►
From YouTube: OCB: Deploying OpenShift for Security, Networking and Observability Across Hybrid and Multi-Clouds
Description
Organizations are rapidly scaling Kubernetes deployments with container platforms running on a mix of on-prem, cloud, and multi-cloud infrastructure (a phenomenon sometimes referred to as “cluster sprawl”). However, not all users are taking a standardized approach to building multiple clusters on a common distribution and on a single infrastructure with common security tools.
Lack of a centralized, unified multi-cluster approach to security, networking, observability as well as troubleshooting, compliance, and policy management results in dozens of clusters that are deployed and managed independently throughout an organization, with very little uniformity in the way they are secured. This adds complexity for DevOps teams, who must adapt to different cluster environments.
A
A
Can
you
share
my
screen,
and
hopefully
my
screen
is
indeed
sharing
and
I'm
going
to
just
pop
this
up
here
today
we
have
roton
tippernane.
The
ceo
of
tigera
has
been
gracious
enough
to
join
us
on
the
tv
show
and
he's
going
to
be
talking
about
probably
one
of
the
most
important
considerations
for
customers
moving
workloads
into
production
in
in
multi-cloud
and
that's
security
and
observability
with
their
with
their
with
their
calico
enterprise
product
for
openshift.
B
A
It's
going
to
be
an
early
spring
here.
We
we
had
probably
12
inches
still
on
the
ground,
I'm
here
just
north
of
boston,
but
we
actually
are
getting
up
into
the
50
degrees.
It's
it's
it's
it's
downright
bombing,
so
anyways
welcome
and
thank
you
for
joining
us.
As
I
said,
you're,
the
ceo
and
and
president
of
tigera,
you
folks
have
been
work.
A
Well,
not
you,
but
your
engineering
and
product
teams
have
been
working
with
us
now
for
quite
some
time
for
testing
and
certifying
your
software
along
with
openshift,
to
make
sure
that
it's
really
well
integrated.
We
have
a
have
that
chocolate
and
peanut
butter
better
together
story
for
end
customers,
so
when
they
when
they
want
to
go
ahead
and
deploy
open
shift
in
production
environment.
A
A
lot
of
the
considerations
for
day
two
supportability
are
greatly
eased
because
there's
there's
things
like
what
you
folks
are
going
to
talk
about
here
available
for
that
you
folks
have
built
an
operator.
It
is
certified
for
customer
production
use,
it
can
be
made.
It
is
available
in
the
in
the
red
hat
container
and
operator
registries.
B
Very
well
very
well,
you
know
last
year
was
difficult
for
a
lot
of
us
going
into
last
year,
especially
it
feels
like
just
about
12
months
ago.
When
you
all
entered
the
pandemic.
It
was
a
lot
of
uncertainty
and
I've
got
to
say
looking
back,
I'm
just
delighted
that
first,
the
team
did
a
fantastic
job,
navigating
that
uncertainty
and
multiple
dimensions,
and
we
are
just
a
fantastic
year.
We
just
closed
out
our
fiscal
year.
On
january
31st
we
had
one
of
the
best
years
ever
in
the
hdr
company.
B
A
That
and-
and
I
know
I
was
greatly
concerned
about
what
was
going
to
happen-
that
year
from
business-
and
you
know
how
do
we
you
know,
is
everyone
just
going
to
stop
buying
or
is
you
know
what's
going
to
happen?
So
it's
really
good
that
that
these
you
know
challenging
times
your
company
was
able
to.
Actually
you
know,
succeed
in.
B
Yeah,
no,
absolutely
in
fact,
now
that
you
mention
it.
It
brings
back
memories.
We
were
in
exactly
the
same
boat
we'd.
You
know
we
were
going
to
have
a
pretty
big
presence
at
kubecon
in
europe,
we'd
all
booked
our
tickets,
and
so
there
was
this
period
when
we
were
trying
to
figure
out
what
was
going
on
and
he
got
a
call.
B
There
was
quite
a
bit
of
chaos
just
in
terms
of
lack
of
information
at
that
time,
but
I
remember
thinking
at
that
time
and
in
our
business,
as
you
know,
you've
got
to
be
there
at
kubecon
right.
It
is
one
of
the
most
sacrosanct
shows
there,
but
I
I
remember
thinking
that's
leaning
back
and
saying
boy,
you
know
if
I
have
to
make
a
decision,
it's
going
to
be
based
on
that.
A
Well,
I'm
really
looking
forward
to
when
we
can
get
back
together
in
person.
I
think
I
think
12
months
of
12
months
of
zoom
meetings
and
virtual
conferencing,
and
can
you
see
my
screen
and
you
know
how
many
times
have
has
everybody
heard
you
know
hey
you're,
on
mute
right
I
mean
it's
like
people,
don't
have
those
problems
when
we're
in
person.
So
I'm
really
looking
forward
to
being
able
to
get
back
out
there
with
and
interact
with
people,
so
calico
tychera.
A
B
Yeah
project
calico
is
the
leading
solution
for
kubernetes,
networking
and
security.
We
mean
we're
the
gold
standard.
We've
been
out
there
in
the
market
for
about
five
years
right
now
we
have
users
in
166
countries
using
it
we
power
over
a
million
nodes.
Software
has
run
for
over
10
billion
hours.
He
considered
the
gold
standard
in
the
space,
all
the
distros,
all
the
major
cloud
providers,
all
of
them
use
it
for
their
own
communities.
B
B
But
perhaps
the
thing
we're
most
proud
of
is
the
fact
that
when
you
ask
for
feedback
from
users
across
these
166
countries-
and
this
is
going
to
sound
a
little
strange
and
partly
spooky-
but
they
all
use
three
words
to
describe
calico
and
they
all
say
it
just
works,
and
first
time
I
heard
I
heard
it.
I
said
this
can
be
a
coincidence
like
how
are
different
people
in
different
countries
using
the
same
words,
but
that's
really
what's
helped
us
drive
adoption
through
word
of
mouth.
B
A
So
you
said
you
know,
networking
in
security
and
and
I've
been
here
at
red
hat
for
20
plus
years
working
with
software
partners
for
all
20
of
those
years.
When
people
say
security,
there's
endpoint
security,
there's
secret
security.
You
know
we
have
lots
and
lots
of
various
different
software
companies
that
provide
various
different
security
solutions.
B
Yeah
calico
enterprise,
and
also
we
just
launched
something
called
calico
cloud
which
we'll
talk
about
in
a
few
minutes.
But
to
answer
your
question
very
simplistically,
you
know
there
are
four
four
problems
and
use
cases
we
are
solving
for
customers.
So
first
is
when
you
establish
a
open
shift.
Cluster
you've
got
to
immediately
solve
the
problem
of
not
so
security
which,
how
do
you
publish
services?
B
What
do
you
give
access
to
and
anything
sitting
inside
your
cluster?
How
does
it
access
external
services?
That's
the
not
soft
security,
and
then
every
company
in
the
regulated
industry
has
to
have
some
form
of
east-west
security
inside
to
be
able
to
isolate
workloads
and
white
label.
What
conductor?
What
so?
That's
the
second
piece,
the
eastward
security.
The
third
piece
is
most
large
enterprises,
or
even
medium-sized
enterprises
have
their
own
specific
security
controls
they
want
to
establish
within
kubernetes,
so
that
that's
what
we
do
and
some
of
them,
depending
on
the
industry.
B
B
A
I
was
going
to
say
so
so
the
the
technology
that
you
folks
are
bringing
to
market
with
calico
are
is
not
something
that's
just
natively
part
of
kubernetes.
What
about
red
hat's
product
openshift
does
does.
Does
red
hat
have
something
like
this
or
what's
the
relationship
between
calico
and
our
openshift
container
platform.
B
Yeah,
so
you
know
we
have
our
tight
integration.
We've
built
calc
enterprise.
We
built
an
operator
same
thing
with
caliper
cloud:
we've
integrated
the
solution
very
well
together,
so
the
relation,
if
you
flip
it
around,
and
you
look
at
it
from
a
customer's
angle,
about
what
challenges
they're
trying
to
solve.
I
mean
red
hat
openshift.
You
know
probably
one
of
the
best
kubernetes
solutions
out
there
in
the
market.
B
You
got
an
incredible
footprint,
you
land
all
these
accounts,
but
as
soon
as
customers
try
to
move
applications
into
production,
they
hit
a
series
of
challenges
around
security
and
compliance
and
devops
and
troubleshooting,
and
those
are
the
sets
of
problems
that
we
solve,
and
so
it's
a
very
complimentary
solution
and
and
and
customers
really.
You
know,
we've
got
a
lot
of
joint
customers
and
we've
we're
working
together.
A
number
of
new
deals
also
with
your
sales
team.
A
So
people
watching,
if
you
have
questions,
please
feel
free
to
put
them
into
the
chat
window
down
below
and
then
our
producers
will
make
sure
to
pick
up
those
questions
and
get
him
over
here
and
and
we'd
like
to
have
this
be
as
much
of
a
dialogue
as
possible.
I
mean
we,
we
don't
like
to
you
know,
have
our
speakers
come
on
and
death
by
powerpoint?
Okay?
A
B
B
A
So,
and
actually
you
and
I
were
talking
about
when
we
were
going
over
this
concept-
and
I
was
asking
you
I'm
like
okay-
well,
isn't
isn't
all
this
just
in
open
shift
already
and
you
were
like
no
mike
it's
not
and
and
that
that's
one
of
the
reasons
why
you
know
we
have
been
working
so
closely
with
you
folks
to
to
have
this
all
tested
and
well
integrated.
So
the
next
question
was:
what
does
tigera
provide?
A
B
Yeah,
so
it's
really
what
I
had
spoken
about
before,
when,
if
you
and
maybe
later
on
mike,
I
can
maybe
just
put
up
one
slide.
We
don't
want
to
put
up
slides
here,
but
maybe
I'll
put
up
one
slide
to
visually
describe
that
later
on,
but
there's
a
level
of
detail
in
terms
of
not
so
security,
eastwood
security
and
the
compliance,
and
also
we've
got
a
purpose-built
ids
ips
for
this
and
in
the
observability
solution.
B
All
that's
all
that
is
complementary
to
red
hat,
open
shift
in
terms
of
stack
rock
stack
rocks
is
a
pretty
outstanding
solution
for
container
scanning.
That's
where
the
roots
were,
and
that's
a
that's,
an
important
problem
that
has
to
get
solved
for
customers.
That
is
not
something
we
do.
So
that's
a
complimentary
solution.
Stackrock
says.
B
B
B
B
All
right,
so
let
me
just
kind
of
get
you
oriented
on
this.
To
answer
your
question,
so
you
know
there
are
different
distros.
Obviously,
if
you
see
large
customers
have
one
or
more
one
of
these
distros
openshift
being
the
standard
really
in
the
market,
so
the
four
pillars
I
talked
about
are
not
south
controls,
e-swiss
control,
security,
compliance,
observability,
and
let
me
just
kind
of
walk
you
through
this.
To
answer
your
question:
what
do
we
do?
B
The
first
thing
is
as
soon
as
you
get
an
openshift
cluster
up
and
running,
you've
got
to
be
able
to
establish
ingress
equals
access
controls
like
which
of
your
services,
do
you
advertise
and
which
what
from
outside
world
can
talk
to.
It
is
a
big
challenge
and
same
thing:
egress
is
about
hey
something
sitting
on
your
cluster.
B
It's
trying
to
access
external
resources.
Maybe
it's
trying
to
access
some
sas
application
like
salesforce,
maybe
it's
trying
to
access
an
api
like
twilio
like
so
you
have
to
make
real
runtime
decisions
about
what
can
get
access
to
what
an
external
world
and
you
have
to
be
able
to
establish
very
fine
grain
control.
B
So
that's
the
ingredients,
controls
and
the
dns
policy
is
about
you
know
being
able
to
configure
a
lot
of
these
rules
based
on
dns
policies,
because
most
customers,
when
they
move
their
applications
to
kubernetes
they're,
not
trying
they
don't
want
to
refactor
them,
especially
the
windows,
applications
and
you've
got
to
be
able
to
establish
these
controls
at
the
dns
level.
The
other
part
is
whatever
your
opinion
may
be
about
firewalls
and
sims.
B
The
truth
is
most
enterprises.
They
have
firewalls
and
sims
and
they're
not
about
to
go
away.
So
you
have
to
be
able
to
talk
to
them
and
and
integrate
with
them,
and
one
of
the
big
challenges
in
this
world
is
firewalls.
Do
they
speak
a
different
language?
They
like
static
ip
addresses.
So
how
do
you
integrate
your
kubernetes
cluster?
To
talk
to
firewalls
is
an
enormous
challenge.
Enterprises
struggle
with.
So
all
these
problems
we
still
solve
under
the
not
sought
control
bucket
in
east
west
control.
B
We
talked
about
it
a
little
bit,
especially
through
the
regulated
industry
or
anyone
who
cares
dp
about
security,
because
once
a
workload
is
compromised,
everything
is
fair
game
inside
the
cluster.
So
our
philosophy
is
defense
in
depth,
so
we
can
protect
at
the
application
level
at
the
service
controls.
We
can
do
micro
segmentation
at
the
container
or
vm
level.
We
can
also
protect
at
the
host
level.
We
can
segment
at
the
host
level
and-
and,
as
I
said
before,
you
know
it's
all
about
limiting
the
blast
radius.
B
If
something
does
get
compromised
and
it
really
depends
on
the
sophistication
of
a
customer
how
fine-grained
they
want
to
make
these
controls,
you
can
go
all
the
way
down
the
dialogue
to
be
a
zero
trust
model
pretty
easily,
and
we
have
automated
tools
that
can
configure
policies
for
customers
without
them
having
to
do
any
manual
work
and
then
put
it
in
staging
security
compliance.
You
know
a
lot
of
customers
we're
seeing
they
want
to
encrypt
all
data
in
motion,
so
we've
got
a
wire
guard
solution
blazing
fast.
B
We've
got
a
purpose
period,
intuition
detection
and
prevention,
and
just
to
give
you
a
little
bit
of
a
teaser
on
this
on
intrusion
detection,
we
do
some
pretty
creative
things.
We
deploy
honey
parts
which
are
really
fake
parts
with
applications.
Services
like
nginx
running
on
them
and
any
traffic
we
detect
to
them.
We
can
automatically
then
inspect
the
traffic.
Do
a
deep
packet
inspection
of
that
run,
a
snot
analysis
and
figure
out.
B
It
is
we're
just
now
starting
to
see
customers
get
to
some
level
of
scale
and
most
of
the
solutions
of
the
market
were
designed
for
static,
vms
and
kubernetes
being
so
powerful.
The
level
of
extraction
it
provides.
The
legacy
tools
are
simply
not
effective,
so
we
got
a
purpose-built
solution
for
observability,
where
we
can
show
you
literally
a
few
seconds
after
you
activate
our
software,
a
dynamic
service
graph
about
which
microservices
talking
to
each
other
microservice.
B
Just
that
itself
is
a
geographic
movement,
because
most
platform
engineers
running
clusters
in
openshift,
don't
know.
What's
going
on
inside
that,
and
we
can
show
them
at
real
time
what's
happening
and
we
can
actually
help
identify
performance
hotspots
within
that
to
tell
people
where
the
problem
areas
are
because
there's
no
sense
in
throwing
data
at
people.
It's
just
overwhelming
cognitively,
it's
impossible
to
make
sense
of
the
data.
B
So
you
need
some
form
of
machine
learning
to
identify
where
the
potential
issues
are
and
if
necessary,
we
can
give
people
the
ability
to
you
know
double
click
and
look
at
the
application.
The
process,
the
socket
or
even
crack
open
a
packet
and
see
what's
inside
a
packet,
so
we
give
them
extremely
powerful
tools
to
be
able
to
debug
applications
and
everything
you
see
here
runs
across
multiple
clusters
or
multiple
clouds
or
hybrid
cloud,
and
this
entire
thing.
B
Our
philosophy
is
that
we
want
to
shift,
left
and
empower
the
developers
and
the
devops
engineers
to
be
able
to
self-serve
any
combination
of
this
or
better
still
integrate
this
into
into
their
ci
cd
chain,
so
that
the
entire
thing
is
automated.
So
so
that's
a
little
bit
of
a
remarkable
in
terms
of
what
we
do
mike.
A
Raton,
while
you
have
this
up,
so
what
about?
What
about
customers
who
aren't
ready
to
move
into
the
cloud
right
now
I
mean
there's.
Certainly
some
people
who,
for
various
different
reasons,
are,
like
you
know,
cloud's
interesting,
but
for
right
now
we're
staying
right.
Where
we
are
you,
you
list
your
multi-cluster
multi-cloud
hybrid
cloud.
What
about
for
those
customers
who
are
staying
put
where
they
are
in
their
data
center
right
now,.
B
A
B
So
so
let
me
answer
the
first
part
of
the
question.
I'd
say
in
general,
you
know
the
first
part
of
the
question.
We
do
that,
all
the
time
customers
using
openshift
sdn,
we
help
them
migrate
to
calico
that
that's
pretty
straightforward.
The
second
part
I'm
going
to
reserve
my
answer.
I
don't
want
to
misspeak.
It's
probably
something
you
know
we
we
can
have
one
of
our
solution.
Architects,
look
at
and
answer
on
that.
A
A
You
know
one
of
the
one
of
the
mainstream
platforms
that
people
are
looking
at
as
well.
You
know,
what's
involved,
to
get
calico
up
and
running
on
an
openshift
cluster.
How
you
know
are
there?
You
know
teams
of
professional
services,
people
that
need
to
come
in.
You
know
and-
and
you
know,
take
over
someone's
labs
for
you
know
a
month
in
order
to
get
this
working
or
you
know,
is
it
like,
and
and
how
does
the
operator
that
you
guys
made
fit
into
all
of
this?
B
Sure
yeah
so
I'd
say
you
know
the
first
part
you
know
I
mean
I
want
to
be
careful
because
in
in
my
response,
both
we
have
common
customers
who
are
fortune
500
customers.
So
obviously
there's
there's
quite
a
bit
of
complexity
given
their
environment,
but
in
general,
to
answer
your
question
more
generally,
for
someone
trying
to
get
something
up
and
running
as
a
pilot
in
their
lab,
or
something
like
that,
you
know:
we've
actually
made
that
entire
experience
self-service
where
they
can.
B
Actually
someone
could
come
to
our
website
sign
up
for
a
14-day
trial
and
we
would
actually
enable
them
to
self-serve
and
just
through
a
few
clicks
in
a
few
minutes,
get
calico
enterprise
or
calico
cloud
running
up
and
running
in
their
openshift
cluster
right
now,
if
you
look
at
the
spectrum
of
someone
running
at
scale,
a
fortune,
500
company
running
open
shift
mission,
critical
applications,
thousands
of
them
across
10
000
nodes.
Obviously
it's
going
to
be
there's
a
there's,
a
level
of
complexity
associated
with
that.
B
The
second
part
of
the
question
at
an
operator
so
you're
one
of
the
early
adopters
of
operator,
we've
adopted
it
fully,
and
I
mean
you
you're
an
expert
and
operator,
so
all
the
goodness
that
comes
with
the
operators.
So
we've
embraced
that,
and
you
know
you
get
that
with
calico
enterprise
in
terms
of
being
able
to
make
sure
that
you
have
the
latest
and
greatest
and
all
the
dependencies
and
all
that
stuff
gets
fleshed
out.
I
think
it's
a
great
model.
A
B
Yeah
yeah,
no,
it
is
it
you
know,
and
and
again
the
proof
point
is
if
you're
referring
to
calico,
open
source
or
calc
cloud,
we've
now
had
people,
especially
calico,
open
source.
When
I
opened,
I
said,
hey,
we
have
people
in
166
countries
use
it
and
trust
me.
When
I
tell
you
they
are
not
calling
outside,
we
would
not
be
able
to
actually
support
them
if
we
had
to
actually
hand
hold
them
in
the
departments.
A
Okay,
if
there's
any
other
questions,
please
put
them
into
chat.
Otherwise
we
can
continue
on
with
our
regularly
scheduled
programming
here.
So
we've
already
talked
about.
We've
already
talked
about
the
technology,
but
you
know
when,
when
customers
are
moving
from
the
data
center
into
multi-cloud,
there's
different
types
of
problems
that
arise
certainly
different
than
just
running
in
a
data
center.
B
Yeah,
so
so
it's
it's
interesting
and
I'll
give
you
an
example.
I
can
name
the
customer,
but
they
started
with
their
on-prem
cloud,
and
then
they
went
to
aws,
azure
and
google,
so
they
have
this
for
cloud
strategy,
and
so
the
first
business
problem
is,
you
know,
to
implement
and
let
me
step
back.
You
know
the
reason
people
choose
kubernetes
in
the
first
place,
what
we've
seen
at
least
the
primary
use
case
for
why
do
people
choose
communities?
B
It's
it's
actually
to
provide
a
layer
of
abstraction
on
the
infrastructure
so
that
it
gives
them
the
flexibility
to
move
to
different
infrastructures
and
not
get
locked
into
a
specific
cloud
vendor,
because
you
know
kubernetes,
ironically,
is
not
getting.
The
primary
use
case
is
not
for
orchestrating
containers
at
scale
that
google
is
no
one.
Has
that
kind
of
scale.
The
primary
use
case
is
extraction,
so
the
first
problem
they
run
into
is
you
know
when
they
are
deploying
to
the
cloud.
B
The
second
thing
is
a
little
bit
more
of
a
practical
problem,
which
is,
if
you
have
different
controls
for
each
of
these.
Now
you
you
need
different
teams
to
operate
them
right
and
that's
an
enormous
cost
that
they
have
to
carry
across
and
not
to
speak
of
training
their
own
users.
So
some
of
our
customers
they've
actually
taken
this
all
the
way
to
self-service
where
they
give
their
you
their
own
internal
users,
the
ability
to
provision
clusters
through
a
self-service
service
catalog.
B
So
someone
can
come
in
and
say
hey.
I
want
to
provision
an
eks
cluster
or
an
aks
cluster,
and
all
this
is
happening
to
self-service
and
when
they
do
that,
they
also
need
to
enable
security.
Security
then
gets
baked
in
as
part
of
that,
so
that
when
a
cluster
gets
spun
up
depending
on
who
it
is
based
on
the
based
on
our
back,
the
cluster
gets
spun
up
the
right
security,
the
controls
get
get
provisioned
and
that
will
happen
across
any
cloud
right.
B
B
People
are
running
youtube
that
they're
trying
to
solve,
and
then
the
same
thing
applies
to
observability,
but
it's
like
if
you
have
a
different
experience
when
you
go
across
different
clouds
to
be
able
to
debug
your
application,
it
creates
complexity
and
to
provide
like
a
single
pane
of
glass
that
it
gives
you
the
ability
to
look
at
your
dynamic
service
graph
across
any
cloud
or
on-prem
a
mix
of
them
and
to
be
able
to
double
click
down
to
the
application
level
process,
level,
socket
level
or
even
do
a
packet
capture.
I
mean
think
about
it.
B
A
Okay,
thank
you.
We
have
been
jumping
around
and
I
would
I
do
encourage
more
questions.
So
thank
you
for
that
because
we,
like,
I
said
we
didn't
want
to
just
you
know,
show
up
and
run
through
some
slides
when
we
were
going
through
our
our
dry
run.
The
other
day
we
were
talking
about
ingress,
egress
access,
and
you
know
frequent
security
concerns
for
kubernetes
apps.
B
Yeah
yeah
so
in
in
really
plain
english
ingresses.
You
know,
you've
got
a
bunch
of
services
running
in
inside
your
openshift
cluster.
You
have
to
advertise
to
the
outside
world
who,
in
the
outside
world,
would
get
access
to
these
services.
So
that's
those
are
the
ingress
controls
you
have
to
establish,
and,
needless
to
say,
my
the
firewalls,
the
technologies
we've
all
used
so
far
for
the.
B
You
really
don't
have
the
notion
of
a
static
ip
address,
so
there's
an
incongruity
between
between
those
two
models
and
you
just
need
a
different
architecture
to
solve
that,
and
that
is
the
ingress
part
of
it
the
equals
part
of
it
is,
you
know,
and
some
of
this
in
hindsight
it
feels
warningly
obvious,
but
most
customers
going
into
this
journey
were
not
aware
of
it,
and
let
me
give
you
maybe
a
real
life
use
case,
one
of
our
customers.
Two
years
ago
they
actually
deployed
to
kubernetes
cluster
and
they
had
to.
B
B
Then
they
discovered
that
once
they
enabled
that
integration
anything
sitting
inside
the
kubernetes
cluster
would
have
access
to
facebook
and,
needless
to
say,
that
level
of
access
can
be
quite
damaging.
If
there's
some
exfiltration
of
data,
so
then
they
realized
that
they
have
to
provide
some
extremely
fine-grained
access
control.
B
They
say
only
this
specific
application
gets
access
to
facebook,
so
that's
a
very
simple
example
of
egress
access
controls
and
to
be
able
to
do
that
at
different
levels
like
maybe
at
the
part
level,
maybe
at
the
micro
service
level
or
maybe
a
specific
api
you
want.
External
access
is
really
what
is
really
about
the
egress
access
control
right.
So
so
those
those
are
the
two
problems
that
customers
run
into
really
out
of
the
gate.
A
B
B
Each
nodes,
multiple
containers
inside
running
different
microservices,
making
api
calls
and
there
is
a
distributed
operating
system
very
powerful,
managing
and
orchestrating
this
whole
thing
so
yeah,
if
you
could
say
that
take
that
concept
apply
that
at
an
uber
level
that
that's
really
the
challenge
we're
talking
about,
and
I
think
probably
the
big
difference
between
the
world.
Maybe
you
and
I
just
spoke
about-
is
the
level
of
dynamism
right.
Everything
is
getting
spun
up
and
spun
down
dynamically,
and
it's
all.
A
B
Yeah,
no,
it
does
so
first
with
calico.
What
we
do
is
we
solve
the
networking
problem
and
also
some
level
of
security
problem.
The
slide
I
put
up
a
few
minutes
ago
that
talks
about
the
knocks
out
controls
the
eastwist
controls,
the
security
compliance
controls
and
the
observability,
all
that
is
in
the
commercial
product
called.
We
have
two
commercial
packages,
calico
enterprise
and
calico
cloud.
So
all
of
that
is
really
in
the
commercial
product
built
on.
So
the
beauty
is
someone
who's
using
open
source
calico
with
a
click
of
a
button.
B
A
Okay-
and
I
I
actually
did
have
a
note
here-
I
write-
I
was
reading
your
your
press
announcements
about
three
weeks
ago
about
calico
cloud
and
I
I
did
want
to
bring
that
up
here,
but
I
also
want
to
make
sure
we
address
some
more
of
these
questions
that
are
coming
in.
We,
like
the
dialogue
wallet
says
I
apologize
if
I'm
mispronouncing
your
name.
I
would
take
your
opinion
on
differences
of
install
environments.
A
B
Yeah
I
mean
the
simplest
icon
so
early
these,
I
I
do
think
they
they
definitely
add
latency
right
there.
There
is
no
doubt
about
it,
and
this
is
where
we
are
actually
actively
working,
especially
given
that
we
are
one
of
the
first
players
to
embrace
evpf
and
we've
got
an
incredible
solution
around
that
there
are.
There
are
optimizations
that
we
are
looking
at
to
further
reduce
some
of
the
latency
and
cut
through
some
of
these
layers
of
abstraction.
B
A
Know
that
I
know
that
our
engineers
came
to
me
geez.
I
think
it
was
back
in
november
and
red
hat's
working
on
red
hat's
working
on
this,
this
network
latency
project.
If
you
will
called
a
sub
submariner
submariner
submariner-
I
don't
know
if
you've
ever
heard
of
that,
but
that
that's
certainly
something.
Maybe
you
know
our
customers
have
been
coming
to
our
engineers
and
services
teams
saying
you
know
we
need
to
figure
out
this
whole
networking
latency
thing
for
multi-cloud.
A
Maybe
I
can
connect
you
up
and
you
can
have
a
conversation
with
our
folks
working
on
submariner,
because
it
is-
and
I
can
I
don't
have
the
link
here.
I
don't
know
cyrus
if
you're,
if
you're
on,
if
you
can
find
that
blog,
that
we
that
we
put
together
around
submariner
project
and
maybe
drop
it
in
chat.
That
would
be.
That
would
be
pretty.
B
Cool,
I
suspect,
the
submarine
something
you
know
you're
talking
about
is
really
is
a
standard
for
multi-clusters.
I
believe
right,
yes,
yeah
and,
and
if
so
I
I
I
need
to
go
back
and
check,
but
I
I
do
believe,
we've
actually
implemented
something.
I
think
it
is
with
submarine
in
there
well
for
for
the
multi
cluster,
but
at
the
same
time
I
do
feel
like
those
standards
are
starting
to
still
get
solidified
right.
The
ground
is
still
moving
underneath
us.
B
A
B
A
Yeah
and-
and
I'm
not
I'm
not
on
the
open
shift
team,
but
I
have
been
around
here
since
2002
and
I'll
tell
you
that
you
know
we
get
questions
like
that,
all
the
time,
the
the
the
reason
why
we
work
with
software
vendors
to
test-
and
you
know
certify
their
software-
is
so
when
it's
running
in
a
production
environment.
You
don't
you
know,
you
don't
have
any
any
surprises
right.
So
we
have
a
collaborative
support
arrangement
in
place
with
tigera.
A
If
you're
running
you
know
calico
with
open
shift,
whether
it's,
oh
you
know,
openshift,
you
know
ocp4
or
greater,
and
you
know
there's
a
defect
repair.
You
know
that
red
hat's
going
to
take
care
of
our
software
and
tiger
is
going
to
take
care
of
theirs.
If
you're
running
a
non-supported
community
edition
and
it
breaks,
you
know,
well,
you
get
to
keep
both
pieces.
A
So
I
don't
know
that
you
would
lose
support
from
red
hat
for
openshift,
but
we
would
ask
you
to
reproduce
the
problem
with
one
of
the
certified
pieces
of
software
that
tigera
provides,
and
then
you
know
if,
if
it's
still
reproducible,
then
our
our
support
teams
will
work
on
it
together.
I
hope
that
answers
your
question
in
a
little
bit
and
my
my
email
address
by
the
way
is
just
it's:
just
wait:
redhat.com
w-a-I-t-e
redhat.com,
I'm
more
than
happy
to
get
anyone
on
the
call
or
or
on
facebook
or
yahoo
or
twitch.
A
A
B
A
So
calico
cloud,
you
guys
announced
that
what,
on
end
of
february
third
week
in
february
oh
and
looks
like
cyrus
just
linked
the
the
stateful
workloads
blog,
that
we
did
that
that's
part
one
cyrus
there
was
a.
There
was
a
second
part
that
we
did
around
distributed
clusters.
I
think
we
did
it
with
with
cockroach
labs,
so
it
should
be
part
two.
Maybe
you
can
drop
that
in
there
as
well.
A
These
are
good
reads.
If
anyone
wants
to
read
about
what
we're
doing
around
some
submariner,
please
feel
free
to
check
it
out.
Rafael
spizzoli
is
a
good
friend
of
mine
and
he's
the
he's.
The
services
lead
on
that
so
calico
cloud
three
weeks
ago,
everybody's
launching
a
cloud
offering
these
days.
How
is
yours
different?
What
what
is
it.
B
Yeah,
so
you
know,
let
me
spend
a
few
minutes
about
the
genesis
of
why
we
launched
calico
floor
in
our
vision
for
that
so
the
last
couple
of
years
you
know,
we've
spent
the
focus
our
go
to
market
was
focused
on
going
after
the
fortune.
500
companies
we've
had
a
lot
of
success.
With
that
we've
closed
some
incredible
deals
in
partnership
with
the
red
hat
openshift
team.
B
We
worked
together
very
proud
of
that,
but
when
we
looked
at
that
we
kind
of
asked
ourselves
the
question:
why
are
some
of
the
fortune
500
companies
seeing
success
with
both
kubernetes
and
open
shift
and
what's
unique
about
them?
It
really
came
down
to
three
things.
One
is
to
state
the
obvious.
You
know
they
have
very
deep
pockets,
so
they're,
you
know
they
were
able
to
invest
quite
a
bit
of
money
just
in
those
projects.
Second,
is
they
have
the
ability
to
attract
a
lot
of
great
talent?
B
You
know
you
need
the
talent
to
be
able
to
launch
these
communities
projects
and
take
this
to
scale,
and
the
third
is
at
least
from
our
lands
from
a
security
perspective.
They
had
incredible
depth.
They've
accumulated
about
maybe
two
decades
or
three
decades
worth
of
expertise
around
security
again,
mostly
because
of
necessity
they
were
the
targets
of
every
hacker
on
the
planet.
B
If
you're
a
fortune,
500
company,
one
of
the
largest
banks,
it's
safe
to
assume
that
you
know
you
you're
being
attacked
thousands
of
thousands
of
times
a
day,
so
so
they
they
had
those
three
areas
of
expertise
or
resources
because
of
which
they
were
able
to
deploy.
You
know
kubernetes
and
take
it
to
scale.
B
So
what
we
did
with
pla,
calico
cloud
and
the
vision
for
calico
cloud.
Is
we
packaged
up
a
lot
of
this?
The
best
practices,
the
lessons
we
learned
by
helping
these
customers
take
it
to
scale?
And
then
our
vision
is
to
go,
make
that
available
package
to
the
next
10
000
companies?
You
know,
maybe
you
you
you're
a
small
company.
Maybe
you
have
finite
employees
in
the
midwest.
You
don't
have
access
to
technical
talent.
You
don't
have
millions
of
dollars.
B
B
A
devops
engineer,
with
with
no
background
in
security,
could
activate
that
in
minutes
over
a
lunch
break
and
have
it
up
and
running
in
any
cloud
any
network,
any
infrastructure
with
you
know
with
open
shift
or
any
other
kubernetes
distro
and
the
beauty
is
they
only
pay
for
what
they
use
right.
So
they
know
long-term
contracts
and
they
just
pay
for
what
they
use.
So
that's
the
vision
for
calco
cloud
and
they
get
to
try
it
before
they
use
it.
They
don't
have
to
make
long-term
commitments
and
it's
entirely
self-service.
A
A
I
was
looking
on
your
website
this
morning
and,
and
there
were
job
postings
just
just
kept
scrolling
off
the
page
and
they
were
they
were
in
ireland
and
israel
and
I'm
guessing
like
you
know,
marketing
is
in
california,
engineering
in
israel
and
ireland.
I
mean
what
things
must
be
really
humming
along
over
there.
B
Oh
yeah,
we
are,
we
are
literally,
you
know
compared
to
where
we
exited
this
financial
year
on
january
31st.
We
are
doubling
and
we
are
doubling
literally
in
the
next
like
90
days,
so
we
are
hiring
at
that
pace
and
the
places
where
we
are
hiring
are
vancouver
in
canada
and
then
also
in
cork
in
ireland.
B
A
A
Okay,
we
already
talked,
and
I'm
gonna,
put
up
a
slide
at
the
when
we
when
we
come
to
the
end,
with
a
link
to
downloading
your
software.
If
people
want
to
get
it,
it's
easy
to
go
there
and
just
pull
it
down.
What
what
didn't
we
talk
about
that?
We
were
supposed
to
talk
about
here.
I
kind
of
wanted
to
talk
about
tiger
summit.
That's
coming
up
in
june.
Probably
don't
have
a
whole
lot.
A
A
I'm
not
I'm
not
an
authorized
person,
but
but
red
hat
is
red
hat
right,
so
there's
ibm
and
then
there's
red
hat,
and
we
are
definitely
you
know
running
our
own
things
underneath
the
ibm
umbrella.
What
what
do
you
want
to
talk
about?
Given
that
we've
got?
You
know
a
couple
minutes
here
and
we
can
take
a
couple
more
questions
and
actually,
while
it
looks
like
he's
going
to
be
going
to
your
summit,
but
you
know
you
want
to
talk
about
the
summit,
what
is
it.
B
B
Fantastic
learning
opportunity
with
expecting
several
thousand
people
to
attend
the
summit
would
would
love,
and
it's
all
going
to
be
educational.
It's
not
going
to
be
marketing
spiel
from
taguera
right,
so
would
love
for
you
to
attend
that
the
details
are
on
my
website
check
it
out.
The
second
thing
I'll
probably
talk
about,
is
you
know
just
you
know
the
incredible
collaboration
we
have
with
the
red
hat
sales
team
and
really
the
reason
for
that
is
given
the
footprint
that
the
red
hat
team
has
on
the
market.
A
B
Probably
are
already
there
in
every
single
account,
so
they're
not
going
to
have
trouble
landing
these
accounts,
but
the
common
pattern
we
are
seeing
across
the
across
the
sales
organization
in
red
hat
is
after
you've
sold
the
first
set
of
licenses
of
open
shift.
The
customer
then
struggles
with
a
bunch
of
problems
and
without
solving
those
problems
around
security
or
observability
or
devops.
B
They
will
not
expand
and
the
real
money
and
the
real
opportunity
for
open
shift
is
really
an
expansion,
not
the
land.
The
land
deals
are
very
modest,
it
could
be
a
fifty
thousand
dollar
deal
or
a
hundred
thousand
dollar
deal,
but
the
expansions
usually
are
in
the
millions,
and
what
we
do
at
target
is
effectively
unblock
those
problems
and
unlock
the
expansion
opportunity
and
specifically,
though
that's
around
high
availability
is
one
of
the
most
common
use
cases
we're
seeing
and
the
second
thing
is
security
and
the
third
is
observability.
B
So
so
that's
that's
the
thing
to
highlight,
and
the
last
thing
else
is.
You
know
we're
just
delighted
to
be
working
with
incredible
people
in
the
red
hat
organization.
We
partner
pretty
closely
with
your
sales
sales
organization,
scott
sager
and
others
in
the
finance
vertical,
and
you
know
every
day.
You
know
that
that
partnership
is
getting
deeper
and
better.
A
Right
and
and
and
when,
when
we
when
we
when
we're
done
here
today
and
you
get
that
phone
call
from
your
vp
of
marketing
and
and
he
or
she
or
you
know,
or
maybe
it's
john
or
someone
like
that,
you
know
and
they
say
you
know,
I
can't
believe
rattan
you
were
on
there
for
an
hour
and
you
didn't
say
the
phone
or
you
didn't
is:
is
there
something
that
will
prevent
that
phone?
Call
that
you
want
to
get
in
here
in
the
last?
You
know
couple
of
minutes.
B
Yeah,
you
know
the
only
thing
I'd
say
is
you
know
one
thing
we're
very
very
big
on
at
a
is
about
education
and
training,
the
community.
We
believe
that
you
know
if
we
actually
give
to
the
community,
the
goodness
will
come
back
to
us.
So
we
have
some
fantastic
training,
educational
resources.
We
get
rave
reviews
about
it.
As
an
example,
we
have
a
calculus
certification
program
where
someone
who's
trying
to
reinvent
their
career
or
learn
new
skills
or
learn
about
kubernetes.
We
take
them
through
the
basis,
teach
them
about
kubernetes
and
networking
and
security.
B
It's
a
self-paced
course,
and
that's
one
of
many
we're
about
to
launch
so
I'd
say
check
that
out
every
week
twice
a
week
we
run
training
sessions.
These
are
live
sessions
so
check
those
out
those
those
are
opportunities
to
learn.
We
have
a
fantastic
ebook
again
that
gets
rave
reviews.
It's
been
downloaded
thousands
of
times
again
talks
about
the
fundamentals
of
community
security
and
we're
about
to
launch
another
ebook
around
kubernetes
security
and
observability,
and
so
we
so
our
belief
is,
we
have
to
educate
and
train
the
market.
B
A
Okay,
well
very
good.
Thank
you
for
joining
us
here.
I
have
the
call
to
action
slide
here.
Let
me
just
start
from
the
current
slot.
Oh
gosh
dang.
It
there's
got
to
be
a
better
way
in
blue
jeans
to
synchronize
screen
sharing
and
presenting
an
open
office.
At
the
same
time,
yeah
there
we
go
so
rattan,
ceo
of
tigera.
Thank
you
so
much
for
joining
here
today.
A
Tell
john
thanks
again.
I
know
that
he
said
he
was
gonna
hop
on
you
know
as
a
as
an
attendee,
but
it's
really
great
to
have
you
on
the
show.
Hopefully
you
can
be
part
of
our
podcast
series
coming
up.
I
don't
know
if
john
talked
about
that,
but
you
folks
can
check
out
the
red
hat
x.
Podcast
series
send
us
some
ideas.
If
you
want
to.
If
you
want
to
talk
about,
you
know
ideas,
you
may
have
for
doing
a
podcast
on
our
on
our
podcast
series.
A
You
can
certainly
do
that
as
well.
It's
just
red
hat
x,
podcast
series
and
you
see-
we've
got
hundreds
of
our
software
partners.
All
talking
technology
learn
more
about
red
hat
and
tiger
partnership.
You
can
see
we
got
the
link
on
here
and
presumably
the
link
for
downloading
it
for
people
to
try
it
out.
Is
there
as
well,
and
I'm
sure
that
you
have
some
workshops
raton,
where
people
can
do
it?