Released on the same day as Kubernetes, cadvisor is a container monitoring daemon that collects metrics and serves them to monitoring tools. It's built into the Kubelet, and underpins many components in Kubernetes, such as eviction and autoscaling. David Ashpole of Google Cloud is TL of Kubernetes SIG Instrumentation, and the maintainer of cadvisor; he joins Adam and Craig this week to explain where instrumentation fits in the stack, and what you should do as a Kubernetes maintainer vs. a cluster administrator.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

Chatter of the week

• In Craig's neighbourhood:
  • Books
  • More books
  • Some less popular items
• Masks
  • Archie the Mammoth
• National Ice Cream Day
  • Carmel
  • Caramel

News of the week

• GKE Ingress features:
  • BackendConfig CRD
  • Cloud CDN
  • Backend service timeout
  • Connection draining timeout
  • HTTP access logging
  • Identity-Aware Proxy (IAP)
  • Session affinity
  • User-defined request headers
  • Cloud Armor security policies (Beta)
  • FrontendConfig CRD (Beta)
  • Custom GCLB health checks (Beta)
  • SSL policies (Beta)
• Exposing services on GKE
• OpenShift 4.5
  • OKD4
• Spring Cloud Data Flow for Kubernetes from VMware; part of the Spring Runtime package
• k8spin.cloud is closing and making their code open source
  • Review of k8spin from launch
• Custom Pod Autoscaler (and docs) by Jamie Thompson
• Envoy 1.15 round-up from Tetrate; release notes from the team
• Fluent Bit 1.5 summary at the CNCF
• k3d v3.0 and new web site
• Best practices for creating a highly available GKE cluster
• Recommended alerts for AKS
• Ingress support added to AWS App Mesh
• Platform9 adds new apps to their Managed Kubernetes Service
  • Episode 88, with Madhura Maskasky
• CVE-2020-8557: Node disk DOS by writing to container /etc/hosts
• CVE-2020-8559: Privilege escalation from compromised node to cluster
  • Alcide write-up
• Threat Alert: Attacker Building Malicious Images Directly on Your Host from Aqua Security
• Certified Kubernetes Security Specialist (CKS) coming in November
• Sign up for a free pass to Virtual KubeCon EU keynotes
• Diving Into Istio 1.6 Certificate Rotation by Christian Posta

Links from the interview

• SIG Instrumentation
• inodes
  • Eviction on inodes
• cgroups
• cadvisor
  • Launched on the same day as Kubernetes
• Monitoring metrics with Prometheus
• Victor Marmol and Vish Kannan
• Episode 22, with Dawn Chen
• CRI
• Resource metrics pipeline
• Heapster
• Metrics Server
• kube-state-metrics
  • Managing Your Costs on Kubernetes by Karl Stoney from Autotrader
  • Episode 52, with Russell Warman and Karl Stoney
• Metrics Stability Framework
• Structured logging
• Distributed tracing in Kubernetes
• Node out of memory eviction
• Pod priority
• David Ashpole on Twitter