath: /etc/nginx/ssl
          name: secret-volume

bundle ServiceProxy nginxsvc # is a transducer port in/out
{
meta:

   "app" string => "nginx";

labels:
   "app_nginx" expression => "true";

exterior_service_port:

 app_nginx::

  "8080"
    map_to_port => "80",
       protocol => "tcp",
           name => "http";

  "443"
    protocol => "tcp",
    name => "https";
}



bundle ReplicationController my-nginx
{
replica_sets:
   "nginx"
      pod_template => nginx_template,
          replicas => "1";
}

bundle pod_template nginx_template
{
meta:
   "app" string => "nginx";

containers:
    "nginxhttps"
                  image => "bprashanth/nginxhttps:1.0",
        container_ports => { 443, 80};

volumes:  # storage:

    "/etc/nginx/ssl"
          volume => "secret-volume";
}

{
"kind": "Service",
"apiVersion": "v1",
"metadata": 
        {
        "name": "my-service"
        },

"spec": 
   {
   "selector": 
        {
        "app": "MyApp"
        },

   "ports": 
        [
          {
          "protocol": "TCP",
          "port": 80,
          "targetPort": 9376,
          "nodePort": 30061
          }
        ],

   "clusterIP": "10.0.171.239",     # conflicts with LoadBalancer???
                                    # mistake?
   "loadBalancerIP": "78.11.24.19", # attempt to acquire this IP
   "type": "LoadBalancer"
   },

"status": 
   {
   "loadBalancer": 
       {
       "ingress": 
          [
             {
             "ip": "146.148.47.155"
             }
          ]
       }
   }
}

bundle ServiceProxy my_service
{
exterior_balancer_port:

 MyApp::

 "78.11.24.19/80"
     map_to_port => "9376",
        protocol => "tcp",
        nodeport => "30061";  #???

 # "clusterIP": "10.0.171.239",   

status: 

  "loadBalancer"                         ## ???? what is this?
    ingress => { "146.148.47.155" };
}