PodCTL - Enterprise Kubernetes

Show: 36

Show Overview: Brian and Tyler talk about the role (pros & cons) of VMs in isolation and security, as well as the broader context of security for containerized applications.

Show Notes:

• [Red Hat] 10 Layers of Container Security
• [Google] Exploring Container Security - An Overview
• [Google] Exploring Container Security Isolation at Different Layers
• [Google] gVisor
• Jess Frazelle “Hard Multi-Tenancy in Kubernetes”
• Jess Frazelle “Security and Echo Chambers”
• Kubevirt and Container-native Virtualization

Topic 1 - Let’s start with the basics. Can you please tell the audience the one command to run to make all containers secure?

Topic 2 - This past week (or 2 weeks) has been a good reminder that there are certain patterns that repeat themselves in emerging technologies and open source:  hype (cool demo), binary claims of market dominance and destruction of previous technology (containers vs. VMs), buzzwords of simplicity which go against decades of experience, and then the realities of production environments.

Topic 3 - Let’s talk about where VMs provide value in a container environment, and realities of VMs that people should be aware of in production and in multi-cloud environments.

Topic 4 - Let’s talk briefly about a few of the recent announcements in this space (e.g. gVisor, CNV, etc.)

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL
• Web: http://podctl.com

Show: 35

Show Overview: Brian and Tyler review the Kubernetes news coming out of Cloud Foundry Summit, KubeCon and Red Hat Summit. Lots of things to talk about.
 
Cloud Foundry Summit

• Attendance: 1500
• Fragmentation of the Container Orchestrator within the Cloud Foundry community - SUSE, IBM and SAP endorse Kubernetes, Pivotal still supporting Diego

KubeCon / CloudNativeCon (all videos)

• Attendance: 4300
• PaaS is now “GitOps” 
• Don’t run containers as root 
• Operator Framework
• Serverless v0.1 events spec is updated
• Many new container runtimes options - Google gVisor 
  
  

Red Hat Summit (all videos)

• OpenShift Commons Gathering (Attendance: 700+ - all videos)
• Attendance: 7000+ 
• CoreOS + OpenShift Converged Kubernetes platform (PodCTL#34)
• OpenShift + Istio 
• OpenShift + Cloud Functions (via OpenWhisk) 
• Red Hat + IBM announcement
• Red Hat + Microsoft announcement

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 34

Show Overview: Brian and Tyler talk with Joe Fernandes (@joefern1, Sr. Director Product Management @OpenShift) and Reza Shafii (@rezaloo, Sr. Director Product Management @OpenShift, formerly @CoreOS) about the CoreOS acquisition and transition, how CoreOS technologies are being integrated into Red Hat platforms, new capabilities for OpenShift, updates on Operators, updates on Container Linux and updates on Quay.

Show Notes:

• Red Hat Unveils Roadmap for CoreOS Integration with Red Hat OpenShift
• Red Hat Brings Cloud-Native Capabilities to Software Partner Ecosystem with Kubernetes Operators
• http://podctl.comBringing CoreOS technology to Red Hat OpenShift to deliver a next-generation automated Kubernetes platform
• PodCTL #33 - Operators Framework

Topic 1 - Welcome to the show, both of you. Before we get to the announcements and roadmap, let’s do quick introductions and maybe tell us how things have been going since the acquisition of CoreOS was announced at the end of January.

Topic 2 - What have been the core focus areas since the acquisition, both near-term and longer-term? Both in terms of Platforms (OpenShift/Tectonic) and OS (RHEL/Atomic/Container Linux)

Topic 3 - What are the announcements coming out this week, related to the Kubernetes platform? What timelines are important for these announcements?

• Operators as a community project (also see PodCTL #33)
• Operators for OpenShift 
• Operators for ISVs 
• Full Stack Automation (New Installer, New Admin Console)

Topic 4 - What are the announcements coming this week, related to the Linux OS platform? What timelines are important for these announcements?

• Red Hat CoreOS  
• Red Hat Quay

Topic 5 - If you’re a customer (new or existing), or an ISV partner of Red Hat, what are you hoping will be the top few takeaways that they understand after hearing these announcements and seeing the demonstrations?

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 33

Show Overview: Brian and Tyler talk with Brandon Philips (@brandonphilips, Founder/CTO at @CoreOS, Member of Technical Staff at @RedHat) about the announcement of the Operators Framework, how the Operator SDK and Lifecycle Manager will help companies, as well as his experience at CoreOS of developing etcd, Prometheus and Vault operators. We also discussed how the broader ISV ecosystem is beginning to embrace the concept of Operators.
 
Show Notes:

• Introducing Operator Framework - Building Apps on Kubernetes
• Operator Framework (GitHub)
• CoreOS introduces Operators
• Operators Homepage and Overview
• Kubernetes Application Operator Basics
• Vault Operator
• Couchbase Operator
• List of Existing Operators (many companies and software)

Topic 1 - Welcome to the show. Tell us about your role within the Kubernetes community, as well as your new role within Red Hat. 

Topic 2 - Back at the original KubeCon in Seattle, you introduced the concept of Operators, as “human operational knowledge in software, to reliably manage an application”. Give us the basics of your original thinking behind Operators.

Topic 3 - What is being announced today at KubeCon with the Operator Framework? 

Topic 4 - Let’s walk through the 3 core pieces of the Operator Framework

• Operator SDK 
• Operator Lifecycle Management 
• Operator Metering 

Topic 5 - How will the broader community plan a role in Operator Framework?

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 32

Show Overview:Tyler and Aaron Delp talk with Liz Rice (@lizrice, Technology Evangelist @AquaSecTeam) about what's easy—and what's not—about finding and patching security vulnerabilities in containers. This is a cross-over show with @TheCloudcastNet podcast.

Show Notes:

• Liz’s talk at Velocity Conf - “What’s so hard about container vulnerability scanning?”
• Use code CLOUD to get 20% off Velocity or OSCON tickets
• Aqua Security Homepage
• Liz Rice’s Blog
• [Video] Kubernetes, Metadata and You (KubeCon 2017 Austin)

Topic 1 - Welcome to the show Liz. Tell us a little bit about your background and the types of things that you’re working on these days.

Topic 2 - Let’s start with the basics. A container is defined by a file (e.g. Dockerfile) that the user/developer/operator defines. How can a vulnerability get into that file?

Topic 3 - Is it up to the CI/CD system or  host OS (where the container runs) or container orchestrator (e.g. Kubernetes) or container registry to figure out if a vulnerability exists?

Topic 4 - How do most container registries today manage vulnerability lists, container scanning and potential mitigations? What are the difficult parts of those tasks?

Topic 5 - Most containers today are Linux containers. Are you seeing anything happening (yet) around how to manage Windows containers vulnerabilities? Is the assumption that Microsoft will fix this through one of their existing tools, or are things happening in the open source community as well? 

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show Overview: Brian and Tyler discuss the basics of Microsoft Windows Containers and their integration into Kubernetes.
 
Show Notes:

• Kubernetes Sig-Windows
• Windows Containers (Microsoft)
• Getting Started with Windows Containers (CNCF)
• Red Hat OpenShift + Windows Containers
• PodCTL Basics - Linux Containers 
• Windows Server 2019 (preview) - Kubernetes

Topic 1 - Containers on Windows

• History of Containers & Windows
• How Windows Containers differ from Linux Containers

Topic 2 - Running Windows Containers on Kubernetes

• Requirements
• Limitations
• Development

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 31

Show Overview: Brian and Tyler talk about the Kubernetes v1.10 release, new features and how they can apply to a broad set of application, security and infrastructure use-cases.
 
Show Notes:

• (CNCF) Kubernetes 1.10: Stabilizing Storage, Security, and Networking
• (Red Hat / CoreOS) Kubernetes 1.10 is Here! 
• (OpenShift Commons) OpenShift Commons Briefing: Kubernetes 1.10 Release Update with Cole Mickens and Stefan Schimanski (Red Hat)
• OpenShift 3.9 Released to GA
• How to use GPUs with Device Plugin in OpenShift 3.9 (Now Tech Preview!)

We discussed some of the new features (Stable, Beta and Alpha) from the Kubernetes 1.10 release. We don't cover every new feature, but we tried to hit the highlights.
 
Topic 1 - API aggregation is stable

Topic 2 - Container Storage Interface (CSI) - Standardized Storage Support

Topic 3 - A replacement for kube-dns

Topic 4 - GPUs and Expanded support for Performance-Sensitive Workloads

Topic 5 - Pod Security Policy

Topic 6 - Adding Identity to Containers (not just pods)

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 30

Show Overview:Brian and Tyler talk about the biggest trends that will shape the Kubernetes community in 2018, with a focus on five critical areas of stability, innovation and experimentation.

Show Notes:

Topic 1 - Open Service Brokers - who is delivering them, who maintains them, how are they evolving, etc.
Topic 2 - Improved Ops Experiences - Operators, Fargate, Container Instances
Topic 3 - Virtualization + Containers - KubeVirt, Kata Containers, does Network Policy overlap SDN/Security
Topic 4 - Developer Experiences - big area of evolution (Istio, Draft, SpringCloud-Kubernetes, Helm v3, Source-to-Image like capabilities)
Topic 5 - Breadth of Supported Applications - Databases, Windows Containers, Serverless,

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 29

Show Overview: Brian and Tyler talk with Marc Curry (@redhatmarc, OpenShift Principal Product Manager, Container Infrastructure) about the basics of Kubernetes networking, CNI plugins, managing Network Policy, granular ingress and egress routing, and how CaaS/PaaS and IaaS are being integrated.

Show News:

• Kubernetes becomes a “Graduated Project” in CNCF

Show Notes:

• Kubernetes Network Plugins
• Kubernetes Cluster Networking
• Kubernetes Network Policy
• Kubernetes Ingress
• Kubernetes Container Network Interface (CNI)

Topic 1 - Welcome to the show. Tell us about your background and some of the areas you focus on now?

Topic 2 - Let’s talk about the basics of Kubernetes networking. Walk us through the core elements from container addressing, pod/cluster networking, and things like ingress/egress routing (direct or through proxies).

Topic 3 - Kubernetes has a standard called “CNI” (Container Networking Interface). What does this do, and how does it interact with various SDN projects/products?

Topic 4 - A recent enhancement to Kubernetes was “Network Policy”. What does this provide, and where does it overlap with some commercial SDN capabilities?

Topic 5 - Let’s talk about inbound and outbound routing of traffic. What are some of the biggest issues that people need to take into consideration (proxies, traffic sources, protocols supported, etc.)?

Topic 6 - What are some of the things you’re working on to bridge the networking between CaaS/PaaS layers and IaaS layers?

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com