Kubernetes Podcast from Google

Copyright: © This work is licensed under a Creative Commons License - Attribution-NonCommercial-NoDerivatives 4.0 International - http://creativecommons.org/licenses/by-nc-nd/4.0/

Latest Episodes:

SIG-Node, with Dawn Chen Sep 26, 2018

Show notes

Dawn Chen, TL for SIG-Node and the Google Kubernetes Engine node team, joins Craig and Adam this week. She has worked on containers and container schedulers since 2007 - not a typo. We also bring you the news, in part from the echo chamber of Google Cloud Summit in Sydney.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter of the week

News of the week

Links from the interview

Dawn Chen on GitHub
The Borg paper
Process containers (later 'cgroups'):
- The first submission of containers to the Linux kernel
- Early coverage of process containers
- Paul Menage's 2007 paper "Adding Generic Process Containers to the Linux Kernel"
- Dawn's first job: tracking processes. Each job had its own GID - she would use netlink connection tracking to map processes and threads to GIDs, and, using procfs, figure out CPU and memory usage.
- Dawn's second job: adjusting CPU usage using nice
- Today we just use memcg
- Fake NUMA - cut a machine into big chunks and assign them to groups of processes.
Linux Plumbers Conference
- Tim Hockin's presentation at the Linux Plumbers Conference in 2011, talking about the work Dawn's team were doing
lmctfy - Let Me Contain That For You
- In case you don't get the joke
- It's like runc and containerd
SIG Node
- Node and lifecycle management
- Application management
- Container runtimes and kubelet
- Node problem detection
- Resource management
- GPU & TPU
- Security isolation
- gVisor and Sandbox Pods
- Logging and monitoring
Was SIG Node the first SIG?
- Tied with SIG API Machinery
How did we get to CRI?
Container RuntimeHandler, so some pods can run with one runtime and some with another

Kubernetes SIG-PM, with Ihor Dvoretskyi Sep 19, 2018

Show notes

This week, your hosts talk to Ihor Dvoretskyi, Developer Advocate at the Cloud Native Computing Foundation, about SIG-PM, the Special Interest Group for Kubernetes Program, Product and Project Management.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter

News of the week

Links from the interview

Ihor Dvoretskyi on Twitter or GitHub
SIG-PM - Program, Product and Project Management
SIG-PM Intro Talk from KubeCon EU 2018

Cloud Native Patterns for Ops, with Justin Garrison Sep 12, 2018

Show notes

Justin Garrison is both a student and a teacher. A senior systems engineer in the media industry, he has boiled his experience and wisdom, as well as that of his co-author Kris Nova, into the book Cloud Native Infrastructure. He talks to Craig and Adam about the Kubernetes community and the process of writing.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter

KubeCon NA '17 keynote: Your Philips Hue Light Bulbs Are Turned On By Kubernetes by Mark van Straten
Philips Lighting case study on Google Cloud

News of the week

Cisco Hybrid Cloud Platform for Google Cloud is now generally available
- Enter the Cisco & Google Cloud Challenge! Win things!
Consul + Kubernetes from Hashicorp
Open Match announced by Google Cloud and Unity
- Agones 0.4.0 released
Couchbase Autonomous Operator
Amazon EKS now available in Ireland
- Google Cloud now available in Finland
Platform9 introduces spot instance arbitrage
External DNS 0.5.6 released
Red Hat on Kubernetes and application servers

Links from the interview

mintCast, which featured Justin a long time ago
Cloud Native Infrastructure book: website and O'Reilly
- The Economics of Writing a Technical Book
Justin's last KubeCon talk: Let's Build Kubernetes, With a Spreadsheet and Volunteers!
Justin Garrison on Twitter and GitHub
- Dashiell, rothgar/v2
Justin's blog

kube-hunter and KubeCon, with Liz Rice Sep 05, 2018

Show notes

Liz Rice from Aqua Security builds penetration testing tools for Kubernetes by day, and runs the KubeCon program by night. Adam and Craig dig into both topics.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter

Adam went to Battle Ground Lake State Park
Adam and Craig are both going to Google Cloud Next in Tokyo (September 19-20)
Craig is also going to Google Cloud Summits in Singapore (September 13), Sydney (September 26) and Hong Kong (October 10)

News of the week

Links from the interview

Supporting Kubernetes, with Ken Massada Aug 28, 2018

Show notes

What does it take to support Kubernetes for other users? Kenneth Massada, a lead for GKE support at Google Cloud, tells Craig and Adam his story.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter

Adam lives in Seattle, which is on fire
Craig baked some tasty cookies
- Using this recipe
- But not using Vegemite, British Marmite or New Zealand Marmite, which are three totally separate things. Only one of which is nice.
  - Hint: it's the last one

News of the week

2018 Kubernetes Steering Committee Elections
Binary Authorization on Google Kubernetes Engine
kube-hunter from Aqua Security
- Video
- Blog
Kubernetes issues and solutions from Alexander Lukyanchenko at Avito
Cilium 1.2 released
- Accelerating Envoy with the Linux Kernel
James Lee's blogs on Kubernetes networking
Amazon EKS supports GPU-Enabled EC2 instances

Links from the interview

etcd is hard:
- Configuration flags
- OpenAI suggestions on scaling Kubernetes to 2,500 nodes includes a separate events database
- Kubernetes docs on configuring and upgrading etcd
- Tina and Fred from Google SRE also discussed etcd on Episode 9
- (Or use GKE, where we do it all for you)
Other hard concepts:
- apiVersion: is hard
- spec: is hard
- Liveliness and readiness probes - don't make them the same!
- Joe Beda thinks of YAML as machine code in Episode 12
What would Ken like to see changed in Kubernetes?
- Affinity and anti-affinity rules and topology keys
Kenneth Massada on Twitter
- Or summon him with a GCP support case!

Shopify and Security, with Jon Pulsifer Aug 21, 2018

Show notes

Jon Pulsifer is a Production Security Engineer at Shopify, and Canada's biggest Kubernetes fan. Adam and Craig dig into why, and what Adam's new mode of transport is going to be.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

Chatter

Sling TV using Kubernetes
- Tesla using Kubernetes?
MITMproxy, Charles and Fiddler
- Intercept HTTP traffic exiting a docker container
Adam has a lot of EconoLodge points
- Not as many as Software Defined Talk hosts Matt Ray and Michael Coté
- Craig thinks he should spend them on the Pepsi jet as seen in this wonderful video

News of the week

Service Networking in a Hybrid Infrastructure by Praveen Shukla from GoJek
KubeCon and CloudNativeCon China
- Craig's session
7 best practices for operating containers by Théo Chamley from Google Cloud
kustomize on Homebrew for macOS
Understanding the Container Storage Interface (CSI) by Anoop Vijayan Maniankara
The Istio 1.0 Release Stream or jump straight to the part with Dan Ciruli from episode 15

Links from the interview

Royal Canadian Navy - Canadian Forces NOC
SANS institute and instructors
Jon Pulsifer is a Production Security Engineer at Shopify
Shopify's adopting Kubernetes and Google Cloud
The evolution of Kubernetes security
- Before RBAC, you used to have to mount an empty directory over the service account to disable access to it
- seccomp and AppArmor
- RBAC
- PodSecurityPolicy
- gVisor and Kata Containers
- Planning for Secure Container Isolation in Kubernetes
- RuntimeClass enhancement proposal
Binary Authorization
- Launch blog post
- Kritis - open source reference implementation of Binary Authorization (the judge)
- Grafaes - API spec for Container Analysis API
- Shopify Voucher, a tool that creates attestations for Binary Authorization and prevents the deployment of images that don't meet Shopify's security requirements.
- Jon's talk on Binary Authorization at Google Cloud Next: Securing the Software Supply Chain
Shopify's $25,000 Kubernetes bug bounty payout
- What is a server-side request forgery?
Getting started with security by reading kubesec.io
Around Ottawa
Jon Pulsifer on Twitter

Descartes Labs, with Tim Kelton Aug 14, 2018

Show notes

Tim Kelton is co-founder and cloud architect for Descartes Labs. Prior to starting Descartes Labs, he was a R&D engineer for 15 years at Los Alamos National Laboratory, working on problem areas such as deep learning, space systems, nuclear non-proliferation, and counterterrorism. Tim talks to Craig and Adam about the use of Kubernetes and Istio in geopolitics, machine learning and food supply.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

News of the week

Cloud Native Computing Foundation Announces Prometheus Graduation
OpenMetrics project accepted into CNCF Sandbox
An Exciting New Direction for the Kubic project
Demystifying RBAC in Kubernetes
Kubebuilder 1.0 scaffolds (with a C) Kubernetes APIs and operators
- Getting Started
- GitHub
Operator Lifecycle Management - it's operators all the way down

Links from the interview

Descartes Labs
Beowulf clusters (a Slashdot meme)
Omega and Borg papers
Mountain biking in Sedona
Descartes Labs Python client
SRE books:
- Site Reliability Engineering
- The Site Reliability Workbook - free until August 23
Descartes Labs talks from Cloud Next '18:
- SRE Quality Operations for Your Services Using the Istio Service Mesh & Stackdriver - with Tim Kelton and Jay Judkowitz from Stackdriver Service Monitoring
- How Computers See the Earth: A ML Approach to Understanding Satellite Imagery with Kyle Story
- Building Multi-Tenancy ML Applications with GKE and Istio to Better Understand the Earth with Tim Kelton and Sam Skillman
Descartes Labs GeoVisual Search - find the squares on the globe that look most like a given square
Tim Kelton on Twitter

Istio, with Jasmine Jaksic and Dan Ciruli Aug 07, 2018

Show notes

Istio has hit 1.0, and there's no-one better to tell you about it than Jasmine Jaksic and Dan Ciruli from Google Cloud. Adam and Craig bring you this, as well as the news from the ecosystem.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

News of the week

Links from the interview

Announcing Istio 1.0
SRE Quality Operations for Your Services Using the Istio Service Mesh and Google Stackdriver, featuring Tim Kelton from Descartes Labs (who presented at the Toronto event two years ago, and has been using Istio in production since 0.2)
Google's Cloud Services Platform
- Kubernetes Podcast episode 13 on Cloud Services Platform with Aparna Sinha
- (It's Dan's favorite episode so far)
Istio à la carte; a presentation by Dan
Istio and the future of service meshes; an article by Jasmine
The Istio project:
- The URL (The IP address is 104.198.14.52)
- Community page, listing Google Groups
- Rocket Chat for users
- Twitter
Jasmine Jaksic and Dan Ciruli on Twitter

Knative, with Oren Teich Jul 31, 2018

Show notes

One of the most interesting announcements from Google Cloud Next was Knative, a framework for building serverless products on top of Kubernetes. Craig and Adam talk to Google Director of Product Management, Oren Teich, about the launch.

Do you have something cool to share? Some questions? Let us know:

web: kubernetespodcast.com
mail: kubernetespodcast@google.com
twitter: @kubernetespod

News of the week

Google's Cloud Services Platform:
- Recapping GKE On-Prem and Knative
- Cloud Services Platform session video with Chen Goldberg and Aparna Sinha
- Google Cloud Build
- GitHub integration
Knative analysis:
- Joe Beda's TGI Kubernetes on Knative
- Using the Knative build system by itself
Visual descriptions:
- Kubernetes: the theme park analogy
- The Kubernetes Comic
Kubernetes blog posts:
- KubeVirt: Extending Kubernetes with CRDs for Virtualized Workloads
- Feature highlight: CPU Manager

Links from the interview

Oren Teich on Twitter
About Knative:
Google Cloud Next videos:
- Serverless at Google Cloud, with Oren Teich
- High-level video intro to GKE Serverless add-on and Knative, with DeWitt Clinton and Ryan Gregg
  - Request early access to the Serverless add-on for GKE
- Developer video intro to Knative, with Ville "Fifth Beatle" Aikas and Mark Chmarny
  - Mark's Knative samples
IBM "Zed Series"

Google Cloud Services Platform, with Aparna Sinha Jul 24, 2018

Show notes

Learn about the announcements from Google Cloud Next, including GKE On-Prem, Cloud Services Platform, and Istio 1.0. Google's product management lead for Kubernetes and CNCF governing board member Aparna Sinha joins Adam and Craig to discuss what's new.

Do you have something cool to share? Some questions? Let us know: