►
From YouTube: KBE Insider (E7) - Liz Rice
Description
For our first episode of the new year, KBE Insider interviews Liz Rice about her role as Chief Open Source Officer at Isovalent (creators of the Cilium eBPF-based networking project) and Chair of the CNCF’s Technical Oversight Committee. We’ll learn how Liz got started with contributing to the Kubernetes community and tips on how you can get more involved. It’s the new year, so let’s see where Liz thinks Kubernetes is heading in 2022!
KBE Insider is hosted by Josh Berkus, Kubernetes Community Manager at Red Hat and Clinical Assistant Professor of Computing and Data Science at Boston University, Langdon White. KBE Insider lets you reach people deeply involved with the Kubernetes community, hear what they have to say, and engage with Kubernetes experts from across the globe.
A
A
A
Well,
hello,
everybody
thank
you
for
coming
to
kbe
insider
and
it
seems,
like
my
camera,
has
a
little
bit
of
a
shake
to
it
today,
but
I'm
langdon
white
and
I
am
formerly
from
red
hat-
and
I
am
currently
now
a
faculty
member
at
the
at
boston
university
in
the
computing
and
data
sciences
faculty,
where
I
teach
data
science
stuff
and
I
teach
computing
stuff,
practicum
and
various
other
things.
We
also
have
josh
burkis,
who
is
co-hosting
with
me
today
and
are
you
there
josh
howdy.
B
Yeah
we're
getting
audio
anyway,
I'm
josh
burkus.
I
work
for
red,
hat's,
open
source
practice
office
and
I
am
the
kubernetes
person
in
our
open
source
practice
office,
making
sure
that
red
hat
is
doing
a
good
job
in
contributing
to
kubernetes
and
many
related
projects,
and
as
such
I
I've
actually
talked
to
our
guest
today
liz
rice
many
times
in
the
cncf.
A
Awesome
thanks
josh
and
so
yeah
we'd
like
to
welcome
liz
rice,
who
is
got
a
whole
host
of
titles,
but
maybe
you
could
introduce
yourself
with
a
little
bit
of
the
teaser
and
hopefully
we'll
get
video
soon
kind
of
you
know.
Otherwise,
it's
going
to
turn
into
a
podcast
or
what's
what
twitter's
new
thing
spaces?
Is
that
what
it's
called?
A
C
B
C
Yes,
so
I'm
speaking
from
north
london,
where
I've
been
working
at
home
for
the
last,
I
can't
remember
how
many
years,
I'm
now
the
chief
open
source
officer
with
isovalent,
who
are
the
company
that
originally
created
the
psyllium
project,
and
I
am
currently
the
chair
of
the
technical
oversight
committee
for
the
cncf,
the
cloud
native
computing
foundation.
So
hi.
A
Awesome
yeah,
that's
really
cool!
Why
don't?
We
kind
of
start,
maybe
with
tell
us
a
little
bit
about
the
psyllium
project,
I
think,
and
maybe
with
a
little
bit
of
background
in
ebpf,
because
I
think
that's
something
that
not
a
lot
of
people
will
have
experience
with,
especially
given
that
you
have
to
have
a
very
recent
colonel,
relatively
speaking,
to
to
get
ebpf.
Would
that
make
a
good
place
to
start.
C
Yeah
sure,
so
I
think
actually
it's
a
very
timely
question,
because
I
mean
I've
been
interested
in
ebpf
for
well.
I
think
I
first
saw
thomas
graf
presenting
on
it
at
2017
2018
and
I
thought
well,
that's
really
cool,
but
clearly
it
needs
a
new
kernel
and
none
of
us
have
those
yet-
and
you
know
this
is
going
to
take
a
while
and
fast
forward
to
you
know
with
2022
now,
apparently,
if
I
can
remember
to
write,
2022
or
not
2021
and
the
kernel
support
for
ebpf
has
become
much
much
more
widespread.
C
The
kernels
that
almost
everyone
is
using
in
production
these
days
now
support
enough
ebpf
functionality
that
we
can
do
useful
things
with
it
and
like
running
psyllium
and
other
ebpf
projects.
So
that's
probably
a
really
really
core
reason
why,
over
the
last,
let's
say
six
months
or
so
maybe
a
year,
you'll
have
seen
ebpf
just
kind
of
explode
in
popularity,
because
we
can.
We
can.
A
Use
it
or
use
it
right
right,
just
for
a
little
bit
of
background,
so
ebpf
is
kind
of
like
a
sandboxing
tech
for
various
functionality
in
the
kernel,
and
why
do
people
care
well
because
that
way,
you
can
kind
of
host.
You
know
quote
dangerous
things
right
without
having
to
worry
about.
You
know
giving
them
kernel
access
except
not
giving
them
kernel
access,
and
so
I
think
celium,
though,
is
specifically
in
the
kind
of
the
networking
space
right.
C
C
So
the
sandboxing
aspect
ensures
that
those
programs
are
safe,
to
run,
for
example,
that
if
you're
going
to
access
memory,
it's
memory
that
belongs
to
the
process,
that's
currently
sort
of
involved
or
that
you
can't
crash.
You
have
to
check
that
pointers
aren't
null
before
you
dereference
them,
because
you,
it
would
be
a
really
dangerous
thing
to.
C
If
you
crash
the
kernel,
you,
your
machine
is
gone,
it's
died,
and
so
ebpf
sandboxing
or
the
verification
process
makes
sure
that
these
programs
are
safe
to
run,
but
you
can
actually
use
it
to
customize
the
way
the
kernel
behaves
with.
You
know:
restrictions
on
what
you
can
and
can't
do
with
that.
It's
it's
pretty
complicated,
but
you
can
actually
hook
into,
for
example,
any
entry
or
exit
point
to
any
function
in
the
kernel
or
in
user
space.
C
So
psyllium
is
it's
best
known
as
being
a
kubernetes
cni,
a
kubernetes
networking
plug-in
you
can
use
it
outside
of
the
kubernetes
context
as
well,
but
what
it
allows
us
to
do
is
create
networking
endpoints
for
kubernetes
pods
and
connect
them
together
in
a
really
really
efficient
way.
People
quite
often
talk
about
how
we
can
bypass
ip
tables.
We
can
bypass
a
whole
load
of
unnecessary
networking
functionality,
essentially
in
the
kernel,
by
kind
of
hooking,
directly
from
pods
to
networking
interface
or
from
pod
to
pod.
A
Gotcha
yeah,
that's
that's
pretty
cool,
I
mean,
I
think,
one
of
the
things
that
I
was
really
interested
to
learn.
I
guess
I
don't
know.
I
was
really
surprised
to
learn
a
year
or
two
ago
is
like
how
root
has
kind
of
been
broken
apart
actually
into
like
a
bunch
of
different
functions,
and
so
that's
you
know
it's
kind
of
in
the
same
vein.
You
know
it's
like
you
know:
it's
not
just
a
super
power
user
kind
of
anymore
and
you
know,
and
so
you
can
now
actually
isolate.
A
You
know
various
processes
from
each
other,
and
that
has
a
lot
of
ramifications,
for
you
know
things
like
kubernetes,
you
know
and
other,
even
even
virtual
machines
or
whatever
it
allows
you
to
kind
of
give
certain
kinds
of
access,
but
not
carte
blanche
to
processes
that
you
may
or
may
not
trust
or
kind
of,
at
least
in
my
experience
right,
I've
written
enough
bugs
in
my
life
that
you
know
I
don't
even
trust
my
own
stuff
right.
I
like
to
be
able
to
isolate
it
from
each
other,
so
yeah,
that's
pretty
cool.
B
I'm
saying
in
one
of
my
roles,
I
I'm
actually
one
of
the
reviewers
for
submissions
to
kubecon
and
kubecon.
Europe
is
coming
up
and
I'll
say
we
certainly
have
quite
a
few
talk.
Submitters,
who
think
ebpf
is
what
we
should
all
be
paying
attention
to
the
a
lot
of
a
lot
of
submissions
with
core.
You
know
sort
of
either
ebpf
or
I
did
this
thing
with
ebps.
C
A
Yeah,
even
even
like
you
know,
it's
a
it's
a
much
smaller
conference
right,
but
I
remember
seeing
stuff
like
this
for
devconf,
which
is
kind
of
the
technical
red
hat
conferences
that
we
do
that
are
kind
of
very
open
source
oriented,
but
even
there
we
saw
ebpf
stuff
kind
of
landing.
So
I
think
you
know
I
think
you're
right
on.
I
think
there's
a
lot
going
on
with
that
tech,
and
you
know
being
this
being
the
kind
of
insider
show.
A
You
know
it's
it'd
be
a
good
idea
if
you're
not
already
kind
of
tuned
into.
What's
going
on
in
that
community,
it'd
probably
be
a
good
idea
to
start
paying
attention
to
it,
because
it
really
does
seem
to
be
the
wave
of
what
we
want
to
be
doing.
You
know
for
for
lots
of
different
kinds
of
functionality.
You
know
celium
is
one
exemplar,
but
not
necessarily
alone
or
definitely
not
alone.
I
guess.
B
C
So
I
think,
all
the
time
we're
talking
about
containers,
we
have
to
be
very
aware
that,
with
we're
sharing
a
kernel,
all
the
containers
running
on
a
given
host
have
one
kernel
and
that
kernel
has
visibility
and
access
into
everything
all
of
the
processes
running
in
all
of
those
containers
on
that
host.
Now
this
is
where
ebpf
becomes
really
powerful,
because
if
you
run
an
ebpf
program
in
the
kernel,
it
has
visibility
and
potentially
the
ability
to
change
behavior
for
every
single
process
on
that
machine,
and
that
includes
every
single
container
in
every
single
pod.
C
So
you
know
there's
a
lot
of
power
here
and
you
know
you
you
do
have
to
treat
that
power
with
respect.
You
have
to
treat
ebpf
programs
the
way
you
would
treat
anything
else
that
you
would
run
essentially
as
root,
but
we
can
use
those
that
we
can
use
ebpf
to
create
stronger,
let's
say,
security
profiles.
C
There
are
all
sorts
of
things
we
can
do
with
networking
policy
to
limit
what
any
given
containerized
applicator
well
any
given
pod
can
can
do
in
terms
of
network
activity,
but
with
ebpf.
We
can
take
that
even
further,
because
we've
got
this
very,
very
granular
visibility
into
what's
happening,
so
we're
going
to
be
able
to
say
not
just
okay,
you
know
this
pod.
C
Has
you
know
it's
trying
to
contact
this
particular
ip
address?
We
can
say
it's
actually
trying
to
contact
this
particular
domain
name
and
the
process
that
initiated
this
request.
Was
this
given
executable
name,
it
was
started
at
this
time.
Here's
the
whole
process
andy
tree
of
that
connect
request,
for
example,
and
that's
going
to
allow
us
to
be
very,
very
specific
about
what
what's
permitted
in
our
system.
So,
for
example,
you
know
how
often
do
we
really
need
to
run
curl
in
a
production
environment?
C
So
you
know,
let's,
let's
assume
we're
not
ssh
into
our
pods
and
running
cal.
It
would
be
pretty
cool
if
we
were
able
to
write
some
network
well,
some
security
profiles.
That
say
we
don't
expect
you
to
run
that
curl
executable
or
if
we
do,
we
only
expect
it
to
be
run
to
access
this
particular
endpoint,
from
which
this
particular
application
you
know,
has
to
download
some
information
it.
We
can
be
very,
very
specific.
A
Yeah,
exactly
the
you
know,
that's
always
it's
always
the
challenge.
I
I
also
like
to
bring
up.
You
know.
I
really
love
five
novels
and
you
know
in
talking
about
security
layers
right,
you
know
so
in
the
tech
world,
you
know,
I
think
most
people
who
even
have
a
you
know
kind
of
glancing
understanding
of
security,
recognize
that
you
know
having
layers
of
security
is
usually
the
right
answer
right,
but
that's
also
true.
A
It
does
require
us
to
really
think
about
the
security
profiles
and
and
not
only
not
only
making
them
work
correctly,
but
then
also
making
them
easy
to
develop
and
all
that
kind
of
thing
right
I
mean,
I
think
the
sc
linux
adoption
went
way
up
as
soon
as
you
know.
They
started
to
have
nice
tools
that
could
tell
you
how
to
how
to
fix
what's
broken,
because
your
se
linux
profile
is
blocking
something
right,
but
now
you
can
get
really
good
information
about.
A
You
know
why
is
being
blocked,
you
know,
is
it
intentional
and
here's
an
easy
way
to
to
change
it?
If
that
is
something
you
do
want
to
be
able
to
do,
for
whatever
reason
you
know,
sometimes
you
do
want
to
be
able
to
call
curl,
for
example,
so
I
think
we
would
like
to
move
on
to
maybe
talking
about
some
cncf
stuff.