Flatcar Container Linux / Tech talks

Using a custom seccomp profile is one of the most recommended ways to increase the security of our Kubernetes workload. However, to be able to do that, we need to know all the system calls that our application uses during its whole life cycle, which is not a simple task.

By default, Kubernetes asks the container runtime to create a container using the `Unconfined` seccomp profile, meaning that seccomp is disabled. Such default behavior ensures that our application will run without problems, but it leaves the containers exposed to remote code execution vulnerabilities.

In this talk, we are going to show how to use Inspektor Gadget to identify all the system calls used by an application and how to generate a custom seccomp profile that ensures it will continue working as intended and with the exact privileges it requires.

Are you always curious? Then let’s take the lid off a cluster running the Calico eBPF data plane and see what’s going on in there.

You will learn:

* The theory of a packet walk through a cluster running the Calico eBPF data plane
* How to see the real thing on a cluster running Calico eBPF
* How to use available tools for diagnostics or to gain visibility of Calico’s eBPF data plane

Flatcar Container Linux is an open-source Linux distribution; with the recent announcements, the community around it is set to grow faster than ever. In this talk, we will see how to get involved in this community at various levels.

Technical contributions to the OS are more than welcome, let's break apart the package addition process with a simple example to get a first idea of what is Flatcar Container Linux development!

With a DevOps culture becoming a standard, we face automation everywhere. It simplifies and shortens our daily duties, which de facto leads to cost optimization. Additionally, our infrastructure gets more and more complicated as we evolve towards cloud-native and microservice architectures. That is why Infrastructure as code (IaC) came up. It’s an answer to the growing complexity of our systems. In the webinar, Maciek focuses on what Infrastructure as Code actually means, its main concepts, and gently fills you in on AWS Cloud Formation. We’ll also get some hands-on experience building and spinning up Enterprise Level Infrastructure as Code.

Even with a high level of test automation and coverage, deploying applications to production carry a particular risk. Differences in infrastructure, configuration, application software, and data stores can mean that an application that performed flawlessly through the development and test cycles can fail when introduced to the production environment.

To counter the risk involved with deploying to production, we developed a technique called canary testing. Rather than immediately replacing existing software with a new version, you gradually introduce it while monitoring its behavior.

In this talk, you will learn how to implement a fully automated progressive delivery pipeline for canary testing using Consul Service Mesh, Flagger, Circle CI, and Kubernetes. We will look at the end-to-end process from code commit to production release, and by the end of the talk, you will understand the core configuration of all the tools involved so that you can replicate the workflow in your environment.

With our digital systems growing increasingly distributed and our tech stacks increasingly heterogeneous, we need to devise new models around policy and access control. In this presentation, we’ll introduce Open Policy Agent (OPA) - what problems it solves and how it unifies policy across the whole cloud native stack. After a brief introduction, we'll take a closer look at Rego, the policy language used by OPA, before exploring how OPA may be used for building guard rails around our Kubernetes clusters.

In this talk, Lili will walk through what prometheus-operator does, the resources it configures and manages. To make the story complete, we will have a look at the kube-prometheus project, which is a set of manifests that allows you to easily set up full Kubernetes monitoring into your clusters and get a complete insight into the cluster workloads. We will conclude with a guide through some examples of how to monitor your applications using prometheus-operator custom resources.

Deep dive into Calico's new eBPF dataplane, which is now GA. You'll learn about its advanced features, including its high-performance Kube-proxy replacement that preserves source IP all the way to the pod. The talk will also touch on Calico's other dataplanes; Calico now supports Windows nodes (including in open source!) and there's a fast-maturing VPP port in the works.

All things profiling and Polar Signals.

Presentation on how to setup a development environment that will boost your productivity on Windows 10 + with the demo of how to use it by building Python Cloud Native App (Python + Tornado + RabbitMQ & Pika + ReactJS). This talk will cover -

- PowerShell (w/ Terminal) - use it instead of git-bash!
- Docker for Windows and built-in k8s cluster
* Building and running containers
* Communication between containers
* Exposing and testing your app
- VSCode and plugins
* Remote extensions (WSL + SSH + Containers)
- PyCharm
- Debugging code inside the container using VSCode
- Creating k8s deployment
- BONUS: How to take your dev env with you!
* Vim
* Maybe VSCode + MobaXTerm
- (Optional) Windows Subsystem for Linux (WSL1 and WSL2)

In this presentation, I will walk you through the process of creating an enterprise-level AWS infrastructure. Throughout it, we will create an infrastructure comprising a VPC with four subnets in two different availability zones with a client application, backend server, and a database deployed inside. Our architecture will be able to provide the scalability and availability required by modern cloud systems. Along the way, I will explain the basic concepts and components of the Amazon Web Services platform.

In an Infrastructure as code / GitOps world, testing that your Kubernetes configuration is correct, secure, and compliant to your company's requirements & best practices is more important than ever. An increasingly large list of tools is there to help you - linters, validators, testing frameworks, admission controllers... each working in subtly different ways.

To help you navigate these waters, I will present some of the most common tools for Kubernetes manifests validation & compliance testing, detail their use, limitations and provide some usage examples.

I will also introduce Kubeconform, a new Kubernetes validation tool I authored.

At Gitpod, we have built an open source automated development environment based on Kubernetes. As a multi-tenant platform that enables developers to spin up workspaces (implemented as Kubernetes pods) to develop, compile and run code, we have some extreme security requirements.

One of the most-requested features has been Docker support within a Gitpod workspace, i.e. running a Docker daemon within a Kubernetes pod. In order to isolate the user’s workspace, it needed to run “rootless”, but Linux containers' intricacies make this extremely challenging.
In this talk, we will explain how, together with our friends at Kinvolk, we approached this challenge and managed to implement this feature, leveraging these latest upstream enhancements.

We will cover an overview of current user namespace efforts in Kubernetes, how we employed user namespaces to provide good isolation of workspaces, about the challenges we had to overcome to make rootless Docker work, giving an overview of upcoming technologies that enable the next generation of rootless containers.

This talk will cover setting up a multi-tenant Observability pipeline for metrics and traces using entirely opensource projects such as OpenTelemetry, Prometheus, Jaeger, Kafka, and Cassandra.

Kubernetes and FaaS have solved most of the challenges of dealing with stateless applications. But when it comes to handling state, it quickly becomes “someone else's problem”. Because of that, we have struggled with the same issues of data consistency and complex failure semantics for the past decade. For stateful applications, we are still far from the smooth development and operations experience associated with serverless.

Stateful Function is a new pattern to solve this problem. It uses containerized, event-driven functions with a stream processor (Apache Flink), not a database, to manage the state and handle the messaging between functions. This talk walks through the ideas behind Stateful Functions and shows how this simple framework solves the problem of consistency and failure semantics within and across functions, at the same time staying true to the serverless experience.

This talk will show how we created a framework to benchmark service meshes, how to create large use and throw clusters, pipelining of metrics in persistent storage, how to choose the right metrics to get a holistic view of the performance of the mesh, (ab)use of the Grafana charts to get around the limitations of time series database, tweaks to the wrk2 tool to get the job done, etc.

Let’s be honest, sometimes we wish we could go back to the good old monolith. A single application that can be easily operated, secured, and monitored and that does not have to deal with all the challenges a network introduces. But instead, many companies have decided to go with Microservices, for many good reasons such as faster delivery and more independence for developer teams.

Yet, the cross-cutting concerns developers implement around the business logic seem to have gotten a bit out of hand. Think about monitoring, circuit breaking, canary releasing, TLS termination. This is exactly what a Service Mesh promises to change. It lifts monitoring, resilience, routing, and security into the infrastructure. Sounds too good to be true? Indeed, a Service Mesh does not come without a price: cognitive complexity, increased resource consumption, and latency.
We need to talk: about meaningful use cases for Service Meshes as well as the drawbacks and implementations such as Istio and Linkerd.

Prometheus is considered a foundational building block when running applications on Kubernetes and has become the de-facto open-source standard for visibility and monitoring in Kubernetes environments.
Your first starting points when operating Prometheus are most probably configuring scraping to pull your metrics from your services, building dashboards on top of your data with Grafana, or defining alerts for important metrics breaching thresholds in your production environment. in your production environment.

As soon as you are comfortable with Prometheus as your weapon of choice, your next challenges will be scaling and managing Prometheus for your whole fleet of applications and environments. As the journey “From Zero to Prometheus Hero” is not trivial you will find obstacles on the way. In this presentation, we are highlighting the most common challenges we have seen and provide guidance on how to overcome them. Finally, we are discussing a solution to get you there more quickly to build automated, future-proof observability with Prometheus showing Keptn as one possible implementation.

Prometheus co-founder Julius Volz presents some usability challenges with Prometheus's query language PromQL, as well as approaches to make usage easier. PromQL is great for doing calculations on time series data. However, the language also has plenty of sharp edges and can be challenging to learn and work with for both beginners and more advanced users. The talk starts with a language overview, goes into examples of usability issues, and then presents recent efforts like PromLens (https://promlens.com/ by Julius' company PromLabs) and the new PromQL text editor that will be part of both PromLens and Prometheus soon.

When trying to iterate quickly on our code, reliability tends to be overlooked and given lower priority than getting the latest features out. Until a large incident comes and knocks our applications out of service.

This talk will give a quick introduction to the Site Reliability principles, and look into how they can be applied to cloud applications, regardless of the size of the organization.

Kubernetes monitors and maintains state for many aspects of your cluster, but what about those out-of-the-box ideas no one’s thought of yet that are essential to the success of your program? Enter Kubernetes Operators: state-management machines for self-defined resources. See Kubernetes Operators in action as Ellen Körbes live-codes one in Go—showing you their practical application and everything you need to write your own.

A large application landscape, handling 96.000 requests per minute, has been successfully migrated to the cloud. That migration was not only about focussing on the application. While we applied an lift'n'shift approach to the application, managing the target infrastructure became crucial.

We needed to make sure that a team of 40 people was able to reproduce environments consistently across many geographies. Introducing Infrastructure as code was one of the best decisions we made.

This talk is about our journey from a client's datacenter to a fully customized cloud platform on Azure. You will see how we used Terraform and Azure DevOps to create a platform for a connected vehicle backend.

Containers, applications, functions: When deploying workloads to cloud platforms, developers have various OSS options. This talk focusses on Kubernetes and compares how Cloud Foundry and Knative relate to it and also how they can extend and improve it.

I’ll compare and contrast the latest experiences of those platforms in order to extract a meaningful comparison from a developer perspective, providing answers to the following questions:

How simple and user-friendly are they? Where are the differences/where are the overlaps? How mature are the individual solutions? Which type of workloads are suitable for which platform?

Additionally, I’ll measure and compare key metrics that affect the developer experience (e.g., time to deploy, time to scale, and more). The overall goal is to better understand what makes each individual useful in the best way and how they can work together. Each technology will be shown with live demos.

Cari spent the last few years building projects using Jenkins, Azure DevOps, AppCenter and Gitlab. After learning about Tekton and building a few example pipelines with Tekton, she started rethinking pipelines and the existing patterns we use to manage automation. Reviewing well known pipeline structures like CI, CD and Gitops, she discussed ideas for creating adaptable pipelines that behave in a modular, reusable way allowing projects to prepare for the rapid transformation of the cloud environments we build.

Andy provided an update on Kinvolk’s two flagship open source projects, Flatcar Linux (its “friendly fork” of CoreOS Container Linux) and Lokomotive, a 100% open source Kubernetes distro, with a heritage derived from CoreOS Tectonic. He covered what’s new in recent releases, where the projects are headed, and how they fit into a broader vision of enabling a truly enterprise-grade open source cloud native platform. We wrapped up with a demo by Iago López Galeiras and Joaquim Rocha, including a sneak preview of some new (work in progress) Lokomotive features.

Frederic Branczyk, software engineer at Red Hat, stopped by the Cloud Native Computing Berlin Meetup on October 25th to discuss kube-rbac-proxy.

Kubernetes RBAC is great for authorizing requests to the Kubernetes API, and is a vital component for a secure Kubernetes cluster. Wouldn't it be great to use RBAC to authorize requests to your applications as well? In this talk, Frederic showcases kube-rbac-proxy, the tool he developed just for this use case. While operating his own Kubernetes cluster, the need came about to protect applications that don't have native authentication and authorization means to utilize the methods available by Kubernetes.

Speaker: Frederic Branczyk
Frederic is an engineer at Red Hat (previously CoreOS) contributing to Prometheus and Kubernetes to build state of the art modern infrastructure and monitoring tools. He discovered his interest in monitoring tools and distributed systems in his previous jobs, where he used machine learning to detect anomalies indicating intrusion attempts. He also worked on projects involving secrets management for distributed applications to build sane and stable infrastructure.
Twitter: https://twitter.com/fredbrancz
Website: https://brancz.com/

Meetup: Cloud Native Computing Berlin Meetup
Event: https://www.meetup.com/Cloud-Native-Computing-Berlin/events/254884066/

Host: Kinvolk
Web: https://kinvolk.io
Twitter: https://twitter.com/kinvolkio

This talk by Sergiusz Urbaniak, senior software engineer at Gesundheitscloud, and Alex Somesan, software engineer at CoreOS/Red Hat, was first presented at the Pre-FOSDEM Kubernetes event in Brussels at the beginning of February 2018. It was so informative and full of useful information that one can apply when setting up and running Kubernetes clusters, Kinvolk requested that Sergiusz and Alex do the talk again. The first hour of this extended talk is led by Sergiusz while the second hour is given by Alex.

This talk tries to demystify the concepts behind a Kubernetes deployment. It outlines the necessary building blocks for networking, storage and compute for a cloud-based Kubernetes installation and provides a concrete example using Terraform.

Speaker: Sergiusz Urbaniak
Sergiusz is a Senior Software Engineer at Gesundheitscloud and formerly of the CoreOS Techtonic installer team, and before that Mesosphere.
Twitter: https://twitter.com/_surbaniak
Company: Gesundheitscloud ,https://hpi.de/open-campus/hpi-initiativen/gesundheitscloud

Speaker: Alex Somesan
Alex is an engineer at CoreOS/Red Hat and is on the CoreOS Tectonic installer team. He previously honed his Terraform craft at AWS.
Twitter: https://twitter.com/ASomesan
Company: CoreOS, https://coreos.com/

Meetup: Cloud Native Computing Berlin Meetup
Event: https://www.meetup.com/Cloud-Native-Computing-Berlin/events/247961017/

Host: Kinvolk
Web: https://kinvolk.io
Twitter: https://twitter.com/kinvolkio

This talk was recorded at a Pre-FOSDEM Brussels Kubernetes Meetup on February 2nd, 2018.

Kubernetes has two simple but powerful network concepts: every Pod is connected to the same network, and Services let you talk to a Pod by name. Bryan will take you through how these concepts are implemented - Pod Networks via the Container Network Interface (CNI), Service Discovery via kube-dns and Service virtual IPs, then on to how Services are exposed to the rest of the world.

Speaker: Bryan Boreham
Bryan has spent decades building and operating large-scale distributed systems, focused on performance and dependability. His current role is Director of Engineering at WeaveWorks, an Open Source technology company.
Twitter: https://twitter.com/bboreham
Company: WeaveWorks, https://www.weave.works/

Meetup: Brussels Kubernetes Meetup
Event: https://www.meetup.com/Brussels-Kubernetes-Meetup/events/245974093/

Video by: Kinvolk
Web: https://kinvolk.io
Twitter: https://twitter.com/kinvolkio

Luca Bruno, an Engineer from CoreOS, kicked off CoreOS’s 4th birthday celebration at the CoreOS Berlin Meetup on July 18. Luca went into detail on CoreOS Container Linux and the tooling around it.

Speaker: Luca Bruno
Luca Bruno is a software and security engineer at CoreOS where he works on rkt and other OS tools. He is a longtime FLOSS supporter and an active Debian developer. Born on the Italian Riviera, he is now a proud and happy Berliner.
Company: CoreOS, https://coreos.com/

Meetup: CoreOS Berlin Meetup
Event: https://www.meetup.com/CoreOS-Berlin/events/241599069/

Host: Kinvolk
Web: https://kinvolk.io
Twitter: https://twitter.com/kinvolkio

Lennart Poettering, creator of PulseAudio, Avahi, systemd, and currently a Senior Software Engineer at Red Hat, stopped by the Linux Technologies Meetup on July 13th to give a debut talk about his new project, casync. casync is an instrument used for efficient image synchronization for IoT, containers, VMs and backups.

This new tool combines the rsync algorithm with the idea of git's content addressable filesystem, in order to implement fast and efficient disk image and file system tree synchronization, taking benefit of the similarity of data. With a focus on simplicity, reproducibility, security, efficiency and metadata minimalism it's supposed to become a useful tool for everybody who needs to synchronize disk images or file system trees over IP networks in high frequencies, for example to implement IoT, container, VM or backup systems. The tool is designed to be friendly to HTTP for data delivery, in particular when used with CDNs.

Speaker: Lennart Poettering
Lennart is currently Senior Software Engineer at Red Hat. He is a German free-software engineer known for his work on PulseAudio, a sound server, Avahi, an implementation of the zeroconf protocol for network device discovery, and systemd, an alternative to the System V init daemon.
Company: Red Hat, Inc., https://www.redhat.com/

Meetup: Linux Technologies Meetup
Event: https://www.meetup.com/linux-technologies-berlin/events/240909087/

Host: Kinvolk
Web: https://kinvolk.io
Twitter: https://twitter.com/kinvolkio

Dr. Stefan Schimanski, a Senior Software Engineer at Red Hat, stopped by the Cloud Native Computing Berlin Meetup on April 25 to talk about different ways to use Kubernetes as a platform to build higher level systems.

This talk covered ThirdPartyResources of Kube 1.5 including their limitations today and in the future, user provided apiservers in Kube 1.6+, k8s.io/apiserver and the kube-aggregator and, finally, the core API concepts that make both approaches work: discovery, api groups, resources, kinds.

Speaker: Dr. Stefan Schimanski
Stefan Schimanski is a Senior Software Engineer at Red Hat on the OpenShift/Kubernetes team working mainly on api-machinery related topics recently. He was heavily involved in the refactoring of the Kubernetes codebase into the sub-repos k8s.io/apimachinery, k8s.io/apiserver and k8s.io/client-go. Stefan holds a PhD in Mathematical Logic and loves to discuss why type casts in Golang are so bad.
Company: Red Hat, https://www.redhat.com/en

Meetup: Cloud Native Computing Berlin Meetup
Link: https://www.meetup.com/Cloud-Native-Computing-Berlin/
Event Link: https://www.meetup.com/Cloud-Native-Computing-Berlin/events/238925663/

Host: Kinvolk
Link: https://kinvolk.io
Twitter: https://twitter.com/kinvolkio

Aaron Levy, Software Engineer from #CoreOS, joined the CoreOS Berlin Meetup on March 31. The talk came on the heels of CloudNativeCon+KubeCon EU 2017 in Berlin. He focused on the process of writing a custom #Kubernetes controller.

This talk covered how to implement your own custom controller, from contacting the Kubernetes API to using existing libraries to easily watch, react, and update components in your cluster. By building on existing functionality and following a few best practices, you can quickly and easily implement your own custom controller.

Speaker: Aaron Levy
Aaron Levy is working on all things Kubernetes. He is also the lead maintainer of bootkube, a kubernetes-incubator project that enables launching self-hosted kubernetes clusters.
Company: CoreOS https://coreos.com

Meetup: CoreOS Berlin Meetup
Link: https://www.meetup.com/CoreOS-Berlin/

Host: Kinvolk
Link: https://kinvolk.io
Twitter: https://twitter.com/kinvolkio

Mike Stowe, the Director of Communications at Tigera, joined the CoreOS Berlin Meetup on March 31. The talk came on the heels of CloudNativeCon+KubeCon EU 2017 in Berlin. He discussed enterprises moving from legacy systems to modern API architectures and micro-services.

About Tigera:
Tigera (https://www.tigera.io/) is changing the way cloud networks are secured. They are creating an integrated cloud connectivity and workload security solution that can scale to the unprecedented level of virtual network and workload turnover that micro-services and containers are placing on large, cloud-native data centers. Their customers employ our flagship open source project, Calico, for their enterprise cloud solutions.

About Project Calico:
Project Calico (https://www.projectcalico.org/) is an open source layer three virtual networking system for containers, which can be deployed across a variety of today's platforms and setups, including hybrid environments.

About Mike Stowe:
Mike Stowe is a professional, Zend Certified Engineer with over 10 years experience building applications for law enforcement, the medical field, nonprofits, and numerous industrial companies. Over the last several years he has been focused on APIs and ways to improve industry standards and efficiency. He now works for Tigera, a company on the leading edge of network virtualisation, scaling, and security. You can view slides from his other talks at mikestowe.com/slides or follow him: @mikegstowe

Meetup link: https://www.meetup.com/CoreOS-Berlin/
Follow us on Twitter: https://twitter.com/kinvolkio
Get more information about Kinvolk: https://kinvolk.io

Joe Beda stopped by the Cloud Native Computing Berlin Meetup which took place the evening before CloudNativeCon+KubeCon EU 2017. His talk focused on clustering technologies, such as #Kubernetes, and how they drive team efficiency. He also compared and contrasted different operations and organisational maturity models.

About Joe Beda:
Joe is currently the CTO & co-founder at Heptio. He was a founding engineer of the Kubernetes project at Google. Before that, he founded Google Compute Engine and was the lead engineer for the project. Previously, Joe worked on the Google ads system where he built tools to help advertisers pick the right keywords and bids. He also connected Google services to the public telephone network (PSTN) and defined and launched Google Talk.

Meetup link: https://www.meetup.com/Cloud-Native-Computing-Berlin/

Follow us on Twitter: https://twitter.com/kinvolkio
Get more information about Kinvolk: https://kinvolk.io

Kelsey Hightower held an "Ask me anything" session about new features in Kubernetes 1.6 at the Cloud Native Computing Berlin Meetup which took place the evening before CloudNativeCon+KubeCon EU 2017.

About Kelsey:
Kelsey Hightower is a Developer Advocate at Google. Kelsey Hightower has worn every hat possible throughout his career in tech, and enjoys leadership roles focused on making things happen and shipping software. Kelsey is a strong open source advocate focused on building simple tools that make people smile. When he is not slinging Go code, you can catch him giving technical workshops covering everything from programming to system administration.

Meetup link: https://www.meetup.com/Cloud-Native-Computing-Berlin/

Follow us on Twitter: https://twitter.com/kinvolkio
Get more information about Kinvolk: https://kinvolk.io