PodCTL - Enterprise Kubernetes

Show: 54

Overview: Brian and Tyler talk about how well the industry has created or evolved Kubernetes-Native platforms and services. 

Show Notes:

Topic 1 - We’re more than 3yrs into Kubernetes, and almost at the 2yr anniversary of the 1st big CloudNativeCon / KubeCon in Seattle (we’ll be back again this year). So let’s ask a big question - how has the industry evolved to actually deliver Kubernetes-Native?

Topic 2 - What is Kubernetes-Native? 

• Is it specific to containers?
• Is it specific to Kubernetes scheduling?
• Is it specific to Kubernetes extensibility?

Topic 3 - Was reading a report recently that separated the concepts of DevOps from PlatformOps. We know Developers experiences and expectations are never the same and always evolving. But should the PlatformOps side of things be standardizing on something Kubernetes-native? 

Topic 4 - What are some of the common things you’ve seen in the Kubernetes community (products, platforms, services) that have gained some traction, but aren’t really aligned to Kubernetes? 

• Most Developer Frameworks
• CI/CD Pipelines
• Storage (CSI framework)
• ITIL Processes

Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

Show: 53

Show Overview: Brian and Tyler talk about how companies rationalize a Buy (or consume) vs Build decision for a Kubernetes platform or service.

Show Notes:

This show is somewhat free form, but it ultimately started with a listener question that asked:

"We run an internal Kubernetes platform in our centralized IT group, but some other developer groups also run their own Kubernetes platform. How do we convince them, or our management team, to bring other groups onto our platform to be both more cost effective and more collaborative with developers?"

• How do we rationalize having one vs multiple platforms (cost, support, feature differences)?
• How do we communicate to internal groups about the capabilities of an internal platform?
• How do we stop thinking like an IT group and start thinking like a product team?
• How do we measure success of the platform?

Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://blog.openshift.com, search #PodCTL

Show: 52

Overview: Brian and Tyler talk about updates to OpenShift 3.11, including new Operations Console, integrated Prometheus monitoring and Grafana graphing and supported Operators on OpenShift. They also discuss the introduction of OpenShift Container Engine (OCE)

Show Notes:

• Red Hat OpenShift Container Platform 3.11 is GA
• OpenShift Container Engine (announcement)
• Kubernetes Operators & Operator Framework
• Kubernetes Operators with Helm
• 3.11 - Cluster Monitoring, dashboards, alerting
• 3.11 - Event Feeds, Node & object introspection
• 3.11 - Access Control, auditing, Role impersonation

Topic 1 - CoreOS integration into OpenShift (admin dash, operators, etc)
Topic 2 - New Cluster Console and Administrator Dashboard
Topic 3 - Integrated Prometheus Metrics and Alerts
Topic 4 - Kubernetes Operator Previews and ISV Operators
Topic 5 - A discussion of OpenShift Container Engine (OCE)

Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://blog.openshift.com, search #PodCTL

Show: 51

Show Overview: Brian and Tyler talk about updates to Kubernetes v1.12
 
Show Notes:

• Kubernetes 1.12 Updates (Official Kubernetes blog)
• What’s new in Kubernetes 1.12 (Red Hat CoreOS blog)
• OpenShift Commons Briefing on October 4 at 9 AM PT to discuss Kubernetes 1.12
• Operator Framework

Topic 1 - Kubelet TLS Bootstrap moves to GA - simplify how nodes are securely added/removed into a cluster. As an add-on,  server certificate rotation functionality moves into beta, and this will be tied in with Cluster Operators and Application Operators.

Topic 2 - Azure Virtual Machine Scale Sets (VMSS) and Cluster-Autoscaler is Now Stable

Topic 3 - On the network security front, two NetworkPolicy components graduate to GA: egress and ipBlock.

Topic 4 - Multi-Tenancy: In this release comes the ability to support priority on the various resource quotas via the new ResourceQuotaScopeSelector feature. This enhances the existing priority and preemption feature that was delivered in Kubernetes 1.11.

Topic 5 - CSI now supports the notion of topology awareness and this functionality moves to beta in Kubernetes 1.12. What this means is that stateful workloads can now have a conceptual understanding of where storage resources live, whether it be a rack, datacenter, availability zone, or region.

Topic 6 - Kubectl Plugins: With kubectl plugins, developers can engineer extensions to kubectl, which accommodate their administration scenarios, while not being baked into the core kubectl codebase. This is going to allow teams to develop and deliver kubectl functionality faster and in a more consistent manner. (example: OpenShift “oc commands”) Topic 7 - Let’s discuss the upgrading process of Kubernetes (again).

Other noteworthy features:

• Snapshot / restore functionality for Kubernetes and CSI is being introduced as an alpha feature. This provides standardized APIs design (CRDs) and adds PV snapshot/restore support for CSI volume drivers. 
• Improvements that will allow the Horizontal Pod Autoscaler to reach proper size faster are moving to beta. 
• Vertical Scaling of Pods is now in beta, which makes it possible to vary the resource limits on a pod over its lifetime. In particular, this is valuable for pets (i.e., pods that are very costly to destroy and re-create). 
• Encryption at rest via KMS is now in beta. This adds multiple encryption providers, including Google Cloud KMS, Azure Key Vault, AWS KMS, and Hashicorp Vault, that will encrypt data as it is stored to etcd.

 Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL
• Web: http://podctl.com

Show: 50

Show Overview: Brian and Tyler answer questions from podcast listeners, about big data and analytics, application deployments, routing security, and storage deployment models.

Show Notes:

• Spark and Analytics
• Jupyter Notebooks
• Packaging Applications on Kubernetes (PodCTL #37)

Topic 1 - From David - Is it possible to do a show about running Spark, Jupyter notebooks and analytical workloads on k8s?

Topic 2 - From Matthew - it would be interesting to hear your thoughts for how apps will be deployed and maintained in the future of OpenShift/kubernetes (covered in Eps.37 in late May).

Topic 3 - From Will - One thing I would still like to know about is how people secure their running kubernetes deployments.  Are people generally just exposing their ingress nodes to the open internet, or is it more complicated than that? I'm familiar with Nginx/Apache and modsecurity, and saw that OpenShift recently started supporting Nginx as ingress, and would like to know if anybody is using that as a WAF.

Topic 4 - From Walid - What storage available options are available for production use cases? and what diverse use cases are out there? e.g. stateful mostly,  how about trends in machine learning/AI, Big Data workloads not the conventional K8s workloads!

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL
• Web: http://podctl.com

Show: 49

Show Overview: In a joint show between The Cloudcast and PodCTL, Brian and Tyler talk with John Morello (@morellonet, CTO at @TwistlockTeam) about how Service Mesh technologies, such as Istio, can be used for more advanced security of containerized applications and Kubernetes environments.
 
Show Notes:

• Twistlock Website
• Securing Istio and Kubernetes
• Making Istio Security Layer Easier to Monitor
• Service Mesh Tutorials

Topic 1 - Welcome to the show. Tell us about your background, and introduce us to Twistlock for anyone that isn’t familiar with the company.

Topic 2 - One of the most popular concepts in the world of containers and Kubernetes is “Service Mesh” (projects like Istio). Let’s talk about the basics of what a service mesh does.

Topic 3 - Service mesh provides routing capabilities, so let’s talk about where security comes into the picture.

Topic 4 - Service mesh introduces a concept in Kubernetes where you deploy multiple containers in a pod, one the application and one the service-mesh proxy. Does security introduce yet another container/agent into a pod?

Topic 5 - What sort of tools are available today for security professionals are service meshes are introduced into a container environment? 

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL
• Web: http://podctl.com

Show: 48

Show Overview: Brian and Tyler try and clarify some confusion about how much patching is still involved when moving from Virtualization to Containers.
 
Show Notes:

Lots of confusion about how to manage patching of VMs vs. Containers.

Topic 1 - What do I have to patch in a VM-centric environment? Who is typically responsible for that patching?

• Host OS 
• Hypervisor
• Guest OS 
• Application Stack

Topic 2 - What do I have to patch in a Container-centric environment? Who is typically responsible for that patching?

• Host OS 
• Container Layer
• Application Stack

Topic 3 - Is it possible to quantify the difference between the amount of patching that’s needed?

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL
• Web: http://podctl.com

Show: 47

Show Overview: Brian and Tyler talk about how the day-to-day tasks of a VM Admin would change if they adopted Containers in their environment.
 
Show Notes:

Let’s put ourselves in the shoes of a virtualization admin. How would we transition their day-to-day activities from VMs to Containers?

Topic 1 - What does the virtualization infrastructure/platform vs. container infrastructure/platform consist of?

• Control Plane 
• Content Repository
• Data Plane (Hosts, OS, Apps) 
• Networking, Storage, Management, Logging, Monitoring

Topic 2 - How do we get an application onto each platform, and how are resources provisioned?

• Network 
• Storage  
• Security 
• Backups 
• What is automated (by default vs. tooling) 
• Availability (models)

Topic 3 - Who is responsible for the different aspects of the application once it’s running?

Topic 4 - What are the biggest differences or misperceptions between the environments?

• Stateful vs. Stateless apps 
• Automated (integrated) vs. Manual tasks 
• Patching

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL
• Web: http://podctl.com