►
From YouTube: Fruit-Picking Robots Powered by K8s: From Sci-Fi to Reality! - Pedro Oliveira & Itzik Ben Zaken
Description
Fruit-Picking Robots Powered by K8s: From Sci-Fi to Reality! - Pedro Oliveira, Spectro Cloud & Itzik Ben Zaken, Tevel Aerobotics
Imagine: autonomous drones hover, zipping through a huge orchard, using AI and computer vision to pick fruit as deftly as any human. It sounds like science fiction, but it’s a reality thanks to Israeli startup Tevel Aerobotics. Its harvesting robots are solving the shortage of agricultural labor. And they’re powered by a lightweight Kubernetes stack running directly on the drone. In this talk, Pedro Oliveira and Itzik Ben Zaken dive into this fascinating use case, solving challenges that will be familiar to anyone working on edge deployments. They’ll tackle: The economics of managing devices at remote sites, at industrial scale, which multiplies the cost of on-site operational activity, from device registration to monthly patching. Security approaches for protecting data on unattended autonomous hardware that may be stolen — making persistent encryption essential. Ensuring highly available autonomous operations even when the edge devices have no connectivity: maintaining policy, security and self-healing, without phoning home. They’ll explore Tevel’s Kubernetes stack, from K3S, to flannel, Portworx, Flux and Traefik, and show how the entire operational stack of thousands of drones are remotely and centrally managed through Spectro Cloud Palette, based on Cluster API.
A
Thanks
everyone
for
joining
today,
my
name
is
Pedro
Oliveira
I'm,
a
Solutions
architect
at
spectrocloud
and
I'm
joined
here
by
my
good
friend,
itik
from
tevel
and
we'll
be
talking
to
you
guys
about
an
awesome.
If
you
ask
me
use
case
about
kubernetes
at
the
edge
for
smart
agriculture,
so
it's
a
take.
Take
it
away.
B
B
Cool
right,
but
seriously
why
to
use
robot
first
of
all,
to
make
very
long
story
short.
There
are
no
Pickers.
There
are
no
enough
human
Pickers
in
the
world
and
it's
seasonally
work.
You
have
something
like
three
or
four
months
at
the
most
in
a
year
to
pick
your
your
fruits
and
it's
difficult
to
hire
these
speakers.
So
20
of
the
fruits
are
stained
to
rot
and
we
are
in.
B
C
B
Oh
no
you're,
not
managing
the
cluster
at
the
the
cloud
on
the
field
no
network,
so
anyway,
I
want
to
show
you
how
we
started.
You
know
as
a
startup.
You
need
to
run
and
run
fast,
so
each
each
developer
at
the
beginning
had
his
own
robot
and
he
needed
to
SSH
to
his
robot
manually
script
to
remote,
the
robot
different
setup,
the
engineer
host
and
the
deployment
host.
B
What
work
is
in
my
machine
syndrome
started.
You
know
how
it
is.
The
the
installation
manual
installation
was
painful,
high
onboarding
on
one
you
want
to
operate,
and
when
you
want
a
new
development
was
impossible
to
operate
multiple
drones.
It
was
too
many
screens
what
we
did.
We
use
containers
look
at
that
we
use
Docker
to
easy
setup,
an
easier
application.
B
We
use
a
Docker
to
freeze
our
setup
and
we
we
build
a
small
web
UI
to
control
everything,
but
we
still
had
some
problems
when
you
handling
containers
by
your
manually,
it's
difficult.
Our
our
images
was
huge
I'm
talking
about
four
years
ago.
The
images
would
use
the
heavy
and
the
the
build
was
TR
was
difficult.
B
B
B
Multi-Robot
now
is
a
breeze
problem
is
solved.
Kubernetes
help
us
a
lot,
but
when
it's
come
to
scale
it's
difficult,
it
still
has
challenges.
When
you
try
to
scale
Edge,
you
need
to
gather
all
statuses
by
your
hand,
you
need
to
be
sure
that
your
you
need
to
make
sure
that
your
cluster
up
and
running
all
the
time-
and
you
remember
far
away
from
the
antennas
and
it's
difficult.
B
A
A
So
the
four
fillers
that
we
identified
I
essentially
easy
provisioning
of
operations,
functionality
when
it's
disconnected
full
stock
security,
very
important
and
zero
risk
upgrades
as
well,
and
those
are
the
ones
that
we're
going
to
be
talking
to
you
guys
about
and
take
you
through
that
Journey,
but
before
we
do
that,
let's
take
a
step,
a
step
back,
because
you
might
be
wondering
what
does
the
devil
architecture
look
like
or
what
are
they
deploying
down
into
the
field?
And
although
it
does
look
over
overly
simplified,
it's
very
complex.
A
It's
like
you'll,
probably
say
that
very
well,
but
essentially
there's
a
ground
control
station.
That
is
a
kubernetes
cluster
which
is
operated
by
an
operator
and
that's
wirelessly
connected
to
these
bins,
and
these
bins
can
manage
for
up
to
eight
multi-purpose
robots
for
the
fruit,
picking
or
pruning.
A
A
But
now,
let's
look
at
managing
kubernetes
clusters
at
scale
at
the
edge.
So
for
that
we
have
spectral
Cloud
palette,
which
is
a
kubernetes
orchestration
tool
designed
for
managing
kubernetes
at
scale
which
allows
you
to
do
that
on
any
data
center,
public
clouds
and
obviously
at
the
edge.
And
what
palette
does
is.
It
has
essentially
for
Edge
very
important,
a
very
distributed
architecture
in
the
sense
that
every
cluster
runs
its
own
palette
agent
as
well.
A
And
that
includes
also
all
the
Integrations
in
between
and
with
that
we
call
a
cluster
profile.
So
with
pilot
you
basically
specify
a
cluster
profile.
You
then
push
that
cluster
profile
to
a
cluster
and
the
cluster
then
manages
itself
right,
so
it
reconciles
and
is
able
to
manage
itself
with
all
the
configuration
and
policies
as
well.
So
I
wanted
to
just
give
you
guys
an
understanding
of
that
before
we
move
on
so
easy
provisioning.
A
A
Center
is
very
important.
So
we
made
that
very
easy.
So
we
use
Kairos,
which
is
an
open
source
project
that
basically
it's
a
Linux
method,
distribution
that
gives
you
an
immutable
OS
and
with
that
we
then
pre-load
content
right
with
table
in
this
case
we're
using
Ubuntu
and
k3f,
and
once
you
boot
up
your
and
you
install
your
your
device,
you
all
you
got
to
do,
is
you
ship
it
out
and
then
the
operator
all
he
has
to
do
is
power
it
on
right
power
it
on
it
connects
and
then
from
then
on.
A
This
is
a
real
example
that
we
have
with
table
right
now
and
they
will
be
able
to
add
information
to
to
the
cluster
or
to
the
device.
Even
and
you
can
see
here-
things
like
device,
name,
Farm,
ID
and
also
the
region
where
it
gets
deployed,
for
example
in
Pilot.
In
this
case,
we
are
actually
using
that
to
select
where
that
device
goes
into
a
project
right
and
that's
how
we
do
so
multi-tenancy
in
this
case.
A
But
what
happens
when
an
operator
is
not
able
to
actually
scan
a
QR
code
or
they
don't
have
a
screen
or
God
forbid?
The
hardware
fails
and
you
have
to
quickly
swap
it
out-
you
don't
want
to
have
to
go
through
all
of
that
together
right.
So
essentially
we
we
also
allow
zero,
zero
Touch
provisioning
without
the
registration,
and
that
is
done
by
essentially
when
you
bootstrap
the
device.
A
You
can
add
some
Cloud
init
file
with
what
we
call
the
user
data
and
with
that
user
data
you
can
specify
some
tags
like
you
saw
before
and
also
an
edge
token,
which
then
authenticates
against
pilot
and
registers
the
device
automatically.
So
now
you
don't
even
have
to
scan
a
QR
code.
All
you
got
to
do.
Is
your
device
failed
or
you're
rolling
out
a
new
device?
A
You
have
to
power
it
on
and
then
that
device
is
going
to
be
automatically
registered
with
palette,
then
the
second
one
which
is
disconnected
environments
and
maintaining
and
making
sure
that
the
functionality
is
still
there.
So,
as
I
said
before,
pilot
has
this
distributed
architecture.
So,
as
you
can
see,
you
might
have
n
Edge
nodes,
but
the
control
plane
and
the
management
plane
are
basically
separated.
So
what
happens
is
once
the
the
the
cluster
is
running
and
everything
is
is
going,
then
the
the
cluster
is
managing
itself.
A
So,
even
if
there's
no
connectivity
back
to
the
management
platform,
the
node
and
and
the
device
and
the
cluster
will
still
maintain
its
status,
these
applications,
its
configurations
and
all
of
its
policies
as
well-
and
this
will
travel
happens.
A
lot
like
86
said
one
or
two
Meg,
sometimes
no
Megs
to
update
anything
so
zero
risk
remote
upgrades.
A
So
when
you
push
an
upgrade
to
an
edge
device
which
is
in
Chile
right
now,
if
that
fails,
you
probably
don't
want
to
ship
out
one
of
your
engineers
from
Israel
to
get
there,
because
that's
probably
going
to
take
24
hours-
and
you
know,
24
hours-
means
that
they're
not
picking
more
waste,
more
loss
as
well.
So
with
that
we're
using
so
as
part
of
Kairos
the
open
source
project
that
I
I
told
you
guys
about
earlier
cairos.
Basically,
it's
a
container
based
image
right
and
what
it
uses
as
well.
A
A
A
You
can't
install
new
new
packages
or
anything
like
that.
All
of
that
is
built
within
the
container
image.
You
can
bring
your
own
OS
because
it's
a
Linux
meta
distribution.
So
basically
you
can
bring
any
Linux
based
OS
and
it's
tamper-proof
because
of
the
immutability
in
itself,
and
then
we
have
to
look
at
DPM
offline
encryption
and
you
guys
probably
were
at
the
awesome
keynote
with
Saad
and
Arun
earlier,
and
we
announced
our
our
collaboration
with
Intel
with
Cena
secure,
Edge
native
architecture,
and
this
is
part
of
that.
A
So
this
is
one
of
the
components.
So
how
do
you
do
offline
encryption
so
it
developed
before
they
were
using
UB
keys?
But
if
you
have
50
60
bins
right
out
in
the
field,
then
you
you
need
50,
60,
Ubi,
Keys,
plus
each
operator
will
have
to
have
his
own
key,
so
it's
impossible
to
manage
that
scale.
So
it's
an
awesome
product,
but
just
not
for
The
Right
Use
case.
A
So
we
decided
to
go
ahead
with
encryption
with
TPM,
so
trusted
platform
module
which
is
based
on
in
Hardware,
so
the
TPM
will
create
a
hash
key.
That
hash
key
is
then
saved
into
a
k-crypt
Challenger
which
actually
lives
in
the
GCS.
If
you
guys
remember
the
GCS,
because
the
the
Intel
TPM
is
in
the
bins,
the
k-crypt
Challenger
is
in
the
GCS
so
effectively.
What
happens
is
every
time
the
device
boots.
It
will
challenge
the
TPM
and
it
will
only
boot
if
that
challenge
is
successful.
B
At
the
end,
devil
wants
to
focus
on
software.
We
want
to
pick
apple
right.
We
want
to
pick
them
good
without
bruising
them,
so
we
need
to
be
focused
on
software
and
not
on
operation
system.
So
this
is
why
it's
so
important
for
us
Hardware,
it's
hard.
You
know
what
it
is
so
that
this
is
why
we
choose
Spectra.
It's
it's
the
right,
technical,
the
awesome
people
they
it's
reduced.
The
time
that
we
spent
of
building
and
managing
clusters
by
ourselves
and
handling
operation
was
it's
give
us.
B
A
Yeah
and
and
like
I,
said
security
again
ever
evolving,
and
we
started
with
some
of
the
concepts
around
the
center
framework
that
you
guys
heard
before
from
Assad
and
Arun,
and
so
we
already
doing
part
of
that
with
persistent
data
encryption
with
TPM.
But
now
it
really
is
about
for
Edge
is
really
is
about
securing
securing
the
device
from
the
Silicon
all
the
way
to
the
top
right.
A
But
how
do
we
apply
that
so
a
devil
is
already
using
x86
machines,
so
all
of
the
computational
Power
is
coming
from
the
intellect
x86
machines.
So
for
us,
it's
really
all
about
now,
starting
to
implement
in
the
next
few
weeks
or
so
we're
looking
at
how
we're
gonna
start
playing
with
Intel
scx
so
think
about
confidential
Computing.
So
all
of
the
all
of
the
different
workloads,
all
the
different
applications
are
enclaved
into
memory
and
also
Intel
txt,
and
how
your
application
will
only
run
if
the
device
is
actually
trusted
right.
A
So
if
the
device
gets
compromised,
you
want
to
make
sure,
because
it's
all
out
in
the
field
right,
so
someone
could,
if
they
want
it
potentially,
if
it's
unsupervised,
go
in
hard,
hard
connect
to
it
and
try
to
try
to
do
something
bad
to
it.
So
how
do
you
do
that?
Making
sure
that
it's
all
safe
and
the
last
one
as
well,
very
important
around
encrypted
images
right?
A
A
What
they're
doing
is
they
have
operators
that
go
out
and
then
they
manually
update
the
registry,
but
what's
stopping
the
that
manual
operator
from
actually
corrupting
or
stealing
those
images
which
have
their
IP
right,
so
you
kind
of
have
to
encrypt
it
not
only
at
rest
but
also
in
transit.
So
looking
at
end-to-end
image,
encryption
with
DPM,
which
already
exists
as
well
on
the
machines.
A
B
A
A
This
is
the
Drone
and,
by
the
way,
we're
gonna
be
at
from
tomorrow
on
we're
gonna
be
at
s22.
So
if
you
guys
want
to,
you
know,
ask
us
questions
check
out
the
architecture
we
can
go.
It
wasn't
too
deep
into
it.
So
if
you
guys
want
to
get
deeper,
please
come
by
if
you
want
to
see
the
drones.
This
is
one
of
the
mock-ups.
A
You
can
play
with
it
as
well
yeah,
and
we
do
have
an
announcement
for
someone
very
lucky,
so
we
were
running
in
our
booth,
a
competition
so
I
have.
So,
if
you
guys
have
scanned
the
QR
code,
then
you
might
be
in
it
to
win
it.
So
I
need
to
remind
myself
who
won
it.
Junkie's.
Looking
at
me,
like
I've,
told
you
before
we're.
C
C
E
A
A
Kairos
will
do
all
of
that
work
for
you
in
the
background
and
it
will
automatically
encrypt
the
the
partition
that
you
tell
it
to
encrypt.
So
you
specify
I
want
to
encrypt
whatever
partition
right.
In
our
case,
it's
called
the
persistent
partition
and
then
Kairos
is
doing
all
the
work
in
the
in
the
back
end
as
well.
So
from
our
side
was
pretty
easy
to
implement
yeah,
so
you
you
should
definitely
check
it
out.
If,
if
that's
something.
D
They
want
to
look
at
great
presentation.
We've
got
one
last
talk.
We
had
a
two
people
on
the
program
committee
for
this
event,
Oleg
and
Tina,
who
couldn't
make
it
because
they
had
Visa
issues
with
travel,
but
Tina
is
has
recorded
a
five-minute
wrap
up
for
the
conference.
So
if
you
can
start
playing
that
now
we're
ready
to
go.