PodCTL - Enterprise Kubernetes

Latest Episodes:

Day to Day Kubernetes Operations Nov 20, 2017

Show notes

Show: 17
Show Overview: Brian and Tyler talk about CNCF Kubernetes Conformance, OpenShift 3.7 GA, and some common questions about day-to-day operations with Kubernetes.
Show Notes:

Topic 1 - How do you deploy the underlying compute resources that are used as Nodes in a Kubernetes cluster?
Topic 2 - If a Kubernetes environment has to scale, how do you grow out the computing (or other) resources?

Topic 3 - When a new version of Kubernetes comes out, how do you manage to upgrade the environment?

Topic 4 - What are the common things that the Ops team is tracking, monitoring, measuring in a Kubernetes environment?

Topic 5 - What are some things that have changed, from an operational perspective, because a Container/Kubernetes environment and previous technologies (e.g. VMs)?
Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

Security: Identity Management, RBAC, Authentication and Authorization Nov 13, 2017

Show notes

Show: 15
Show Overview: Brian and Tyler continue their focus on Security with Marc Boorshtein (@mlbiam, CTO of @tremolosecurity), discussing Identity Management, Container and Kubernetes Authorization and Authentication, RBAC, and how IT teams evolve to manage security in more agile environments.
Show Notes:

Topic 1 - Let’s talk about User authentication in Kubernetes>

Certificate Authentication
OpenID Connect
Reverse Proxy

Topic 2 - Let’s dig into the various types of Authorizations

Overview of RBAC (Role-Based Access Control)
Mapping of Roles to Users and Groups
Organizational Challenges

Topic 3 - Given that various people (Devs & Ops) interact with dashboards, how do we manage that Authentication?
Topic 4 - How are organizations evolving to keep up with this more agile form of software development and the associated security challenges?
Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

Security: Hosts, Registries, Content and Pipelines Nov 06, 2017

Show notes

Show: 14
Show Overview: Brian and Tyler talk address some of the many layers of security required in a container environment. This show will be part of a series on container and Kubernetes security. They look at security requirement in the Container Host, Container Content, Container Registry, and Software Build Processes.
Show Notes and News:

Topic 1 - Let’s start at the bottom of the stack with the security needed on a container host.

Linux namespaces - isolation
Linux capabilities and SECCOMP - restrict routes, ports, limiting process calls
SELinux (or AppArmor) - mandatory access controls
cGroups - resource management

Topic 2 - Next in the stack, or outside the stack, is the sources of container content.

Trusted sources (known registries vs. public registries (e.g. DockerHub)
Scanning the content of containers
Managing the versions, patches of container content

Topic 3 - Once we have the content (applications), we need a secure place to store and access it - container registries.

Making a registry highly-available
Who manages and audits the registry?
How to scan container within a container?
How to cryptographically sign images?
Identifying known registries
Process for managing the content in a registry (tagging, versioning/naming, etc)
Automated policies (patch management, getting new content, etc.)

Topic 4 - Once we have secure content (building blocks) and a secure place to store the container images, we need to think about a secure supply chain of the software - the build process.

Does a platform require containers, or can it accept code? Can it manage secure builds?
How to build automated triggers for builds? How to audit those triggers (webhooks, etc.)?
How to validate / scan / test code at different stages of a pipeline? (static analysis, dynamic analysis, etc.)
How to promote images to a platform? (automated, manual promotion, etc.)

Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

An Introduction to CRI-O Oct 30, 2017

Show notes

Show: 12
Show Overview: Brian and Tyler talk with Dan Walsh (@rhatdan, Consulting Engineer at Red Hat, container team lead) and Mrunal Patel (@mrunalp, Principal Engineer at Red Hat, OCI/runc maintainer) about the evolution of containers with Kubernetes, the creation of CRI-O, and the focus on container security and stability. We also discussed emerging projects like Skopeo, Buildah, Intel Clear Containers and Grafeas.
Show Notes:

Topic 1 - Welcome to the show. Why don’t you both introduce yourselves and tell us what areas you focus on.
Topic 2 In past episodes, we’ve talked about the CRI-* concept in Kubernetes. We’ve also talked about the OCI standard for containers. So what is CRI-O?
Topic 3 What problems does CRI-O attempt to solve for the container ecosystem?
Topic 4 - How does CRI-O different from containerd and CRI-containerd?
Topic 5 - How can people get CRI-O today? What are some of the things people can expect with CRI-O beyond v1.0?
Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

Service Catalog All the Things Oct 17, 2017

Show notes

Show: 10
Show Overview: Brian and Tyler talk with Paul Morie (@cheddarmint, Principal Software Engineer @RedHat, Lead of Kubernetes Service Catalog SIG) about the evolution of the Open Service Broker API, integrating with external services, the role of Service Brokers, and use-cases to expand Kubernetes applications.
Show Notes

Topic 1 - Welcome to the show. Before you got involved in the Service Catalog SIG, you worked on several other aspects of Kubernetes (security, etc.). Tell us about some of the things you’re been involved with?
Topic 2 - Let’s go back to when the Open Service Broker API was announced. What was the purpose and how did it evolve to where it is now?
Topic 3 - What are the basics of how the Service Broker / Service Catalog interacts with applications on Kubernetes and 3rd-party services?

Example: How do we think about user/password/security credentials to a database?
Example: Is the Service Broker in the data path as well as the control path?
Example: Where would traffic auditing functions happen?

Topic 4 - We saw a demo of the Service Catalog/Broker at Red Hat summit during an announcement with AWS, where is showed AWS services as part of the catalog. Previously, we’ve seen the CF Service Broker interact with Google or Azure services. Is the relationship between the broker and cloud-services “cloud specific”, or will things be interchangeable at all?
Topic 5 - Beyond public cloud services, what other types of things might be interconnected or managed via the Service Broker?
Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl..com

Unclogging some Kubernetes Plumbing Issues Oct 09, 2017

Show notes

Show: 9
Show Overview: Brian and Tyler talk about Kubernetes Networking and Kubernetes Storage.
Show Notes:

Topic 1 - Let’s talk about the challenges of networking with containers and some of the ways that Kubernetes addresses these challenges.

There’s lots of different ways to network containers together. Kubernetes does some basic networking (by default), and then there are add-on options for more complex, secure scenarios.
The role of DNS in Kubernetes networking (services, etc.)
Kubernetes network plugins (CNI: container network interface)
Ingress and Egress Routes, Services, Load Balancing
Network Policy (fine-grained traffic control)

Topic 2 - Let’s talk about the challenges of storage with containers and some of the ways that Kubernetes addresses these challenges.

There’s definitely a misperception that containers should only be used for stateless applications.
Containers are (primarily) Linux, and Linux has well known concepts about how to interact with persistent storage.
Containers need a way to interact with persistent storage in a model where it can be dynamically allocated.
Kubernetes storage plugin proposal (CSI: container storage interface)

Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

Managing High Performance Workloads Oct 02, 2017

Show notes

Show: 8
Show Overview: Brian and Tyler talk with Jeremy Eder (@jeremyeder, Senior Principal Software Engineer at Red Hat) about the Kubernetes Resource Management Working Group, scaling Kubernetes environments, extending Kubernetes for high-performance workloads (HPC, HFT, Animation, GPUs, etc.), testing at scale and how companies can get involved.
Show Notes:

Topic 1 - Welcome to the show. You recently introduced the Resource Management Working Group within Kubernetes. Tell us a little bit about the group.
Topic 2 - The group’s prioritized list of features for increasing workload coverage on Kubernetes enumerated in the charter of the Resource Management Working group includes (below). Let’s talk about some of the types of use-cases you’re hearing that drive these priorities.

Support for performance sensitive workloads (exclusive cores, cpu pinning strategies, NUMA)
Integrating new hardware devices (GPUs, FPGAs, Infiniband, etc.)
Improving resource isolation (local storage, hugepages, caches, etc.)
Improving Quality of Service (performance SLOs)
Performance benchmarking
APIs and extensions related to the features mentioned above

Topic 3 - This is a broad list of areas to focus on. How do you determine what things should be kernel-level focus, Kubernetes-level focus, or application-level focus?
Topic 4 - How do you go about testing these areas? Are there lab environments available? How will you publish methodologies and results?
Topic 5 - As you talk to different companies, do you feel like they are holding back on deploying higher-performance applications on Kubernetes now, or they are looking for more optimizations?
Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

Digging into Kubernetes 1.8 Sep 25, 2017

Show notes

Show: 7
Show Overview: Brian and Tyler talk with Clayton Coleman (@smarterclayton, Lead Kubernetes Architect) and Derek Carr (@derekwaynecarr, Kubernetes Lead Engineer) about the Kubernetes development process, the role of SIGs, the process for deciding what gets included in a release, as well as an in-depth discussion about the extensibility of Kubernetes 1.8
Show Notes:

Topic 1 - Welcome to the show. Both of you are top contributors to Kubernetes, both also lead (or co-lead) some of the SIG/Working group. Can you give us a sense of your community involvement from a contributor and leader perspective?
Topic 2 - Derek, you're on the nomination list for the Kubernetes Steering Committee. Chris Aniszczyk mentioned it a couple weeks ago, but what does that group do that’s different than SIGs?
Topic 3 - When there are 100s of contributors and many different focus areas, what is the process for deciding what’s included or prioritized or dropped from a specific release?
Topic 4 - Kubernetes 1.8 has a mix of Alpha, Beta and Stable features. What do you see as the key focus areas in this release? (e.g. RBAC, CRI-O, etc.)
Topic 5 - How does Kubernetes look at the explosion of “tools” around core Kubernetes (deployers, application templates, application frameworks) and when to make those parts of the project or keep them separate?

Feedback?

Email: PodCTL at gmail dot com
Twitter: @PodCTL
Web: http://podctl.com

What's included with Kubernetes? Sep 18, 2017

Show notes

Show: 6
Show Overview: Brian and Tyler talk about the technologies in “core” Kubernetes and the additional elements needed to evolve it into a more complete application platform.
Show Notes:

[TRANSCRIPTION] - coming soon
PodCTL #4 - All the Tools in the Kubernetes Toolbox
PodCTL #3 - Making sense of container standards (including OCI)
Kubernetes by Example

News of the Week:

Oracle joins the CNCF
Heptio takes Series B round of VC funding
Jaeger (@JaegerTracing) and Envoy (@EnvoyProxy) become official CNCF projects.

Topics 1 - What's included in Kubernetes (by default)?
We’ve seen quite a bit of survey data recently that shows usage of Kubernetes is growing quite rapidly. If somebody says they are “using Kubernetes”, by default, what functionality do they have available to them?
Topic 2 - What core “platform” elements aren’t included with Kubernetes?