►
From YouTube: How to Effectively Manage Kubernetes in a Regulated Environment - Darien Ford, Capital One
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2021 Virtual from May 4–7, 2021. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
How to Effectively Manage Kubernetes in a Regulated Environment - Darien Ford, Capital One
Kubernetes plays an important role when scaling containerized applications in a highly regulated environment. Capital One understands this first hand, as they will complete a multi-year journey to exit on-prem data centers this year and move to the public cloud. As large enterprises look to shift to cloud architecture, Darien Ford will explain how Kubernetes container orchestration accelerates a safe and effective shift to cloud architecture with both developer experience and enterprise requirements in mind. As network boundaries broaden, he will cover ways container orchestration can help introduce workloads to the cloud while managing application development, testing, deployment and, of course, governance and policy compliance.
https://sched.co/ekAI
A
A
Banking
is
ripe
for
disruption,
and
we
want
to
be
the
ones
that
disrupt
the
industry.
Capital
one
was
founded
on
the
belief
that
the
banking
industry
would
be
revolutionized
by
information
and
technology.
We
are
known
for
being
a
data
and
tech
pioneer
in
the
financial
services
industry.
Two
decades
later,
our
belief
is
stronger
than
ever
and
we
are
seeing
the
relevance
of
this
focus
right
now
in
the
pandemic,
as
businesses
of
all
sizes
grapple
with
how
to
engage
customers
at
a
distance
through
digital
channels
in
the
same
human
and
personalized
ways
they
did
before.
A
When
we
think
about
where
the
future
of
banking
is
headed,
we
start
by
looking
at
how
technology
is
changing
our
lives.
The
digital
revolution
has
changed:
how
we
communicate
connect
with
people.
Shop,
travel,
manage
our
health
and
manage
our
money.
Digital
adoption
has
only
accelerated
with
covet
19..
We've
all
seen
years
of
digital
adoption,
condensed
down
to
months
or
even
just
weeks,
capital
one
has
spent
the
last
eight
years.
Investing
in
a
technology
transformation
focused
on
comprehensively
reimagining,
our
culture
and
talent
strategy,
how
we
work
and
modernizing
and
hardening
our
technology
infrastructure.
A
A
The
most
challenging
part
of
moving
to
the
cloud
as
a
highly
regulated
industry
is
building
the
technology,
governance
structure
and
support
of
culture.
On
the
technology
side,
many
financial
institutions
have
structural
barriers
legacy
systems
that
have
been
in
use
for
20
years.
Most
banks
don't
have
the
technology
in
place
to
even
send
their
code
outside
of
the
company's
corporate
firewall.
A
From
the
governance
perspective,
it
takes
time
to
develop
a
process
where
code
is
reviewed
by
legal
information,
security
and
leadership,
along
with
other
stakeholders,
without
impacting
the
developers
themselves.
All
that
much
and
culturally
traditional
banks
need
to
challenge
the
perceived
risks,
such
as
loss
of
intellectual
property,
competitiveness
or
productivity.
A
A
huge
part
of
us
going
all
in
on
the
cloud
and
digital
transformation
is
investing
in
our
tech
associates
and
giving
them
the
tools
they
need
to
excel.
We
believe
in
our
associates
and
we
believe
in
continuously
investing
in
them.
One
way
we
invest
is
to
constantly
encourage
continued
learning.
To
that
end,
we
launched
a
tech
college
inside
of
capital,
one
to
support,
associates
ability
to
sharpen
their
skills.
Our
focus
areas
include
software
engineering,
security,
cloud,
mobile
data,
agile
and
machine
learning.
A
A
For
example,
we
have
aspirational
targets
for
the
number
of
engineers
who
will
get
aws
certifications
and
we're
giving
associates
time
to
study
over
the
course
of
the
summer
and
into
the
fall.
We've
had
a
series
of
invest
in
yourself
days,
one
day
a
month
where
there
are
no
meetings
allowing
time
to
focus.
A
We've
had
numerous
certifications
completed
over
the
past
several
months
as
a
result
of
the
program,
an
unforeseen
side
effect
with
our
gradual
approach
to
the
cloud
came
when
we
saw
duplication
of
efforts
when
you
really
embrace
the
cloud
and
tell
developers
who
are
organized
into
independent,
agile
teams
to
go
make
stuff
happen.
You
get
various
iterations
on
similar
solutions,
a
large
amount
of
duplication.
A
Many
of
these
teams
were
used
to
throwing
solutions
over
the
wall
for
someone
else
to
run,
and
yet
now
they
had
to
own
things
end
to
end.
We
quickly
realized.
We
quickly
realized
that
a
u-bill
that
you
own
at
mandate
and
doubling
down
on
devops
was
the
key
to
keeping
delivery
rapid,
but
well-managed
at
the
same
time.
Re-Architecting
our
process
in
this
way
has
allowed
us
to
successfully
and
efficiently
deliver
solutions
in
the
cloud.
A
Another
best
practice
I
can
share
in
this
area
is
investing
in
creating
a
single
common
deployment
pipeline
ecosystem
that
allows
us
to
build
consistent
checks
and
expectations
for
getting
code
into
production.
We
built
this
solution
to
address
a
gap
in
the
industry
and
we're
already
seeing
the
benefits
of
more
efficient
delivery.
A
We've
applied
similar
thinking
to
our
container
management
strategy.
In
recent
years,
we've
scaled
our
usage
of
kubernetes
and
steadily
increased
the
number
of
containerized
applications.
We
have
running
production
harkening
back
to
some
of
our
earlier
lessons
learned
from
our
cloud
journey.
We
knew
we
wanted
to
avoid
silo
teams
creating
disparate
solutions
to
manage
their
own
containerized
applications.
A
Instead,
we
decided
we
needed
to
standardize
on
our
own
set
of
additional
features
across
the
company
that
would
enable
our
developers
to
more
efficiently
develop
and
deliver
business
value.
This
meant
running
kubernetes
at
enterprise
scale
in
a
regulated
environment.
Earlier
this
year
we
commissioned
a
study
with
forester
consulting
about
container
adoption
and
usage
in
the
enterprise.
We
found
that
compliance
is
the
number
one
concern
among
senior
leaders
using
container
management
platforms.
A
For
this
reason,
it
might
surprise
you
to
hear
that
a
bank
was
an
early
adopter
of
kubernetes.
We
fully
embraced
the
technology
in
2016
less
than
two
years
after
its
initial
release.
Kubernetes
is
certainly
newer
and
more
cutting
edge
than
say
the
legacy
mainframes
you
might
expect
the
bank
to
use,
but
that
doesn't
make
it
inherently
insecure
for
many
companies,
fear
of
introducing
new
risks
can
make
them
feel
lost
when
it
comes
to
exploring
and
adopting
new
technologies.
A
Compliance
and
safety
is
what
people
really
care
about
across
most
industries,
not
just
regulated
ones.
In
many
cases,
understanding
all
of
the
factors
you
need
to
evaluate,
as
you
build
a
container
management
platform,
is
a
challenge
in
and
of
itself.
We
found
it
was
helpful
to
consider
our
overall
cloud
strategy,
our
culture
and
talent
strategy,
the
state
of
our
cloud
resources
were
they
over
provisioned,
etc,
and
our
application
development,
speed
and
scaling
requirements.
A
Other
important
components
of
a
successful
container
management
strategy
include
the
supply
chain,
how
your
containers
are
built
where
they
are
stored,
how
they're
validated
the
infrastructure
and
orchestration
where
and
how
your
containers
are
run,
how
they're
run
together?
How
they
can
access
each
other,
the
runtime
security
and
policy
enforcement?
How
you
ensure
your
containers
do
what
you
want,
and
nothing
else
and
observability
runtime
metrics,
debugging
audit
logging
tracing
everything.
You
need
to
run
your
containers
in
a
well-managed
way.
There
are
many
benefits
to
a
container
orchestration
platform.
A
Developers
can
focus
on
business
outcomes,
logging
and
metric
gathering
can
be
for
free
compliance
and
government
are
baked
in
by
default.
You
can
have
a
testable
workloads,
better
infrastructure
utilization
and
you
can
have
higher
resiliency
simply
put
a
container
orchestration
platform
should
meet
the
needs
of
your
developers
as
well
as
your
enterprise
developers
need
a
simplified
and
consistent
workflow
with
an
intuitive
interface
that
will
put
deployed
applications
at
their
fingertips
for
quick
and
efficient
management.
A
The
platform
should
be
flexible
to
develop
and
deploy
applications
to
while
giving
freedom
to
write
code
and
not
have
to
manage
that
infrastructure
enterprises
need
compliance
and
regulatory
control,
plus
the
ability
to
enforce
workflow
standardization
and
reduce
the
technical
complexity
placed
upon
developers.
When
we
start
thinking
about
how
we
begin
to
meet
these
goals
and
achieve
those
benefits,
it
leads
us
to
the
makeup
of
the
platform
and
the
components
of
it.
Two
of
these
components-
we've
already
open
sourced
each
solved
some
challenges
we
encountered
around
provisioning
and
resiliency
of
kubernetes
clusters.
A
Crit
is
a
command
line
bootstrapper
for
kubernetes,
which
decouples
management
of
xcd
enables
multiple
nodes
to
be
provisioned
simultaneously
correctly,
regardless
of
the
order
in
which
they
come
up
and
is
designed
to
work
with
the
cluster
api.
We
open
sourced
crypt
in
september
of
this
year.
E2D
is
a
tool
for
deploying
fully
automated
at
cd
clusters.
A
Etcd
the
powerful
back-end
storage
that
makes
software
like
kubernetes
possible
has
historically
required
a
human
operator
to
perform
complex
administrative
tasks
like
initial
cluster
bootstrapping
cluster
membership
data
backups
and
disaster
recovery.
E2D
solves
for
many
of
those
challenges
that
we
came
across.
Crit
and
e2d
are
both
part
of
critical
stack.
Our
enterprise
container
orchestration
platform
that
runs
on
top
of
kubernetes
critical
stack
enforces
common
governance
and
security
controls,
enabling
teams
to
efficiently
scale
containerized
applications
in
the
strictest
of
environments
for
developers.
Critical
stack
is
full
of
valuable
functionality.
A
Stack
apps
is
a
path
to
enable
packaging
of
applications
in
a
way
which
takes
into
account
all
of
the
kubernetes
objects
which
are
needed.
This
creates
an
immutable
verifiable
package
which
can
be
promoted
from
one
environment
to
another.
Having
a
running
platform
that
is
a
default
location
for
workloads
means
we
shift
left
the
whole
you
build
it
you
own,
a
portion
of
things,
swall
provides
ebpf,
metrics,
gathering
and
tracing
for
all
kubernetes
workloads,
enabling
engineers
to
truly
understand
the
impact
of
their
workloads
on
the
underlying
infrastructure.
A
There's
also
a
developer
ui,
which
provides
fingertip
access
to
your
namespaces
containers,
logs
traces
and
an
editor
with
templates
to
help
ease
the
learning
curve
of
kubernetes
for
the
enterprise
and
platform
operators.
There's
a
bunch
as
well
there's
a
user
interface
which
provides
enhanced
rbac
management.
Sso
integration,
along
with
audit
logging
by
default,
psyllium
cni,
is
installed
as
part
of
the
critical
stack
platform
by
default,
along
with
the
ability
to
edit
policies
all
within
the
ui.