►
Description
Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)
Keynote: Kubernetes Project Update - Aparna Sinha, Group Product Manager, Kubernetes and Google Kubernetes Engine, Google
About Apara
Aparna Sinha leads the product team at Google for Kubernetes OSS and Kubernetes Engine. She started and co-leads the Product Management SIG to maintain an open backlog for the Kubernetes project on Github. Aparna is currently a secondary member of the CNCF Governing Board. She has worked in enterprise software for 15+ years, and was formerly Director of Product at NetApp. Aparna holds a PhD in Electrical Engineering from Stanford and has co-authored several technical papers during her research.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.
A
Good
morning
welcome
to
Q
Con.
This
is
the
largest
cube
con.
Yet
I
am
very
excited
to
give
you
an
update
on
the
kubernetes
project
and
also
some
of
the
innovations
that
Google
and
others
have
been
adding
to
the
roadmap.
So,
let's
get
started,
I
think
everyone
knows
that
kubernetes
is
a
fast
growing,
fast-moving
project.
A
We've
clearly
won
some
developer
love
with
over
35
thousand
stars
on
github
and
in
the
last
year.
It's
second
only
to
Linux
in
number
of
PRS
and
number
of
issues,
but
perhaps
more
important,
we've
also
matured
technically,
and
that's
evidenced
by
the
certification
program,
the
conformance
test
suite
that
helps.
You
know
that
the
version
of
kubernetes
you're
using
is
in
fact
compatible
with
others.
A
These
are
major
milestones
and
achieved
in
just
three
years,
but
I
think
the
question
on
everybody's
mind
everyone
here
and
of
course
all
of
us
is
how
well
is
kubernetes
adopted
how
many
users
are
using
it.
This
is
hard
to
gauge.
Actually,
there
are
a
number
of
different
surveys
and
it
appears
that
roughly
half
of
even
the
Fortune
100
enterprises
are
using
kubernetes
in
some
shape
or
form,
and
that
seems
to
be
true
across
most
industries.
That's
heartwarming,
that's
encouraging,
but
our
ambition
for
kubernetes
is
actually
much
greater,
so
why
our
enterprise
is
so
important.
A
Well,
personally,
I've
been
working
in
enterprise
system
since
graduating
from
college.
About
five
years
ago,
I
decided
to
make
a
change
I
moved
to
Google
to
work
in
consumer
software,
because
I
thought
Enterprise
Systems,
it's
a
little
bit
slow,
sometimes
a
little
bit
outdated.
There's
a
lot
of
waiting
involved.
Consumer
systems
really
fast
moving
well.
Little
did
I,
know
I
found
out
at
Google
that
enterprise
systems
can
actually
be
quite
fast.
Moving
as
well
and
I
met
the
folks
who
started
kubernetes
at
Google
and
I
realized
that
this
community
has
a
big
dream.
A
A
So
in
the
community,
and
also
at
Google,
we
interact
with
a
lot
of
users
at
Google
with
gke.
We
have
over
a
hundred
thousand
nodes
under
management
and
the
feedback
that
we
hear
from
users
helps
us
helps
us
shape
the
roadmap
for
kubernetes,
some
of
the
things
that
we
hear
this
year
in
particular
that
are
important
to
enterprises.
A
A
A
So
today
you
can
set
policies
at
a
very
granular
level
on
which
user,
which
pod,
which
application
can
do
what
and
speak
to
which
other
resource
in
your
cluster
network
policy
are
back
stability,
pod
security
policy
also,
we've
covered
some
of
the
basics,
like
encrypting
your
secrets
and
rows
hitting
your
certificates.
This
is
tremendous
progress,
but
as
a
user,
how
do
you
consume
this
security?
Well,
one
thing:
that's
probably
a
parent
is
you
have
to
upgrade?
A
Thinking
back
to
my
experience
in
the
enterprise
upgrades
were
not
fun,
it's
not
something
that
we
did
frequently.
So
how
do
you
reconcile
this
well
on
gke?
Some
of
the
things
we've
done
is
we've
built
secure
defaults
into
the
system,
but,
more
importantly,
we've
worked
on
making
upgrades
seamless
so
that
the
application
has
no
downtime.
When
the
cluster
upgrades
and
that's
work
that
we've
done
and
contributed
back
to
the
open
source.
Again,
features
are
important
for
making
them
usable
and
easily
accessible
to
the
users
is
more
important.
A
Another
area
of
security
is
threat.
Detection,
so
you've
got
your
production
application
running.
How
do
you
know
if
there's
a
threat?
How
do
you
know
if
there's
some
someone
crypto
mining
in
your
cluster?
That's
actually
not
within
the
purview
of
the
core
kubernetes
project,
but
fortunately
there
is
an
ecosystem
of
vendors,
and
this
is
just
a
list
of
some
of
them
that
have
started
building
threat,
detection
software
with
containers
and
kubernetes
specifically
in
mind.
So
as
a
user.
How
do
you
obtain
this
easily?
A
That's
a
good
question.
What
we've
done
in
Google
is
we
actually
have
a
single
pane
of
glass,
that
is
the
cloud
security
command
center.
Most
clouds
have
something
like
this:
it's
one
place
where
you
can
see
all
of
the
alerts
and
security
related
threats.
That
may
be
it
that
may
be
present
in
your
network
in
your
storage,
in
your
in
your
compute.
A
Obviously,
since
GCP
is
so
big
on
kubernetes
kubernetes,
engine
and
containers
are
a
first-class
resource
in
this
command
center,
but
again,
more
importantly,
we're
bringing
this
ecosystem
aqua.
Capsule
8
stack,
roxas,
dig
and
twist
lock,
as
the
first
initial
set
of
partners
integrated
into
the
security
command
center.
This
type
of
technology
is
not
deep,
but
it's
actually
really
important
to
make
security
usable
speaking
of
innovation.
You
know,
one
of
the
problems
with
containers
is
that
they
don't
actually
contain
very
well,
and
so
that's
a
problem
for
enterprises.
A
Today,
containers
speak
to
a
kernel
that
is
a
privileged
kernel
and
you
have
many
different
applications
that
share
a
kernel.
This
leads
to
benefits,
like
you
know,
efficiency,
high
utilization
and,
of
course,
fast
startup,
but
there's
actually
a
large
surface
area
of
resources
that
are
exposed
despite
see
groups
and
namespaces,
and
there
are
frequent
kernel
vulnerabilities,
so
the
chance
of
an
application
or
container
escaping
and
impacting
some
other
workload
is
now
is
not
not
negligible.
A
A
One
way
to
implement
sandbox
containers
is
to
use
a
hypervisor
and
that
has
a
full
kernel
inside
the
hypervisor,
so
now
you're
back
to
one
container
or
one
pod
per
VM.
This
is
great
for
isolation,
but
then
you
lose
the
benefits
of
the
low
memory
footprint,
not
having
a
full
colonel
in
the
fast
startup.
Really
what
what
users
want
is
the
benefits
of
containers,
high
utilization
and
high
productivity,
along
with
hypervisor
level
isolation.
So
how
can
we
get
that?
A
Well,
obviously,
we've
been
running
containers
for
many
years
at
Google,
twelve
billion
at
twelve,
twelve
years,
twelve
plus
years
and
billions
of
containers.
So
we
know
how
to
do
this.
Yesterday
we
open
sourced
that
technology.
It's
called
G,
visor
and
I
think
it's
potentially
the
biggest
innovation
since
kubernetes
itself.
What
does
it
do?
A
That's
all
I'm
gonna
say
about
security.
I
think
you
can
see
that
we're
really
making
tremendous
progress.
The
second
objection
tends
to
be
applications.
How
many
applications
can
run
on
this
platform?
We
don't
just
want
stateless
applications.
Obviously
containers
are
good
for
that,
but
what
about
batch?
What
about
machine
learning?
What
about
stateful
applications?
A
Secondly,
GPUs
GPUs
and
hardware:
accelerators
are
critical
for
HPC
and
machine
learning,
and
machine
learning
is
becoming
a
huge
workload
for
kubernetes.
As
machine
learning
takes
off,
people
don't
want
to
have
to
manage
the
GPUs
and
the
underlying
infrastructure,
not
at
the
level
of
granularity
that
some
of
the
brain
researchers
do
and
kubernetes
is
a
great
platform
for
abstracting
away
that
infrastructure.
A
What
we've
done,
in
addition
to
the
GPU
support
in
gke,
is
we've
added
the
constructs
of
advanced
scheduling
so
taints
and
Toleration
x',
pod
affinity
and
auto
scaling,
so
you
can
auto
scale
your
GPUs
with
the
usage
that
you
that
you
have
from
your
machine
learning
workload.
Those
are
some
pretty
nifty
things
and
then
back
to
the
bread-and-butter,
stateful
applications,
databases
that
has
actually
moved
to
GA
again
a
lot
of
work
by
many
members
of
the
community
over
the
period
of
two
years,
and
we
continue
actually
in
cig
storage
with
adding
local
storage
support.
A
So
you
get
high
performance
with
your
stateful
applications
and,
finally,
with
the
container
storage
interface,
this
is
great,
but
we're
not
stopping
at
GA
we're
actually
going
to
make
stateful
applications
much
more
automated
and
easy
to
use
and
that's
important.
The
concept
here
is
that
of
application
operators.
What's
an
operator
well,
traditionally,
an
operator
is
a
person,
it's
a
person
that
does
backup
and
restore
they
monitor
and
scale
the
application.
If
you
think
about
databases,
that's
usually
the
DBA,
but
in
the
world
of
kubernetes
it's
a
piece
of
software.
A
It's
something
that
automates
the
deployment
and
management
of
the
application
in
your
cluster
what's
more
exciting,
actually
is
that
the
operator
extends
the
kubernetes
api
for
the
application,
so
through
the
use
of
a
custom
resource
definition,
the
operator
basically
makes
it.
So
you
can
speak
your
application
to
kubernetes
itself
using
cube
cuddle.
So
I'm
not
gonna,
try
and
talk
about
that.
I'm.
Just
gonna
give
you
a
demo.
So
if
we
could
switch
over
I'm
going
to
be
demonstrating
the
SPARC
operator
that
was
developed
at
Google
see
if
we
can
switch
over
to
my
laptop.
A
It's
available
in
github
and
so
I've
cloned,
the
repo
and
I've
got
the
yanil
for
the
SPARC
operator,
so
I'm
gonna
do
cube,
cuddle,
apply,
dash,
F
SPARC
operator,
and
what
that's
going
to
do
is
it's
going
to
deploy
the
SPARC
operator
as
of
as
a
as
a
deployment.
But
you
know
normally,
if
you
were
to
deploy
the
SPARC
application
in
kubernetes,
there
would
be
a
lot
of
config
involved
and
it
could
take
quite
a
bit
of
time
to
deploy
the
application.
A
All
right
so
now
the
SPARC
operator
is
created.
So
if
I
refresh
here,
the
UI
I
see
that
the
SPARC
operator
is
created,
so
it's
actually
in
one
command
actually
deployed
SPARC
made.
It
look
really
super
simple,
which
is
how
it
should
be.
You
can
imagine
doing
this
for
any
stateful
application,
but
it's
also
extended
the
kubernetes
api.
So
I
can
now
run
SPARC
jobs
directly,
using
cube,
cuddle
and
I'm
going
to
show
you
that
I
have
another
channel
here,
which
is
the
bigquery
word
count
llamo,
and
so
let's
look
at
this
yeah
mo.
A
You
can
see
that
this
yeah
Mille
is
using
a
new
API
kind,
which
is
called
SPARC
application,
and
so
it's
depending
on
that
extension
and
what
it's
going
to
do
is
you
know
it's
a
it's
a
java
application.
You
know
running
in
cluster
mode,
but
what
it's
going
to
do
is
it's
going
to
pick
all
of
the
works
of
Shakespeare
and
it's
going
to
do
word
count.
It's
gonna,
say:
ok
across
all
the
works
of
Shakespeare.
A
A
Okay,
and
here
all
I
need
to
do
is
cube,
cuddle
apply
F
now
bigquery,
and
what
we'll
start
to
see
here
is
that
the
system
is
creating
spark
they're,
creating
a
spark
driver
and
spark
executor
pods,
and
so
these
parks,
these
pods,
have
started
to
initialize
in
the
cluster
and
they're
going
to
start
running.
These
spark
jobs
automatically
and
I
will
start
to
have
in
Google,
Cloud
Storage
I'll
start
to
have
a
new
bucket
here.
A
Well
soon,
it
hasn't
yet
completed
right.
So
we
have
one
driver,
pod
and
two
executors.
Pod
spark
also
has
a
master
slave
architecture
and
they're
going
ahead
and
they're
doing
this
analysis
of
all
of
Shakespeare's
work.
And
now
we've
got
this
bucket
created,
and
if
we
go
further
into
it,
we
will
see
the
results.
The
output
of
of
the
word
count
I'm
gonna
switch
over
to
the
slides
to
keep
going,
but
this
should
give
you
an
idea
of
the
power
of
application
operators.
A
You
don't
have
to
know
a
lot
about
the
application
it
can
be
deployed
automatically
in
kubernetes,
and
then
you
can
just
hit.
Go
the
last
piece
in
managing
applications.
You're
going
to
have
now
many
applications
in
your
environment
in
one
cluster
and
potentially
many
clusters
in
different
clouds.
So
how
do
you
monitor
all
of
that
in
one
single
pane
of
glass?
We
found
that
that's
actually
quite
important
from
our
experience
with
Sree
at
Google.
A
You
want
to
have
both
application
metrics,
as
well
as
infrastructure
metrics
in
one
play
in
a
glass
across
your
environment,
and
so
what
we've
done
on
on
gke
is
we've
pulled
in.
You
know
all
of
the
kubernetes
resources
in
the
stack
driver,
so
you
have
one
pane
of
glass
there,
but
what's
more
important
is
we
were
actually
started,
contributing
to
the
Prometheus
open
source
code
base.
Prometheus,
for
those
of
you
who
don't
know
is
the
default
metrics
pipeline
for
kubernetes
clusters,
and
so
many
folks
are
using
Prometheus
in
their
on-prem
clusters.
A
The
contribution
that
we've
made
there
is
we've
created
an
API
that
allows
you
to
pull
metrics
and
stream
them
to
the
cloud,
and
so
in
gke
we
stream
the
metrics
from
on
pram
clusters
using
Prometheus
to
provide
one
pane
of
glass
where
you
can
see
all
of
your
clusters
in
both
application
and
infrastructure
metrics.
What
is
that
combination?
Give
you
well
there's
many
examples.
You
can
use
application
metrics
to
trigger
the
horizontal
pod
autoscaler.
You
can
use
application
and
infrastructure
together
to
debug
your
application.
A
These
are
some
of
the
simpler
innovations
but
they're
really
important
again
for
usability
and
broader
adoption
of
kubernetes.
The
last
thing
I'm
going
to
cover
is
developer
experience.
So
there's
been
a
lot
of
talk
about
the
developer
experience
of
kubernetes
and
whether
it's,
whether
it's
truly
as
good
as
it
could
be
and
I,
think
it's
not.
If
you
think
about
what
a
developer
does
their
writing
source
code
somewhere
over
here
on
the
left
and
then
there's
kubernetes
that's
been
installed
and
is
managed
for
them.
A
Many
different
tools,
many
different
choices,
there's
no
one
well-lit
path
for
this
process
and
I'm,
not
gonna,
say
that
there
is
because
there
isn't
and
there's
a
lot
of
work
in
the
community
to
fix
this
or
to
improve
this
experience.
But-
and
actually
this
experience
goes
on
if
you're
a
developer,
you
do
this
many
many
times
a
day,
because
you
know
you're
making
changes
but
there's
a
project
that
has
recently
been
open
sourced.
Actually
it
was
developed
by
one
of
our
customer
engineers
at
Google,
so
this
is
very
much
customer
friendly.
A
It's
called
scaffold,
it's
a
small
project
and
they're
gonna.
Give
you
a
demo
of
it
just
to
show
what
this
developer
experience
could
be
in
the
future
and
I
demo
scaffold,
because
in
the
two
months
that
it's
been
out
and
has
more
than
three
thousand
stars.
So
it
must
be
somewhat
useful
to
some
number
of
people.
We
can
switch
over
to
my
laptop.
A
So
we're
back
in
our
cluster
and
there's
it
there's
there's.
Actually,
this
is
the
scaffold
directory
and
I'm
gonna
pretend
to
be
a
developer.
What
I'm
doing
is
I'm
working
on
this
application
called
main
goal.
It's
a
very
simple
application.
It
just
says
hello
cube
con.
It
prints,
hello,
cube
con,
and
so
now
I
don't
know
much
about
kubernetes.
There's
a
cluster
out
there
somewhere,
okay,
I,
don't
really
want
to
know
all
of
the
things
that
I
need
to
do.
Just
let
me
run
this
and
change
it
and
iterate.
So
with
scaffold.
A
A
So
this
is
what
it's
doing
right
now
and,
and
you
can
run
scaffold
locally
on
your
Mac
or
in
this
case
we're
running
it
against
a
kubernetes
cluster
in
in
gke,
and
so
it's
using
container
builder,
which
is
a
built-in
functionality
in
GCP,
and
then
it's
pushing
the
image
up
to
GCRs
container
registry.
The
nice
thing
about
this
is
your
developer
actually
doesn't
have
to
know
all
of
this,
and
you
can
be
setting
policies
on
the
registry.
A
You
can
be
doing
it
voluntarily,
scanning
and
image
provenance
and
all
of
the
enterprise-grade
policies
that
you
want
to
have
around
those
images
can
be
baked
in
to
that,
and
so
here
we
are.
We're
now
live
we're
saying
hello
cube
con,
but
the
the
other
interesting
part
of
this
is
that
I
as
a
developer,
I'm
going
to
go
ahead
and
change
main
go
cuz.
You
know
I'm
testing
it
out
and
I
want
to
try
something
else.
So
I'm
gonna
say
hello,
cube
con.
A
A
Actually,
this
this
time,
there's
a
there's,
a
problem:
I
haven't
fully
got
the
credentials,
but
what
it
should
do
is
it
will
pick
up
the
changes
and
it'll
start
saying:
happy
huggy
to
cube
Khan,
okay,
we'll
switch
over
to
the
slides,
so
that
those
are
some
of
the
simple
examples
of
how
we
can
make
kubernetes
easier
to
use
and
how
it
can
be
better
adopted
in
the
enterprise.
I
just
want
to
leave
you
with
the
thought
that
this
project
has
a
great
deal
of
horsepower.