PodCTL - Enterprise Kubernetes

Show: 19

Show Overview: Brian and Tyler talk how the Kubernetes community and technology have evolved in 2017, and make a few predictions for 2018
 
Show Notes:

• OpenShift Commons Gathering (videos): bit.ly/2BB3weV
• KubeCon (videos): bit.ly/2jczyn1

Topic 1 - GETTING STARTED: People said that getting started w/ Docker Swarm was easier than Kubernetes. Kubernetes community created tools like Minikube & Minishift to run locally on the laptop, automation playbooks in Ansible, Katacoda have made it simple to have online tutorials, multiple cloud offerings (GKE, AKS, EKS, OpenShift Dedicated) make it simple to get a working Kubernetes cluster.

Topic 2 - ENSURING PORTABILITY: Enterprise customers wants Hybrid Cloud environment. they need to understand how multiple cloud environments will impact this decision. The CNCF’s Kubernetes Conformance model is the only container-centric framework that can ensure customers that Kubernetes will be consistent between clouds.

Topic 3 - INFRASTRUCTURE BREADTH: Other container orchestrators had ways to integrate storage and networking, but only Kubernetes created standards (e.g. CNI, CSI) that have gained mainstream adoption to create dozens of vendors/cloud options.

Topic 4 - APPLICATION BREADTH: The community has evolved from supporting stateless apps to supporting stateful applications (and containerized storage), serverless applications, batch jobs, and custom resources definitions for vertical-specific application profiles. 

Topic 5 - SECURITY: There were concerns about K8S security. the community has responded with better encryption and management of secrets, and improved Kubernetes-specific container capabilities like CRI-O and OCI standardization.

Topic 6 - PERFORMANCE: Red Hat (and others) have started the Performance SIG to focus on high-performance applications (HPC, Oil & Gas, HFT, etc) and profiling the required performance characteristics of these applications in containerized environments.

Topic 7 - DEVELOPER EXPERIENCE: One of the themes of KubeCon was focusing on developer experience, and in just a few months we’re seeing standardization around the Helm format (for application packaging), Draft to streamline application development, Kubeapps to simplify getting started with apps from a self-service catalog. We also seen security model of non-root containers (vs. the Docker model of root-enabled containers).

Topic 8 - APPLICATION EXTENSIBILITY: Kubernetes community decided not to reinvent the wheel, instead working with the Cloud Foundry Foundation to create the Open Service Broker API. Within a year, we’re now seeing implementations that have not only ported all the functionality to Kubernetes, but have extended it beyond Cloud Foundry’s previous capabilities to include support for external clouds (e.g. AWS, Azure, GCP), as well as additional services such as Ansible playbooks and other 3rd-party capabilities.

Topic 9 - IMPROVING OPERATIONAL EXPERIENCE: As Clayton Coleman (Red Hat) discussed in his KubeCon keynote, companies like Red Hat are using their online environments to improve their operational experience and ultimate feed this knowledge back into the upstream products.

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 18

Show Overview: Brian and Tyler talk with Gabe Monroy (@gabrtv, Lead Product Manager Containers @ Azure, CNCF Board Member) about a wide variety of projects and services that Microsoft is working on in the Kubernetes and CNCF communities - from Windows containers to Container orchestration to making it simpler for application developers.

Show Notes:

• Azure Container Service (AKS)
• Azure Container Instances (ACI)
• Azure Draft (OSS project)
• Helm - Kubernetes Package Manager (OSS project)
• Azure Service Broker
• Virtual Kublet (OSS project)
• Gabe Monroy’s Azure Blog

Topic 1 - Welcome to the show. You joined Microsoft via the Deis acquisition. Let’s talk about some of the work you’ve been focused on since joining Microsoft.

Topic 2 - Microsoft Azure offers several options to use containers and container services (ACS, AKS, ACI). Can we dig into each of those services?

Topic 3 - Working on hybrid environments is becoming more important. Let’s dig into how Microsoft is expanding the capabilities of the Open Service Broker.

Topic 4 - Help us understand what the Helm project and Draft project enable for developers.

Topic 5 - One of the most frequent questions we get is around Windows-based containers. When will they be available, and what is Microsoft doing to make them easier to use? 

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 17

Show Overview: Brian and Tyler talk about the containers and Kubernetes news coming out of AWS re:Invent, as well as a look ahead to KubeCon in Austin.

Show Notes:

• Amazon announced its much-anticipated Kubernetes service Amazon Elastic Container Service for Kubernetes
• Amazon announced AWS Fargate “a technology that enables you to use containers as a fundamental compute primitive without having to manage the underlying instances.”

Topic 1 - AWS re:Invent happened last week. Any news about Kubernetes?

Topic 2 - The concept of “Bring Your Own Container” is evolving to “Bring A Workload that Runs in a Container” (Fargate, Microsoft ACI, etc.)

Topic 3 - What can we expect at KubeCon this week?  What new trends are you seeing emerge, or are you looking to see if they have momentum?

• Evolution of User-Experience
• Serverless standards?
• Adjacent projects to Kubernetes (backups, CI/CD, etc.)

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 17

Show Overview: Brian and Tyler talk about CNCF Kubernetes Conformance, OpenShift 3.7 GA, and some common questions about day-to-day operations with Kubernetes.

Show Notes:

• Cloud Native Computing Foundation Launches Certified Kubernetes Program with 32 Conformant Distributions and Platforms
• Red Hat OpenShift Container Platform v3.7 goes GA
• Kubernetes and OpenShift: Community, Standards and Certifications

Topic 1 - How do you deploy the underlying compute resources that are used as Nodes in a Kubernetes cluster?

Topic 2 - If a Kubernetes environment has to scale, how do you grow out the computing (or other) resources?

Topic 3 - When a new version of Kubernetes comes out, how do you manage to upgrade the environment?

Topic 4 - What are the common things that the Ops team is tracking, monitoring, measuring in a Kubernetes environment? 

Topic 5 - What are some things that have changed, from an operational perspective, because a Container/Kubernetes environment and previous technologies (e.g. VMs)?
 
Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 15

Show Overview: Brian and Tyler continue their focus on Security with Marc Boorshtein (@mlbiam, CTO of @tremolosecurity), discussing Identity Management, Container and Kubernetes Authorization and Authentication, RBAC, and how IT teams evolve to manage security in more agile environments.
 
Show Notes:

• PodCTL #14 - Security: Hosts, Registries, Content and Pipelines
• [Video] Identity Management and Compliance
• [Video] DevOps Identity Management
• [Website] Tremolo Security
• 10 Layers of Container Security
• Open Source k8s SSO project
• Open Source OpenShift Identity Manager project

Topic 1 - Let’s talk about User authentication in Kubernetes>

• Certificate Authentication 
• OpenID Connect 
• Reverse Proxy

Topic 2 - Let’s dig into the various types of Authorizations

• Overview of RBAC (Role-Based Access Control)
•  Mapping of Roles to Users and Groups 
• Organizational Challenges

Topic 3 - Given that various people (Devs & Ops) interact with dashboards, how do we manage that Authentication?

Topic 4 - How are organizations evolving to keep up with this more agile form of software development and the associated security challenges?

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 14

Show Overview: Brian and Tyler talk address some of the many layers of security required in a container environment. This show will be part of a series on container and Kubernetes security. They look at security requirement in the Container Host, Container Content, Container Registry, and Software Build Processes.
 
 Show Notes and News:

• 10 Layers of Container Security
• Google, VMware and Pivotal announced a Hybrid Cloud partnership with Kubernetes
• Google and Cisco announced a Hybrid Cloud partnership with Kubernetes (and more)
• Docker adds support for Kubernetes to DockerEE
• Rancher makes Kubernetes the primary orchestrator
• Microsoft announces new Azure Container Service, AKS
• Oracle announced Kubernetes on Oracle Linux (and some installers)
• Heptio announces new tools

Topic 1 - Let’s start at the bottom of the stack with the security needed on a container host.

• Linux namespaces - isolation 
• Linux capabilities and SECCOMP - restrict routes, ports, limiting process calls 
• SELinux (or AppArmor) - mandatory access controls 
• cGroups - resource management

Topic 2 - Next in the stack, or outside the stack, is the sources of container content.

• Trusted sources (known registries vs. public registries (e.g. DockerHub) 
• Scanning the content of containers 
• Managing the versions, patches of container content

Topic 3 - Once we have the content (applications), we need a secure place to store and access it - container registries.

• Making a registry highly-available 
• Who manages and audits the registry? 
• How to scan container within a container? 
• How to cryptographically sign images? 
• Identifying known registries 
• Process for managing the content in a registry (tagging, versioning/naming, etc) 
• Automated policies (patch management, getting new content, etc.) 

Topic 4 - Once we have secure content (building blocks) and a secure place to store the container images, we need to think about a secure supply chain of the software - the build process.

• Does a platform require containers, or can it accept code? Can it manage secure builds? 
• How to build automated triggers for builds? How to audit those triggers (webhooks, etc.)? 
• How to validate / scan / test code at different stages of a pipeline? (static analysis, dynamic analysis, etc.) 
• How to promote images to a platform? (automated, manual promotion, etc.)

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 12

Show Overview: Brian and Tyler talk with Dan Walsh (@rhatdan, Consulting Engineer at Red Hat, container team lead) and Mrunal Patel (@mrunalp, Principal Engineer at Red Hat, OCI/runc maintainer) about the evolution of containers with Kubernetes, the creation of CRI-O, and the focus on container security and stability. We also discussed emerging projects like Skopeo, Buildah, Intel Clear Containers and Grafeas.
 
Show Notes:

• CRI-O Homepage
• CRI-O Blog
• Introducing CRI-O v1.0 (blog)
• Containers Project (Image, Storage)
• Project Buildah - A tool which facilitates building OCI images
• Project Skopeo - Work with remote images and registries
• Project Grafeas - An open artifact metadata API to audit and govern your software supply chain
• Intel Clear Containers

Topic 1 - Welcome to the show. Why don’t you both introduce yourselves and tell us what areas you focus on.

Topic 2 In past episodes, we’ve talked about the CRI-* concept in Kubernetes. We’ve also talked about the OCI standard for containers. So what is CRI-O?

Topic 3 What problems does CRI-O attempt to solve for the container ecosystem?

Topic 4 - How does CRI-O different from containerd and CRI-containerd?

Topic 5 - How can people get CRI-O today? What are some of the things people can expect with CRI-O beyond v1.0?

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com

Show: 11

Show Overview: Brian and Tyler talk Julius Volz (@juliusvolz, @PrometheusIO co-founder, promcon.io founder) about the challenges that Prometheus solves, how it does monitoring and interacts with other systems, how it works with Kubernetes, and common-use cases and patterns.
 
Show Notes

• Prometheus (homepage)
• Part II - Evolution of Prometheus, v2.0 (via The Cloudcast)
• PromCon and PromCon Videos
• Prometheus v1.0 on The Cloudcast (v1.0 launch)
• WeaveWorks Managed Prometheus
• Robust Perception Blog (Prometheus consulting)

• What can it monitor?
• What can it trigger other systems to do? 

Topic 3 - Prometheus is now part of CNCF. Is it a native Kubernetes service, or a sidecar application for containers, or a broad service that just runs on Kubernetes?

Topic 4 - What are the basic things that most people use Prometheus to monitor for?  What are a few complex use-cases?  (application types, application frameworks, usage-patterns, etc.)

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podtl.com

Show: 10

Show Overview: Brian and Tyler talk with Paul Morie (@cheddarmint, Principal Software Engineer @RedHat, Lead of Kubernetes Service Catalog SIG) about the evolution of the Open Service Broker API, integrating with external services, the role of Service Brokers, and use-cases to expand Kubernetes applications.

Show Notes

• Kubernetes Service Catalog SIG
• OpenShift Commons - Kubernetes Service Catalog Deep Dive
• Kubernetes Service Catalog SIG (meetings, demos)
• Open Service Broker API

Topic 1 - Welcome to the show. Before you got involved in the Service Catalog SIG, you worked on several other aspects of Kubernetes (security, etc.). Tell us about some of the things you’re been involved with?

Topic 2 - Let’s go back to when the Open Service Broker API was announced. What was the purpose and how did it evolve to where it is now?

Topic 3 - What are the basics of how the Service Broker / Service Catalog interacts with applications on Kubernetes and 3rd-party services? 

• Example: How do we think about user/password/security credentials to a database?
• Example: Is the Service Broker in the data path as well as the control path? 
• Example: Where would traffic auditing functions happen?

Topic 4 - We saw a demo of the Service Catalog/Broker at Red Hat summit during an announcement with AWS, where is showed AWS services as part of the catalog. Previously, we’ve seen the CF Service Broker interact with Google or Azure services. Is the relationship between the broker and cloud-services “cloud specific”, or will things be interchangeable at all?

Topic 5 - Beyond public cloud services, what other types of things might be interconnected or managed via the Service Broker?
 
 Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl..com

Show: 9

Show Overview: Brian and Tyler talk about Kubernetes Networking and Kubernetes Storage.

Show Notes:

• Kubernetes Network Plugins
• Kubernetes and Storage
• Container Native Storage

Topic 1 - Let’s talk about the challenges of networking with containers and some of the ways that Kubernetes addresses these challenges.

• There’s lots of different ways to network containers together. Kubernetes does some basic networking (by default), and then there are add-on options for more complex, secure scenarios.
• The role of DNS in Kubernetes networking (services, etc.) 
• Kubernetes network plugins (CNI: container network interface) 
• Ingress and Egress Routes, Services, Load Balancing 
• Network Policy (fine-grained traffic control)  

Topic 2 - Let’s talk about the challenges of storage with containers and some of the ways that Kubernetes addresses these challenges.

• There’s definitely a misperception that containers should only be used for stateless applications. 
• Containers are (primarily) Linux, and Linux has well known concepts about how to interact with persistent storage. 
• Containers need a way to interact with persistent storage in a model where it can be dynamically allocated. 
• Kubernetes storage plugin proposal (CSI: container storage interface)

Feedback?

• Email: PodCTL at gmail dot com
• Twitter: @PodCTL 
• Web: http://podctl.com