Brian Grant joined the Borg team in 2009, and went on to co-found both Omega and Kubernetes. He is co-Technical Lead of Google Kubernetes Engine, co-Chair of Kubernetes SIG Architecture, a Kubernetes API approver, a Kubernetes Steering Committee member, and a CNCF Technical Oversight Committee member, where he’s sponsored 11 CNCF projects. Your hosts talk to him about all those things.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Sunset from Mauao (Mount Maunganui)
• Russian Doll on Netflix
  • Edge of Tomorrow sequel back on

• Rancher introduces k3s
  • Didn’t they launch it 5 months ago?
  • k3s.io
• VMware launches VMware Essential PKS
• Istio Operator from BanzaiCloud
• CVE-2019-1002100
• containerd graduates at the CNCF
• Scytale announces $5m funding and Scytale Enterprise
  • SPIFFE and SPIRE
• Automate operations on your cluster with OperatorHub.io
  • OperatorHub website
• RightScale State of the Cloud 2019

• Borg, Omega and Kubernetes
  • Borg paper
  • Omega paper
• Issue 831: implement Image volumes and container volumes in Kubernetes
• Chubby key-value store paper
• IP per Pod
• LMCTFY
• CNCF TOC
• Updated 2018 mission for the CNCF
• SIG and Working Group List
• Devstats
• PR 1325: create kubectl
• Brian Grant on Twitter
  • PR 607

Kubernetes has a number of mechanisms to enforce policy: some built-in, like quota and NetworkPolicy; some extensions or add-ons like OPA. John Murray, a product manager at Google Cloud, joins Craig and Adam to talk about policy and configuration, and introduce the new CSP Config Management tool launched to Beta along with the new Cloud Services Platform.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Adam is in the news!
• Cat Lady
• Craig’s Oscar prediction and Rami Malek’s incident

• Google brings Cloud Services Platform to Beta
  • Application Modernization and the Decoupling of Infrastructure Services and Teams by Eric Brewer and Jennifer Lin
• Developer preview of OpenShift v4
• Knative v0.4
• Update to Azure DevOps Projects support for Azure Kubernetes Service
• The service mesh era: Securing your environment with Istio by Samrat Ray of Google Cloud
• Cloud Native DevOps with Kubernetes by John Arundel and Justin Domingus
  • Get it free* from NGINX
• All new Reddit services run on Kubernetes
• Breaking Docker via runC by Yuval Avrahami of Twistlock
• Secure Kubernetes with Vault by Bjorn Wenzel
• Migrating from Heroku to GKE
• How to prepare for a Kubernetes interview
• Adding “containers” to Linux

• ResourceQuota, PodSecurityPolicy and NetworkPolicy
• Open Policy Agent
  • Kubernetes integration
• CSP Config Management
  • Take control of your clusters with CSP Config Management (blog post)
• John Murray on Twitter

The history of Borg influences the history of Kubernetes in many ways: Google has different teams handle “get traffic to a cluster” and “serve traffic”, so Kubernetes has a conceptual split here too. Tim Hockin, Kubernetes co-founder, Google principal engineer and former Borg/Omega team leader, joins Adam and Craig to explain the history and future of the Ingress API, why it’s taken so long to get to v1, and how it might evolve in the future.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Intelligence Squared: Can an AI change your mind?
• Robot or Not: Is your AI a robot?

• Arm joins the CNCF
• Cilium 1.4 is released
  • Installing on GKE
• Lightboard: week
  • Managed Knative on IBM Kubernetes Service
  • Brendan Burns’ videos for Microsoft Azure
• New EKS regions
  • New EKS CNI plugin
• Kubernetes Day India schedule announced
  • Liz Rice on episode 19
• The Information on Kubernetes (subscription or e-mail address required)

• Hello, my name is Tim Hockin, and I pronounce “kubectl” as “kubectl”
• lmctfy, Google’s open source container tool
  • Episode 22 with Dawn Chen
• Kubernetes network concepts: Service and Ingress
• Annotations
• NGINX ingress
• Google Cloud BackendConfig
• Heptio Contour
• IngressRoute
• Istio v1alpha3 API
• KEP to move Ingress to v1 (GA)
• T-shirt logos
  • Tim’s favourites: Brushstrokes and Pixels
  • Craig’s favourite is the paint splash
• Tim Hockin on Twitter

The new GKE Usage Metering feature lets you find out how much your tenants or applications cost to run. Your hosts talk to Madhu Yennamani, product manager at Google Cloud, about usage metering, and how new GKE features are implemented.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Weather in Seattle
• Weather in London

• runc vulnerability:
  • Open source disclosure
  • Write up from the patch author
  • GKE bulletin
  • Kubernetes blog post
• Infoworld names Kubernetes a Technology of the Year
• Encrypting GKE secrets with Google Cloud KMS
• Build containers faster with Google Cloud Build and Kaniko
• Jib 1.0.0 GA
• Red Hat CodeReady Workspaces
• Heptio open source project changes
• Platform9 VMware Kubernetes managed service
• ClearDATA launches Kubernetes solution for healthcare
• KubeCon diversity scholarships
• Poseidon Firmament scheduler
  • Firmanent

• GKE usage metering: Whose line item is it anyway?
• Enable GKE usage metering
  • BigQuery
  • Google Data Studio
• Madhu Yennamani on LinkedIn

Minikube is a tool that makes it easy to run Kubernetes locally, by running a single-node Kubernetes cluster inside a VM on your desktop or laptop. Craig and Adam talk to author and maintainer Dan Lorenc from Google Cloud, and in the wake of the Super Bowl, discuss how “football” means something different to each of them.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Adam watched the Super Bowl
• Craig watched some Superb Owls
  • Outside the UK, you can watch them here
• You can watch some ads
  • But not the ad for Blue Origin, which was pulled
  • Snow day in Seattle!
  • Jeff Bezos at the Super Bowl
  • The Daily Mail is not really news
• Jeff Bezos’s earnings per minute

• Spark Operator for Kubernetes now in Beta
  • IBM Cloud Databases report on the Operator Pattern
• New members in the CNCF TOC
  • Alexis Richardson from Weaveworks
  • Brendan Burns from Microsoft
  • Joe Beda from VMware
  • Matt Klein from Lyft
  • Xiang Li from Alibaba
  • Kelsey Hightower from Google
• Google Kubernetes Engine usage metering
• Advanced application deployments and traffic management with Istio on GKE
  • GitHub repo
  • Megan’s development workflow for Kubernetes
• Ambassador 0.5.0
  • API Gateways are going through an identity crisis
• Kubernetes as an API standard; looking toward a Rust implementation

• Dan leads a team working on:
  • Minikube
  • Skaffold
  • Kaniko
  • Knative Build
• Minikube was helped in the early days by Localkube from RedSpread, who were acquired by CoreOS (who were acquired by Red Hat, who were acquired by IBM)
  • There was also Boot2docker, but Kubernetes didn’t like Docker-in-Docker much back then
• Guide for developing Minikube
• Other similar projects:
  • Microk8s
  • Docker Desktop
• Things it was hard to get working:
  • Load balancers; solved via tunneling
  • Persistent volume provisioning, solved with a custom hostpath provisioner
• Minikube Roadmap
• Dan Lorenc on GitHub and on the web

You learn so much more from failure than success. Henning Jacobs, head of Developer Productivity at Zalando, joins Adam and Craig to share his own stories of failure, and talk about what he has learned by reading stories from others.

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• A Normal Lost Phone
• Neil and Liam Finn

• CoreDNS graduates
• Intel introduces Nauta; enterprise Kubeflow
  • Interview with David Aronchick in Episode 2
• Ian Lewis’s blog posts on container runtimes
• Istio blog intro by Megan O’Keefe
  • Interview with Dan Ciruli and Jasmine Jaksic in Episode 15
• Kubinception: Using Kubernetes to run Kubernetes at OVH
  • Why OVH Managed Kubernetes
  • Giant Swarm and SAP
• GKE Jenkins Plugin and source code
• Deploying to Kubernetes from GitHub Actions
  • Mortar; the manifest shooter for Kubernetes
• It’s a good time to be working in Kubernetes

• Kubernetes Failure Stories blog post
  • GitHub repo
  • Hacker News post
• Zalando
• A Million Ways to Crash Your Cluster
  • Original version of the talk from the Dusseldorf meetup
• Tacoma Narrows Bridge collapse
• Nordstrom talk at KubeCon NA 2017
• Serverless Failure Stories
• Startup scripts used to just kill the Docker daemon
• 90 days of EKS in production: configuration options you need to set
• CPU throttling
• Facebook oomd
• John Wilkes: only make new mistakes
• Henning Jacobs on Twitter

Richard Hartmann is a member of the Prometheus Team and the founder of the OpenMetrics project, which aims to replace SNMP with a modern format for transmitting metrics. He joins your hosts to discuss both projects, and how Cloud Native technology can improve the datacenter.

No soup for you! Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Lego collecting delivers huge and uncorrelated market returns

• Knative 0.3 released
• Service Mesh Day; March 28-29, San Francisco
• FoundationDB Record Layer
• Tumblr open sources Kubernetes tools
• gVisor presentation by Adin Scannel
• Aleksa Sarai on tar in oci
• Detect overspending by measuring idle Kubernetes resources
  • Karl Stoney’s post on managing costs on Kubernetes
• SQL Server on GKE and AlwaysOn Availability Groups
• Namely’s Crash Course in Running Istio
• Kubernetes failure stories
  • Zalando
  • Target
• 9 security best practices
• Google remains the top contributor to CNCF projects, even if you were to remove Kubernetes!

• Space.net
  • Swiss Army Chainsaw
• Prometheus
  • Built by ex-Googlers at Soundcloud
  • Better than MRTG and rrdtool
  • Cortex, Thanos, InfluxData for persisting Prometheus data long-term
• Manage multiple DCs
• Grafana for visualising data
  • Variables for templating
• PromQL
• OpenMetrics
  • A new Lingua Franca for monitoring and tracing that isn’t SNMP
    • Export SNMP to Prometheus format
  • Transforming the Prometheus Exposition Format into a Global Standard; Richard’s PromCon talk
  • End goal: write an RFC
  • GitHub repo
  • Prometheus 2.5 has experimental OpenMetrics support
• QUIC becomes HTTP/3
• Get involved with the Prometheus community
• Richard Hartmann on Twitter

Rook is a cloud native storage orchestrator and a controller for storage systems such as Ceph. Jared Watts has been working on Rook since the start, first at Quantum, and then at Upbound. He talks to Craig and Adam about storage, chess, and premium-rate telephone numbers.

Does anyone actually read the show notes? Turns out a few of you do. Thank you for listening and reading!

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Tabletop Simulator (a computer game)
• Happy (a televisual programme)

• Kubernetes Day India from the CNCF
• Vertical Pod Autoscaling in GKE in Beta
  • Vertical Pod Autoscaler in OSS
• Announcing TriggerMesh Knative Lambda Runtime (KLR)
  • Episode 28 with Sebastien Goasguen
• krew, the package manager for kubectl plugins
• Monitoring Kubernetes, by Sean Porter of Sensu on the CNCF Blog
• Istio 1.1 update
  • Episode 15 with Jasmine Jaksic and Dan Ciruli
• Kubernetes authorization via Open Policy Agent by Stefan Bueringer

• Symform; Jared’s first startup, peer-to-peer cloud storage
  • Totally unlike KaZaA
  • Where Jared first met open source, through the Mono project
  • Acquired by Quantum
    • Craig explicitly remembers owning a Quantum Bigfoot (though that one wasn’t his first hard drive)
• Rook, a cloud native storage orcestrator
  • SIG Storage and the Volume abstraction
  • Started with support for Ceph
  • Also now supports CockroachDB, Minio, NFS, Apache Cassandra
  • But not Gluster - for now at least
  • Added to the CNCF Sandbox in January 2018, and moved to incubating in August
• Upbound; founded by Bassam Tabbara
• Container Storage Interface 1.0.0
• Rook on GitHub
• Queen Storage
• Jared Watts on Twitter and the Rook blog
  • Why you might have had to pay 90c per minute to tweet Jared

The Cloud Native Computing Foundation was formed to create a vendor-neutral home for Kubernetes. Now with over 30 projects, we kick off 2019 by talking to Dan Kohn, Executive Director of the CNCF, and hearing his views on projects, licenses and conferences.

Please reach out and say hello:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• Platform9’s KubeCon survey
• Security notices:
  • Dashboard custom certificates
  • API server proxying

• Cloud Native Computing Foundation
  • Dan Kohn
• Linux Foundation
  • Jim Zemlin
  • Other projects: Lets Encrypt, Hyperledger, Node.js Foundation
  • Fellows: Linus Torvalds and Greg Kroah-Hartman
  • CNCF members and Governing Board
• Getting people on board with Open Source
  • Crossing the Chasm (a book by Geoffrey A. Moore)
  • Why Software Is Eating The World (an article by Marc Andreessen)
• CNCF projects
  • Project list
  • Interactive landscape and trail map
  • Licenses
    • Why Dan (& the CNCF) Recommnds Apache 2.0
    • “Shared source”: Redis and the Commons Clause; MongoDB and the Server Side Public Licence
  • What would Dan like to see in the CNCF?
    • Istio and Knative
  • Technical Oversight Committee Principles say it’s OK for overlapping projects
• Certification
  • For people: Certified Kubernetes Administrator and Certified Kubernetes Application Developer; curriculum
  • For distributions: Software Conformance
• KubeCon + CloudNativeCon
  • China
    • Based on the End User Conference in 2017
    • Co-hosted with the Open Source Summit in 2019
  • US
    • 27 co-located events
• Dan Kohn on Twitter

Adam and Craig end the year by talking to Jordan Liggitt, the member of the Kubernetes Product Security Team who fixed the recent critical security vulnerability in the Kubernetes API server. We also take a look at the news from KubeCon.

This is our last episode for 2018. Thank you for your support this year, and we’ll be back on the 8th of January!

Do you have something cool to share? Some questions? Let us know:

• web: kubernetespodcast.com
• mail: [email protected]
• twitter: @kubernetespod

• etcd donated to the CNCF
  • Chubby paper
  • Raft paper
  • Blog post on the relationship between Kubernetes and etcd by Gyuho Lee and Joe Betz
• Istio:
  • Geekwire: Has Istio become the new cloud-native darling?
  • Google launches Istio on GKE
  • VMware NSX Service Mesh
  • Aspen Mesh open beta
  • In other service mesh news: A10 Secure Service Mesh
• Knative:
  • Knative: bringing serverless to Kubernetes everywhere
  • SAP: Extensibility on cloud-native stack
  • Red Hat to deliver hybrid serverless workloads to the enterprise
  • Pivotal launches Function Service
  • GitLab and TriggerMesh announce GitLab Serverless
• Oracle Cloud Native Framework
• Microsoft:
  • Osiris
  • Azure Monitor for Containers is GA
  • Phippy Goes To The Zoo
  • Phippy, Captain Kube and friends now in the CNCF
• Digital Ocean Kubernetes now open to everyone
• Linode Kubernetes CLI
  • Terraform scripts
• VMware closes its acquisition of Heptio
  • For $550M
  • Dell will go public again
• Quickfire Kubernetes security news
  • NeuVector announced containerd and CRI-O runtime support in their container firewall
  • Aqua’s Container Security Platform is now certified to cover the Kubernetes CIS benchmarks
  • Lacework announced their configuration scanning platform covers Kubernetes
  • Sysdig released Sysdig Secure 2.2, which adds Kubernetes audit events, and the ability to block deployments using Kubernetes admission controllers
  • Twistlock released 18.11, which “introduces security visualization for Kubernetes, and compliance and security configuration checks for Istio, including new alerting integrations with PagerDuty, and cloud services
• Grafana Loki
  • Thanos: Prometheus at scale
• Maestro – A declarative, no-code approach to Kubernetes Day 2 Operators
• rbacsync
• PlanetScale announces funding
  • TechCrunch article

• Jordan’s suggested KubeCon talks to watch:
  • Kelsey Hightower’s keynote, “Kubernetes and the path to serverless”
  • Julia Evans’ keynote, “High Reliability Infrastructure Migrations”
• OpenShift before Kubernetes in 2014
• Kubernetes Product Security Team
• CVE-2018-1002105: proxy request handling in kube-apiserver can leave vulnerable TCP connections
  • Listing in the National Vulnerability Database
  • Originally filed as a bug against Rancher
    • Rancher blog post
  • How to report a vulnerability
  • Proof of concept (third party)
  • How it was fixed
  • Distributor’s list
  • Client certificate vulnerability in Kubernetes in 2016
• Answering questions on Stack Overflow
• Jordan Liggitt on Twitter, GitHub, Slack or Stack Overflow