Kubernetes Podcast from Google

Copyright: © This work is licensed under a Creative Commons License - Attribution-NonCommercial-NoDerivatives 4.0 International - http://creativecommons.org/licenses/by-nc-nd/4.0/

Latest Episodes:

Kubernetes 1.16, with Lachlan Evenson Sep 24, 2019

Show notes

Kubernetes 1.16 is out, and our guest this week is its release manager, Lachlan Evenson. Lachie is a Principal Program Manager at Microsoft and an Australian living in the US; Craig and Adam are therefore method-interviewing, being this week in those two countries respectively.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

News of the week

Links from the interview

Prison England
Lithium Technologies
Kubernetes 1.0 launch roster
CrashLoopBackOff
Helm Classic
Deis acquired by Microsoft
- Deis Labs
- Episode 61, with Jeremy Rickard and Ralph Squillace
- Phippy and Captain Kube
- Childrens Illustrated Guide to Kubernetes
1.16 release blog
- What Lachie is excited about:
  - Dual stack IPv4/IPv6
  - Endpoint slices
- What he's looking at in Alpha: Ephemeral containers
  - Distroless
What slipped: Sidecar containers
Breaking old APIs in Kubernetes 1.16
- Deprecation policy
1.16 release team
Emeritus Advisors
KubeCon San Diego session on shadowing in releases
Kubernetes 1.17: run by women
Removing the Test-Infra release role
Release notes from annotated PRs
Community retrospective
Release mascots:
- 1.16 Release patch
- 1.11
- 1.14
Olive Garden
- When you're here, you're family
- History of the breadstick
- Cutting people off from unlimited breadsticks
2019 Steering Committee elections are happening
Lachlan Evenson on Twitter

containerd, with Derek McGowan Sep 17, 2019

Show notes

containerd was born from community desire for a core, standalone runtime to act as a piece of plumbing that applications like Kubernetes could use. It sits between command line tools like Docker, which it was spun out from, and lower-level runtimes like runC or gVisor, which execute the container's code. This week's guest is Derek McGowan, a Software Engineer at Docker and a containerd maintainer-d.

Along with the news of the week, Adam and Craig discuss the many Vancouvers.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

Vancouver, Vancouver, and George Vancouver
South Bend, North Bend, and Bend
Cosmpolis
"50 Year Sensation: the Dave McMacken Retrospective" (album art show in Astoria, Oregon)

News of the week

Istio 1.3 is out
Google's Anthos now incudes Anthos Service Mesh, Cloud Run for Anthos and more
Cloud Native Application Bundles hit 1.0
- Episode 61 with Ralph Squillace and Jeremy Rickard
Nominations for the annual CNCF Community Awards
Bloomberg hits 90% utilization with Kubernetes
Mistakes that "cost" thousands by Gajus Kuizinas
Kubernetes Edge working group publishes whitepaper
Isopod, by Cruise
Pulumi 1.0
5 RBAC mistakes you must avoid (number 4 will shock you)
OpenShift 4.2 disconnected install
Red Hat Quay 3.1
Microsoft AKS brings Scale Sets and Standard LB to GA
- Upstream kernel bugs
Amazom EKS adds cluster tagging and IAM roles for service accounts
Deep dive into AWS Fargate by Abhisheck Ray from Amazon
Kong introduces Kuma, "universal service mesh"
Google introduces Cloud Dataproc for Kubernetes
Apache Flink operator from Google Cloud
Container runtime security bypasses on Falco by Mark "Antitree" Manning
Rafay Systems lands $8m in Series A funding

Links from the interview

containerd
Original announcement
The many meanings of 'container runtime'
kubelet and Container Runtime Interfaces
runC, gVisor, Kata Containers, and the Windows Host Compute Service (HCS)
ctr debug tool
containerd's graduation from the CNCF
containerd shim API
rkt announced in 2014 with appC spec
Open Container Initiative
- libcontainer, which became runC
Web Assembly (WASM)
BuildKit
1.3.0 releases are coming
Contribution opportunities:
- Reporting issues
- Plugin ecosystem
Derek McGowan and containerd on Twitter

Windows Server Containers, with Patrick Lang Sep 11, 2019

Show notes

Patrick Lang is the co-chair of the Kubernetes Windows SIG. He is a Senior Software Engineer at Microsoft, developing Kubernetes and related open-source projects supporting Windows Server Containers. Patrick joins Adam and Craig to tell the story of how containers came to Windows.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

Getting to the Peak Tram

News of the week

KubeCon 2019 schedule
- Tim Hockin and Kal Henidak on dual stack IPv4
- Building a 5G network live on stage
GKE Shielded VM Nodes
Mæsh
Project Contour 0.15
- Contour on Kind
TechCrunch video: How Kubernetes Changed Everything
Aaron Roydhouse reverse engineers release schedules as 1.15 hits Preview on Azure and Rapid Channel on GKE
GKE Scalability best practices
- The Kubernetes scalability hypercube
Cloud Foundry Networking Team Update
Building a Continuous Delivery Pipeline for Symphony by Ivan Babenko
The Cult of Kubernetes and Hacker News discussion

Links from the interview

Windows Server containers
Windows Server Core and Nano Server
Sessions on Windows
Docker and Windows partnership announced in 2014
Active Directory
Group Managed Service Accounts (GMSA)
- GMSAs for Windows containers
Windows network namespaces
Host Networking Service and Virtual Filtering Platform
GMSA integration with Kubernetes
GPU acceleration in Windows Containers
Batch files!
Patching:
Docker for Windows
Get started with Windows containers
Windows Server Containers in preview on AKS, EKS or GKE
SIG Windows and their Slack channel
Patrick Lang on GitHub

kind, with Ben Elder Sep 03, 2019

Show notes

kind stands for Kubernetes in Docker. Originally built for continuous integration (CI) and testing of Kubernetes itself, kind has found many uses, including acting as a cluster for bootstrapping other clusters. Original author Ben Elder from Google Cloud joins Craig and Adam to talk about it.

Want to see Adam's puzzles? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

News of the week

Links from the interview

Ben's GSoC proposal and first Kubernetes project: use iptables for proxying instead of userspace
kind webpage
- Documentation
kind on GitHub
Privileged containers
kubernetes CI
Cluster API
IPv6 on kind
End to end testing
Running Kubernetes in a CI pipeline by Loodse
Cluster API logo - it's turtles all the way down
kubeadm
cluster-api-provider-docker
Other tools:
- kinder
- kindest
Shoutouts to:
- Antonio Ojea from SUSE
- James Munnelly from JetStack
- SIG Cluster Lifecycle
Ben Elder on Twitter

Container Camp, with Angie Maguire Aug 27, 2019

Show notes

Container Camp is a series of independent conferences, spanning three continents and in their fifth year. "Camp mother" Angie Maguire is the co-organiser, and is also the founder of Ladies of Code. She joins Adam, who is yet to attend a Camp, but actually goes camping, and Craig, who has spoken at Camps in London and Sydney, and prefers hotels.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

News of the week

VMware buys:
- Pivotal
- Carbon Black
- Intrinsic
- Greenland
VMworld news:
- Introducing Project Pacific
- Project Pacific technical overview
  - Reintroducing Project Bonneville?
- Joe Beda's take
- Tanzu, VMware's approach to modern applications
- Tanzu Mission Control
Splunk acquires SignalFX
2019 Accelerate State of DevOps report
Red Hat OpenShift Service Mesh is GA
- Maistra, the upstream of the operators
Cilium 1.6 is out
E2E Kubernetes testing with GitHub Actions
Why does developing on Kubernetes suck?
- Hacker News says it doesn't
CNCF Google Summer of Code projects

Links from the interview

Container Camp
Ladies of Code
- Women Who Code
- Black Girls Code
Container Camp videos on YouTube
- Craig's talk from London in 2016
- Kaggle talk from San Francisco in 2016
IPFS Camp
Digital nomads
Angie's Netflix recommendations:
Container Camp and Angie Maguire on Twitter

Orka, with Chris Chapman Aug 20, 2019

Show notes

Kubernetes and Docker might not seem the obvious choice for managing virtual macOS instances on hosted Apple hardware. Learn how they were used to build Orka - Orchestration for Kubernetes on Apple - a virtualisation layer for Mac build infrastructure offered by hosting company MacStadium. Craig and Adam ask MacStadium SVP of Software Chris Chapman about Orka, and how Kubernetes is useful in places you might not expect.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

Letterboxing
- Geocaching
- Orienteering

News of the week

HTTP/2 security bulletin from Netflix
- New releases for:
  - Kubernetes
  - Istio
  - Envoy
  - gRPC
  - NGINX
- And others
CNCF archives the rkt project
GitHub Actions is now a CI/CD service
- Announcing preview of GitHub Actions for Azure
Kubernetes web UIs in 2019 and Kubernetes Web View by Henning Jacobs
- Episode 38: Kubernetes Failure Stories, with Henning Jacobs
k3sup by Alex Ellis
- Episode 57: Rancher Labs, with Darren Shepherd
Evolving Istio's APIs, by Sandeep Parikh and Louis Ryan
- Episode 58: Istio 1.2, with Louis Ryan
- Istio 1.3 release branch cut
Intel GPU Plugin for Kubernetes by Brian Carey
Kubernetes Gated Deployments at GoDaddy
CNCF now has 100 end user members
VMware, Pivotal and Dell:
Helm Summit EU 2019

Links from the interview

MacStadium
Orka
Conference presentation videos from Chris:
- macOS in a Docker container for development - MacADUK 2019
- Announcing Orka - AltConf 2019
Mac OS X Lion supports running additional OS X instances (up to two)
- 10.7 EULA (PDF)
Device test labs
Docker for Mac
Virtual Command, Chris's prior company acquired by MacStadium
The orca
kubevirt
Mac hardware:
- Mac Pro (2013) - the "trashcan"
  - The MacStadium sled
- Mac Pro 2019 - the return of the "cheesegrater"
- T2 security chip
- MacStadium in WWDC 2018 keynote
- Inside the MacStadium data center
JenkinsWorld 2019
- Orka plugin for Jenkins
Docker for Mac in macOS on Docker
MacStadium on Twitter

kubectl Plugins and krew, with Ahmet Alp Balkan and Luk Burchard Aug 13, 2019

Show notes

No matter how you say it, you probably use kubectl all the time. Did you know you can extend it with plugins? Did you know you can find and install those plugins using krew, a plugin manager for kubectl? krew was built by Luk Burchard, a student at TUBerlin, as an intern project. He was supervised by Ahmet Alp Balkan at Google Cloud, and they both join Craig and Adam to discuss it.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

News of the week

Links from the interview

kubectl overview
Extend kubectl with plugins
Sample CLI plugin
Write your own kubectl subcommands and The case for a kubectl plugin manager by Ahmet Alp Balkan
kustomize becoming a kubectl sub-command
kubectl access-matrix (a.k.a. rakkess, as a stand-alone binary)
krew
krew plugin index
Ahmet's recruitment tweet
Luk's first day at Google
Ahmet Alp Balkan:
- Web
- Twitter
Luk Burchard:
- Web
- Twitter

Attacking and Defending Kubernetes, with Ian Coldwater Aug 06, 2019

Show notes

Ian Coldwater specializes in breaking and hardening Kubernetes, containers, and cloud native infrastructure. A pre-eminent voice in the Kubernetes security community, they are currently a Lead Platform Security Engineer at Heroku. Ian joins Adam and Craig to talk about the offensive and defensive arts.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

News of the week

Links from the interview

Red teams and penetration testing
Fuzzing
Attacking Helm's Tiller
Black-box and white-box testing
DevSecOps: guard rails, not gates
OWASP - the Open Web Application Security Project
The math behind calculating security risk
CVSS score
etcd: encrypt it at rest!
Admission control
Technologies for isolation:
- AppArmor
- Seccomp
- gVisor
- Firecracker (not yet supported with Kubernetes)
"Kubernetes is powerful, and it's insecure by design"
- Ian and Duffie Cooley's BlackHat talk
- Cloud doesn't make it better!
Threat modelling
hostpath - "a powerful escape hatch"
- Trail of Bits blog: understanding Docker container escapes
Recommended watching:
- Ship of Fools by Ian Coldwater (slides)
- Hacking and Hardening Kubernetes by Example by Brad Geesaman (slides)
- A Hackers Guide to Kubernetes and the Cloud by Rory McCune (and his upcoming Black Hat training)
- DIY Pen Testing for your Kubernetes Cluster by Liz Rice (our guest on episode 19)
Ian Coldwater on Twitter

Cloud Code, with Sarah D'Angelo and Patrick Flynn Jul 30, 2019

Show notes

Cloud Code provides everything you need to write, debug, and deploy Kubernetes applications, including extensions to IDEs such as Visual Studio Code and IntelliJ. Joining Craig and Adam are Sarah D'Angelo, a UX Researcher, and Patrick Flynn, an engineering lead, both on the Cloud Code team at Google.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

News of the week

Links from the interview

Economics of Kubernetes, with Owen Rogers Jul 23, 2019

Show notes

Owen Rogers is a Research Vice President at 451 Research, co-leading the cloud team. He gained a PhD in the economics of cloud computing in 2013. Owen joins Craig and Adam to discuss the economics of cloud computing generally, and Kubernetes specifically.

Do you have something cool to share? Some questions? Let us know: