Kubernetes Podcast from Google

Fabian Kammel is a Security Architect at ControlPlane, where he helps to make the (cloud-native) world a safer place. In his career, he continuously worked to bring hardware security and cloud-native security closer together. His past projects include:

* A cloud-native PKIs for on-road vehicle services secured by enterprise HSMs

* An always-encrypted Kubernetes distribution that harnesses the power of Confidential Computing

* And more recently securing SPIFFE-based machine identities via hardware attestation.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

Confidential Computing Blog from kubernetes.io

Confidential Computing Consortium

Confidential Computing Whitepaper

Intel SGX Enclave

Swap Memory with Kubernetes in Beta in 1.28

Hardware Security Modules

Trusted Platform Modules (TPM)

Envelope Encryption

Confidential Computing Concepts - Confidential Virtual Machine

AMD Secure Encrypted Virtualization (AMD SEV)

AMD Secure Encrypted Virtualization - Secure Nested Paging (AMD SEV SNP)

Trusted Computing Base (TCB)

Remote Attestation

Confidentiality, Integrity, and Availability: The CIA Triad

Intel SGX Enclaves

Confidential Containers (CoCo)

Katacontainers

AWS Firecracker

Guests are Marek Siarkowicz , Senior Software Engineer in Google Cloud, Tech Lead of SIG-etcd AND Wenjia Zhang, Engineering Manager in Google Cloud, Co-Chair of SIG-etcd, Google. We spoke about the project, the recent change to become a Special Interest Group and how to learn etcd.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

Co-host this week is Mofi Rahman [X, LinkedIn]. Cloud Developer Advocate at Google

Karpenter graduated to Beta

The Kubernetes SIG Network announced release 1.0 of the Gateway API

Ingress2gateway new CLI to migrate from Ingress to Gateway

The Call for Proposals for KubeCon EU 2024 will close on Nov 26, 2023

etcd

Meaning of etcd

etcd history from CoreOs

Raft paper

On the Hunt for Etcd Data Inconsistencies by Marek Siarkowicz - [youtube]

Lessons Learned From Etcd the Data Inconsistency Issues by Marek Siarkowicz - [youtube]

The first pancake rule

etcd as a Kubernetes sig

The Case for SIG-ifying etcd

CNCF Contributor License Agreements (CLA)

Kubernetes Prow

Contributor Experience Special Interest Group

Kubernetes Watch

Go Serialization and Deserialization

Cilium with external etcd

Certified Kubernetes Administrator

etcd mentorship program

etcd @kubecon NA 2023

Kubernetes considerations for large clusters

Operating etcd clusters for Kubernetes

Kueue

etcd on the podcast

The Heartbleed Bug

XKCD meme about dependency

WasmCon took place in BELLEVUE, WASHINGTON on Sept 6-7 2023. Kaslin and Mia from our advocacy team went down there and spoke to some folks at the conference to get their impression of the event.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

Mia Villaseñor:

• Twitter/X

• LinkedIn

Cilium Graduated

Docker AI apps tools

Kubernetes steering committee election results

CRI-O moved to Kubernetes owned repository

CNCF TOC voted to archive the SMI project

WasmCon 2023

Guests

• Dan Wilson

• Hood Chatham

• Brendan Irvine-Broque

• Josh Berkus

• Kevin Zheng

• Sid Hussmann

• Dawn Parzych

• Daiki Akasaka

• Radu Matei

• Dan Mihai Dumitriu

• Russell Ashi

• Chris Madison

• Brooks Townsend

Open Policy Agent

V8

Gapfruit OS

WASI Capabilities

Trusted Compute Group

Trusted Platform Module (TPM)

Jnode

Midokura WASM Runtime

Cosmonic Cloud

CNCF WasmCloud

Wasm Components Model

WASI

WasmTimeSQLite in Wasm talk at WasmCon

AI and Wasm talk at WasmCon

Envoy and Wasm

The WIT format

Cloudflare RU workers

Wasm and Kubernetes

Wasm and Kubernetes case study

Doom on Cloudflare workers with Wasm

Wasm and bosch by Emily Ruppel

Dynamic Linking Python

Dynamic Linking in Wasm from Wasm I/O 23

Podcast episode#208 with Phil estes

Podcast episode#203 with Justin Cormack

This week we explore what's new in Istio with core maintainers John Howard and Keith Mattix

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

• Announcing Linkerd 2.14: Improved enterprise multi-cluster, Gateway API conformance, and more!

• Amazon to invest up to $4 billion in AI startup Anthropic

• KubeCon EU 2024 CFP is open until November 26th

• CNCF Security Slam

• NEW Certification: Istio Certified Associate (ICA)

• npm packages caught exfiltrating Kubernetes config, SSH keys

• Kubernetes Native Sidecars in Istio (Blog from Istio)

• Kubernetes v1.28: Introducing native sidecar containers

• Argo Workflows

• Apache Airflow

• Envoy Proxy

• Istio Ambient Mesh

• Introducing Rust-Based Ztunnel for Istio Ambient Service Mesh

• eBPF

• Kernel TLS

• HTTP Based Overlay Network Environment (HBONE)

• KubeCon EU 2023: "Future of Service Mesh - Sidecar or Sidecarless or Proxyless?" - Idit Levine & Yuval Kohavi, Solo.io; Keith Mattix II, Microsoft; Eric Van Norman, IBM; John Howard, Google

• Istio Ambient Waypoint Proxy Made Simple

• kiali.io

• Kubernetes Gateway API (Istio)

• Getting Started with Istio and Kubernetes Gateway API

• Istio Desitination Rule

• Announcing Istio's graduation within the CNCF

• Istio sails into the Cloud Native Computing Foundation (CNCF Blog)

This week we explore the history of containers, particularly containerd, with Phil Estes.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

• Notary Project announces a major release! (Blog)

• Kubernetes Legacy Package Repositories Will Be Frozen On September 13, 2023 (Blog)

• Gateway API v0.8.0: Introducing Service Mesh Support (Blog)

• Amazon VPC CNI now supports Kubernetes Network Policies (Blog)

• Introducing VMware Tanzu Developer Portal: Empowering Developers with Enterprise-Grade Backstage

• Google Cloud Next page

• Google Cloud Next Blogs

• Google Cloud Post-Next Videos

• KubeCon NA 2023 Schedule

• Rig.dev startup (Blog)

• Docker

• Containerd

• Chroot (archlinux wiki)

• Linux namespaces (Linux man page)

• runC announcement (2015)

• runC on Github

• Containerd project creation announcement (2016)

• Containerd donation to CNCF announcement (2017)

• Containerd graduation announcement (2019)

• Container Runtime Interface (CRI)

• Kubernetes SIG Node

• Dockershim debacle (kubernetes.io blog)

• Dockershim deprecation FAQ (kubernetes.io blog)

• Mirantis-owned cri-dockershim on Github

• Open Container Initiative (OCI)

• Cloud Native Computing Foundation (CNCF)

• CoreOS ("What was CoreOS" blog by RedHat)

• Rkt ("What is Rkt" blog by RedHat)

• Kinvolk

• BlaBlaCar

• BlaBlaCar Case Study on Google Cloud

• gRPC

• gVisor

• Kata Containers

• Docker && WASM with Justin Cormack (Docker CTO) on the Kubernetes Podcast from Google

• WasmEdge (A Wasm runtime)

• CRI-O (lightweight container runtime for Kubernetes)

• Containerd scope and principles

• nerdctl: Docker-compatible CLI for containerd

• Docker Buildkit

• github.com/container-image, github.com/container-storage

• Podman

• Skopeo

• Firecracker microvms

• Intel Clear Containers

• Hyper.sh

• Open Infrastructure Foundation

• OpenStack

• Cloud Native Rejekts

• "Face off: VMs vs. Containers vs Firecracker" by Alex Ellis at Cloud Native Rejekts EU 2023

• Keynote: Reperforming a Nobel Prize Discovery on Kubernetes - Ricardo Rocha & Lukas Heinrich

• Keynote: CERN Experiences - Ricardo Rocha & Clenimar Filemon

• Jesse Frazelle's container escape challenge used to be at contained.af, but it doesn't seem to exist anymore.

• Containers from Scratch - Liz Rice at GOTO 2018 (there are a bunch of recordings of this talk)

• Mirantis-owned cri-dockershim on Github

Guest is Grace Nguyen. Kubernetes 1.28 release lead and student at the University of Waterloo. Grace had to juggle exams and community work to bring Kubernetes 1.28 to life. We will get to know grace and learn what work went into release, where the theme come from and what's special about it

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

• Docker Desktop 4.22 is live

• The CNCF announced the End User Technical Advisory Board

• The Go community released v1.21

• Configu raised a $3M pre-seed round

• Grace Nguyen

• LinkedIn

• X

• Kubernetes SIG-Security

• Kubernetes 1.28 Planternetes

• API Awareness of SideCars

• Native SideCar containers in Istio

• pkgs.k8s.io: Kubernetes Community-Owned Package Repositories

• Expanding support skew between control plane and node components

• Non-Graceful node shutdown

• Pod replacement policy for Jobs (alpha)

• Match conditions for admission webhooks

• Feature graduations and deprecations in Kubernetes v1.28

• Kubernetes 1.28 webinar. Sept 6th 2023 9am PDT

• Kubernetes 1.29 PR to assemble team

• Kubernetes 1.29 shadow program is open

• Kubernetes 1.27 release lead Xander Grzywinski

• Beta support for enabling swap space on Linux

• SideCars handling is the most popular issue on kubernetes tracker

• Reddit conversation about native SideCars

• Native SideCars explained

Guests are Wesley Hales and Max Bruce are co-founders of LeakSignal. LeakSignal is an American startup which is building a set of tools and products to detect and prevent data exfiltration in Service Meshes and proxies supporting Envoy and proxy-wasm.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

• Dragonfly v2.0.1 is released

• Redhat Terraform Provider for ROSA Preview

• Microsoft Azure Operator Nexus

• Hashicorp Adopts BSL Blog

• Open Source Security Foundation S2C2F

• Kubernetes and Cloud Native events Q4, 2023

  • WasmCon on Sept 6 and 7 in Bellevue, Washington

  • The Open Source Summit EU on Sept 19 to 21 in Bilbao, Spain

  • GRPC Conf on Sept 20 in Sunnyvale, California

  • Virtual IstioCon on Sept 25 and 26.

  • KubeCon, Cloud NativeCon And Open Source Summit China on Sept 26 to 28 in Shanghai, China

  • PromCon EU on Sept 28 and 29 in Berlin, Germany

  • KubeCon and CloudNativeCon NA on Nov 6 to 9 in Chicago, Illinois.

  • KubeDay India On December 8 in Bangalore

  • KubeDay Singapore on December 12

• Fermyon added SQL Database support and custom domains to their Wasm Cloud Platform

• Exposed Kubernetes Clusters are everywhere

• LeakSignal

• LeakSignal GitHub

• OpenShift

• Apigee

• Keyhouse

• Spiffe

• WebSockets

• gRPC

• Wasm

• Envoy

• Nginx

• AWS Lambda

• Proxy Wasm

• Istio Proxy Wasm

• Apisix

• Istio

• Prometheus

• PCI Compliance

• Cloud Armor

• Blog post about Cloud Armor WAF capabilities

• Akamai

• eBPF

• Envoy Mobile

"The State of Kubernetes Cost Optimization," is a recent report based on research into best practices for running Kubernetes clusters. If you're running your workloads as efficiently as possible, your costs will be optimal too. The report reviews the data and offers recommendations on tools and techniques you can use to optimize your Kubernetes clusters. We talk with two of the report's creators, Fernando Rubbo and Kent Hua, to learn more.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

- CNCF Istio Graduation blog

- Istio's blog about CNCF Graduation

- CNCF Blog on Flux v2 GA release

- Redhat Blog on Kubevirt 1.0

- Pulumi blog on v4.0 of their Kubernetes Provider

- VMware Wasm Labs blog on serverless with wasm

- CNCF announcement of over 30 new members

- VMware docs on self-hosted Tanzu

- The State of Kubernetes Cost Optimization report

- "Sharing the inaugural State of Kubernetes Cost Optimization report" blog

- Resource Management for Pods and Containers (Kubernetes Documentation)

- Google Site Reliability Engineering (SRE) books

- Google Cloud Managed Service for Prometheus

This week we speak to GKE Project Manager, Nicholas Eberts, about Platform Engineering. He draws from his considerable experience both with the Cloud Native community and working with businesses to set up their cloud platforms to explore the trend.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

- Kubernetes binary distribution via CDN at dl.k8s.io

- OpenShift Service Mesh version 2.4

- AWS Signer

- KubeCon CloudNativeCon North America 2023 registration

- KubeCon CloudNatieCon and Open Source Summit China 2023 registration

- Kubernetes Bill of Materials CLI from KSOC Labs

- Blog

- GitHub

- CNCF Blog "Version after version: how the open source project Kubernetes releases its software"

Nicholas Eberts:

- Twitter

- LinkedIn

- Abdel tweeting about Platform Engineering

- "DevOps is dead, long live Platform Engineering" tweet

- DORA (DevOps Research and Assessment)

- Charity Majors on the Hacking the Org Podcast

- Charity Majors on the DevInterrupted Podcast

- Open Service Broker

- CNCF Landscape

- Google Bard

This week we speak to Justin Cormack the CTO of Docker. We talked about WASM (or WebAssembly Modules), Docker support for running WASM apps and the future of the technology.

Do you have something cool to share? Some questions? Let us know:

- web: kubernetespodcast.com

- mail: [email protected]

- twitter: @kubernetespod

WASMCon 2023:

• CFP

• Event

Kyverno Project 1.10

Intro to Cilium course

Microsoft Azure Linux is GA

CNCF Glossary German edition is live

Google C3 Machine family is available for GKE

ChainGuard move from Github Registry to self-hosted

Amazon Pull through cache on AWS container registry

Justin Cormack:

• Twitter

• LinkedIn

Docker

WebAssembly

Docker+WASM

asm.js

asmjs.org

V8 Javascript engine

Google Sandboxing

WebGPU

ByteCode Alliance

Containerd

Mesos

WASM Edge