►
From YouTube: TGI Kubernetes 180: Kubernetes 1.23 release review
Description
Come hang out with Joe Beda (@jbeda) as he explores the Kubernetes ecosystem.
This week we have Rey Lejano as a guest. Rey was the release lead for Kubernetes 1.23. He is also a Field Engineer for SUSE via Rancher Labs. Rey is going to take us through what goes into a release and some of his favorite enhancements for release 1.23.
Notes are at https://github.com/vmware-tanzu/tgik/blob/master/episodes/180/README.md.
00:03:49 - Welcome to TGIK and welcome Rey!
00:07:11 - Week in Review
00:26:10 - What is a Kubernetes Release Lead?
00:33:36 - Dual stack IPv4/v6
00:37:37 - PodSecurity Admission to beta
00:42:06 - TTL Controller
00:44:43 - HPA v2 API to GA
00:52:17 - Ephemeral Containers and kubectl debug
00:59:16 - Auto Remove PVCs from StatefulSets to alpha
01:00:44 - SLSA Level 1 compliance
01:05:26 - 1.23 Lightning Round
01:06:52 - Thank you and goodbye
A
A
how
time
flies
and
doesn't
it
I'd
like
to
welcome
everybody
and
today
is
going
to
be
a
very
special
episode,
we're
going
to
be,
in
addition
to
sort
of
doing
our
regular
sort
of
news
of
the
week
and
going
over
sort
of
what's
happening
in
the
kubernetes
world.
We're
also
going
to
be
welcoming
ray
lahanya,
and
I
should
have
asked
you
before.
We
started
to
make
sure
I'm
pronouncing
your
name
right,
but
let
me
go
ahead
and
bring
you
on
ray
and
you
can.
A
A
A
A
I've
definitely
experienced
that
and
let's
see
on
from
from
cupertino
sevy
from
amsterdam,
david
good
to
see
ya,
awesome
yeah,
it's
so
great
to
see
folks,
who've
sort
of
joined
us
on
and
off
for
for
so
long
and
to
still
stick
with
us
here.
It's
been,
it's
been
an
interesting
transition
for
tgik,
as
we've
been
bringing
on
more
hosts
and
like
with
the
pandemic.
So
many
more
folks
are
doing
stuff
like
this
and
bringing
folks
on,
and
it's
really
good
to
see
that
having
so
much
content.
A
So
many
good
things
going
on
out
there
steve
good
to
see
you,
I'm
from
from
israel
good
to
see
you
also
well
for
those
who
aren't
familiar,
what
we
try
and
do
with
tgik
is.
We
have
some
some
sort
of
crowd,
source
notes
and
I'm
going
to
go
ahead
and
start
projecting
these
here
and
if
you
want
to
go
start
looking
at
these
things,
they're
available
at
tgik.io
notes,
this
is
using
hackmd.
I
love
hackmd
as
a
service.
A
It's
just
super
easy
to
get
going
with
and
and
lightweight,
and
so
anybody
who
has
things
that
they
want
to
talk
about
or
as
we're
talking
about
stuff.
If
you
want
to
add
some
some
pointers
there
feel
free
to
to
sort
of
crowdsource
and
add
some
stuff
to
the
notes.
But
what
we
like
to
do
is
actually
go
through
hey.
A
What
are
some
interesting
things
that
folks
have
seen
over
the
last
you
know
week
or
two,
since
the
last
episode
do
a
little
could
a
bit
of
kibitzing
back
and
forth
on
that.
Sometimes
you
know
folks
in
the
chat
will
bring
up
new
things
that
we
might
have
missed.
That
should
be
part
of
this
like
right
as
we're
talking
about
this.
A
We
can
get
that
on
here
too,
but
but
let's
go
ahead
and
get
started
and-
and
you
know
ray
you
are-
you
know
definitely
sitting
on
ground
floor
for
some
of
these
things,
and
so
I
definitely
am
looking
forward
to
hearing
your
perspective
on
this.
Let's
start
with
the
docker
shim
deprecation.
Now
we've
talked
about
this
on
and
off.
A
If
you're
not
aware
of
it,
I'm
surprised,
but
this
is
the
idea
that
the
the
the
sort
of
the
special
super
special
adaption
code
for
the
cubelet
talking
to
docker
is
moving
out
of
being
built
in
from
the
cubelet
into
something
that's
actually
existing
outside
of
of
sort
of
core
built-in
kubernetes.
Am
I
getting
that
right
ray?
A
Yes,
absolutely
so
tell
me,
so
you
said
that
you
reviewed
this,
this
blog
post,
but
also
you
know,
there's
been
a
lot
of
lessons
learned
through
sort
of
like
the
journey
of
of
this
particular
deprecation,
because
it
definitely
did
hit
a
lot
of
people
really
hard.
Can
you
give
me
a
little
bit
of
color
in
terms
of
like
you
know
how
people
are
approaching
communicating
this
and
and
this
one
specifically,
you
know
what
are
the?
What
are
the
concerns
and
and
what
is
some
of
the
hangover
from
that
initial
communication.
B
B
In
open
source-
yes,
absolutely
so,
there's
a
tweet
out,
saying:
hey
doctor,
shims
being
deprecated
before
any
big
upstream
communication
or
communication
from
upstream
beef,
so
it
came
out
and
kind
of
became
what
kind
of
went
viral
or
you
know,
kind
of
create
a
created
firestorm
from
it.
So
that
was
so.
Dr
schmidt's
off
was
deprecated
in
1.20,
oh,
it
is,
it
will
be
removed
into
1.24,
and
because
of
this,
we've
had
some
lessons
learned
on
communication.
B
B
A
B
Exactly
and
we've
had
a
few
blogs
published
already
on
kubernetes
dot,
dot
io
about
doc,
shim,
there's,
there's
an
faq
there's
been
a
few
blogs
since
then.
I
think
there's
been
two
before
this
one
and
the
faq.
So
we
are.
We
are
going
to
continue
the
effort
of
communication
with
the
docker
shim
removal.
B
We're
also
going
to
do
some
changes
on
kubernetes
dot,
io
to
make
sure
there's
proper
migration
docks
as
well
on
how
to
actually
migrate
from
docker
ship
to
other
cr
cri
compliance
container
runtimes,
like
container
d
cryo
et
cetera,
so
we'll
have
that
ready.
We
want
to
make
sure
the
that
the
end
users
and
the
whole
community
is
well
aware
of
this,
this
removal
and
how
to
and
how
to
actually
prepare
for
that
removal.
A
Yeah,
I
think
one
of
the
interesting
aspects
of
kubernetes
as
an
open
source
community
is
that
man
there's
a
ton
of
people
using
it
and
they're
not
as
plugged
in
I
mean
they
don't
watch,
you
know
they
don't
necessarily
read
the
blog.
They
don't
follow
the
twitter
accounts.
They
don't
necessarily
you
know,
watch
shows
like
tgik,
and
so
it's
really
hard
to
get
this
message
out
there
and
you
really
gotta
sort
of
broadcast
it
across
all
sorts
of
different.
You
know
channels
and
communication
mechanisms,
and
I
think
you
know
there's
language
barriers
associated
with
it.
A
Also
right,
I
think
you
know
you
know
we're
here
speaking
english
reading
stuff,
that's
english
on
here
and
but
not
everybody
who
who
uses
kubernetes
is
necessarily
a
native
english
speaker.
So
that's
definitely
something
to
to
take
into
account
there.
Also
so
icarus
sort
of
like
so
you
know
this
is
an
interesting
question
here.
Would
it
be
possible
to
add
an
end
of
life
to
the
cube
control
api
versions
command?
So
there
are
capabilities
now,
and
I
don't
know
when
this
is
added
recently,
where
some
warnings
can
be
returned.
A
I
think,
as
a
header
in
in
api
calls
to
kubernetes
and
then
cubecontrol
will
actually
display
those,
and
so
there
is
room
to
start
notifying
users
of
deprecations
from
the
sort
of
you
know,
cluster
user
point
of
view.
I
think
this
particular
one
is:
is
kind
of
deeper
and
buried
deeper
than
that.
So
I
don't
know
if
it
would
show
up.
A
B
A
Oh
yeah,
this
goes
at
it
by
you
know
things
that
haven't
even
been
released
yet
you're
preparing
yeah
awesome,
super
useful,
all
right
great,
let's
see,
hey
carlos
and
alex,
and
the
other
name
there
that
I
that
I'm
not
going
to
try
and
pronounce
that's
in
cyrillic
all
right.
So
let's
keep
going
here.
So
this
is
just
kind
of
fun.
I
love
seeing
this
stuff,
and
I
know
this
came
out
a
while
ago.
The
date
here
is
in
october
2020,
but
multiple
people
have
sent
it
to
me.
A
This
is
somebody-
and
I
think
this
is
you
know-
there's
been
some
examples
of
this
in
the
past
of
folks,
who've
gone
through
and
created
a
kubernetes
minecraft
connection,
and
I
think
in
this
case
I
love
this
like
pigs
are
pods,
cows
are
replica,
sets
chickens,
our
services
and
horses
are
deployments
which
I
think
is
really
cute,
so
it's
always
fun
to
see
this
stuff,
and
you
know
this
is
the.
This
is
the
weird
stuff
that
you
get
when
you're.
You
know
when
you
have
an
api
right.
A
It's
the
magic
of
apis
is
that
people
can
do
things
that
don't
necessarily
make
sense,
but
are
a
lot
of
fun
like
this
yeah
all
right
folks
talking
in
the
chat,
which
is
cool
all
right,
so
the
next
one
here.
So
you
know,
you
know
that,
like
one
of
the
things
that
we're
doing
with
tonzu
is
we're
investing
in
this
tool
set
called
carvel
around
packages,
it's
all
open
source.
I
would
encourage
a
lot
of
folks
to
be
able
to
take
a
look
at
it,
but
there's
this
really
great
blog
post.
A
That
really
goes
into
the
details
around
sort
of
how
carvel
works,
what
we're
looking
at
there,
the
different
parts
of
it
and
how
cap
controller
works-
and
I
think
this
is
you
know
if
you're
interested
all
in
this
and
why
we're
actually
investing
in
carvel
and
what
our
plans
are
there.
This
is
some
great
stuff
to
really
take
a
look
at,
and
I
think
you
know
one
way
that
I
explain
this
to
folks
is
that
you
know
a
couple
things
that
I
like
about.
Carvel.
Is
that
it's
it's?
A
You
know
unix
philosophy
in
terms
of
small
sharp
tools,
it's
a
bunch
of
things
that
are
built
to
work
together
and
so
we're
hoping-
and
you
know
over
time-
we're
going
to
see
more
and
more
tools,
whether
they're
part
of
carvel,
officially
or
not.
That
can
start
to
be
able
to
be
composed
with
this
combined
with
this
stuff,
also
being
with
with
cap
controller,
being
very
git
ops,
friendly
right,
I
think,
having
crds
for
being
able
to
say
I
I
makes
make
it
such
that
version.
A
Xyz
of
something
is
installed
and
having
that
be
supported.
As
plain
old,
you
know,
resources
with
operators
you
know
without
having
to
install
sort
of
outside
clushes
is
something
that's
definitely
front
of
mind
for
what
we're
doing
with
carvel
too.
So,
if
you're
interested
at
all
a
good
resource
there
to
start
digging
into,
I
don't
want
to
belabor
that
too
much
carlos.
I
wonder
if
dagger
will
have
similarities
with
carvel.
You
know
I'm
not
sure
what
they
have
planned
for
dagger.
You
know
I
did.
A
You
know
get
a
little
bit
of
of
a
demo
talking
with
solomon,
about
that,
for
those
who
aren't
familiar
sort
of
like
was
it
dagger.io
is,
is
solomon
hike's,
a
new
company?
The
the
fascinating
thing
here
is
that
you
know
it's
a
lot
of.
It
is
based
on
cue,
and
I
don't
know
I
mean
so
ray.
Do
you
have
an
opinion
on
queue?
Have
you
looked
into
it.
B
A
Yeah
I'd
love
to
know
I
mean
I
love,
I
mean
this
is
part
of
you
know
again
open
apis.
Is
that
there's
so
much
room
for
folks
to
play
around
with
different
ways
of
doing
things,
and
I
think
you
know
at
least
one
of
the
things
we
wanted
to
do
with
carvel
is
separate
out
sort
of
how
do
you
package
and
deploy
ammo
from?
A
So
my
opinion
on
cue
and-
and
I
think
we
did
a
tgik
on
it-
I
know
I
did
one
live
at
cubecom.
One
point
is,
I
think
it's
awesome.
I
love
the
work.
That's
going
on
that
the
type
system
is
really
interesting.
I
worry
for
this
class
of
of
solutions
and
I
think
q
is
there.
I
think
json.
It
is
also
there
it's
just
a
different
way
of
thinking
and
looking
at
things
and
so
for
a
lot
of
folks
who
are
not.
A
You
know
deep
into
this
world,
don't
necessarily
have
a
more
formal
computer
sciencey
background,
the
the
the
sort
of
the
functional
programming
aspects
of
q,
I
think,
can
really
give
people
pause,
and
I
think
we
see
this
with
with
rego
with
with
oppa
right.
It's
not
a
procedural
way
of
doing
things.
A
Oppa
and
rego
is
really
a
sort
of
a
constraint
language
and
when
you
view
it
through
that
lens,
it
makes
perfect
sense,
but
most
people
view
it
as
a
procedural
language
and
they
really
get
themselves
twisted
around
the
around
the
axle
with
that,
and
I
think
there
might
be
some
similar
issues
with
q.
I
see
similar
stuff
with
nicks
and
the
way
that
people
use
use,
nics
and
program
that
a
lot
of
great
properties,
really
cool
technology
and
also
holy
moly.
A
This
is
a
whole
different
world
that
is
kind
of
alien
to
a
lot
of
folks.
So
that's
my
take
on
on
cue
and
I
assume
that
it's
going
to
be
interesting
to
see
how
how
dagger
adapts
a
bunch
of
this
stuff,
yeah
ytt,
I
feel,
is
missing
something
about
ux.
I
mean
the
team
would
love
to
hear
about
that
carlos
and
so
you
know
feel
free
to
to
reach
out
and
give
them
that
feedback.
I'm
happy
to
connect
you
all
right.
A
A
If
we
had
v6
support
like
all
this
overlay
stuff,
you
know,
would
would
really
start
to
sort
of
fade
to
the
background,
because
we
could
actually
do
direct
addressability
right,
because
I
think
so
much
of
the
overlay
stuff
is
really
downstream
of
the
fact
that
you
don't
have
sort
of
unlimited
ip
addresses
with
with
v4
and
at
the
time
the
the
cloud
providers
didn't
have
great
v6
support.
I
think
you
know
amazon
at
that
time.
A
You
could
have
a
public
v6
endpoint
with
with
elb
similar
internally
with
with
google,
but
actually
having
v6
support
internally
was
just
not
well
supported,
and
I
remember
being
bitterly
disappointed,
because
the
first
editions
of
v6
support
for
ec2
were
very
limited.
You
could
have
individual
ip
addresses
up
to
like
20
of
them,
but
what
you
couldn't
get
is
a
subnet
assigned
to
your
ec2
instance,
which
is
really
what
we
needed
to
be
able
to
do
the
networking
stuff
for
for
kubernetes.
A
So
I
think,
there's
sort
of
been
a
little
bit
of
a
chicken
and
egg
with
sort
of
having
the
underlying
platform
support,
v6
and
then
having
kubernetes
evolve
to
support
it
also,
but
it's
really
great
to
see
to
see
this
stuff
coming
together,
so
yeah.
So
congratulations
to
the
teams
on
that.
Any
comments
on
that
ray.
B
Yeah
I'll
talk
about
some
of
the
backstory
as
well
with
how
services
how
they
used
to,
like
you,
had
to
have
a
service
for
an
ipv4
and
you'd
have
a
service
for
ipv6.
So
you
had
a
service
per
ip
family,
and
that
was
refactored
and
I
forgot
what
version
it
was.
But
yeah
I'll
talk
about
a
little
bit
more.
When
we
go
into
like
the
enhancements
for
123.
A
And
I
think
this
is
something
that,
like
it's
a
lesson
that
I've
seen
again
and
again-
and
I
think
you
know
I
tr-
we
tried
to
avoid
it
with
kubernetes.
But
apparently
we
failed.
Is
that
any
time
where
you
have
a
singleton,
it
almost
always
is
going
to
come
and
bite
you
in
the
butt?
At
some
point
right-
and
I
think
you
know-
there's
definitely
places
in
kubernetes,
especially
around
networking,
where
there
was
an
assumption
built
in
earlier
that
apod
has
a
single
ip
address
and
you'll
see
that
show
up
in.
A
There
is
only
one
of
something
like
anytime.
You
have
one
of
something
you're
going
to
need
n
of
something
it's
almost
like
a
truism
in
this
world
and
we
did
it
in
a
bunch
of
places,
but
I
think
in
networking
it's
one
place
where
we
missed
it
and
it's
taken
a
long
time
to
be
able
to
actually
get
to
the
other
side
of
that
yeah.
Carlos
is
saying
that,
like
with
private
v4,
there's
a
lot
that
you
can
do
today
and
you
know
ipv6
isn't-
is
niche.
A
I
I
would
agree
with
that,
but
like
it's
not
unusual
to
have
companies
running
out
of
ten
ten
eight
space
right-
and
I
think
you
know
you
start
seeing
them
start
to
steal.
You
know
you
know
private
vp,
you
know
v
force
base
from
some
of
the
carrier
blocks
and
all
that
you
start
seeing
some
crazy
stuff,
because
you
know
hey,
like
you
wanna,
maybe
you
know
give
a
you
know
a
subnet
to
every
node
and
then
make
that
directly
routable.
A
And
then
you
have
a
bunch
of
kubernetes
clusters
and
how
many
nodes
do
you
have
pretty
soon?
You
start
eliminating
huge
chunks
of
your
ip
space,
and
so
I
think
you
know
you
know,
I
know
like
big
production
footprints.
People
are
very
careful
about
how
they
allocate
you
know
v4
space
and
it's
easy
to
get
it
wrong
and
it's
painful
to
change.
I'm
sure.
As
a
field
engineer,
you've
seen
some
of
that
stuff
right
right.
I've.
B
A
A
Yeah,
so
that's
one
of
the
things
we're
going
to
be
getting
to
here
and
then.
Finally,
I
just
want
to
give
a
personal
shout
out
with
shout
out
to
to
liz
rice
who
she
was
she's.
A
I
surveillant
now
was
at
aqua
has
been
on
the
toc
for
the
cncf.
You
know
for
three
years
now
and
I
worked
with
her
when
I
was
on
the
toc,
and
she
you
know
amazingly
dedicated,
really
did
a
great
job
of
of
helping
to
lead
and
really
brought
it.
A
I
think
you
know,
there's
you
know
with
things
like
the
toc,
and
I
think
you
know
we
see
this.
You
know
with
the
with
the
steering
committee.
Also
not
everybody
brings
the
same
level
of
commitment
to
these
types
of
positions.
There's
a
lot
of
folks
that
view
it
as
a
as
a
position
to
be
held,
not
a
job
to
be
worked,
and
you
know-
and
I
can
definitely
say
with
respect
to
liz.
A
She
took
it
seriously
and
definitely
viewed
it
as
a
as
a
job
to
be
worked,
and
so
you
know
a
huge
thank
you
and
shout
out
to
her
for
for
her
three
years
of
service
for
the
cncf
on
the
toc
all
right.
So
that
is
the
notes
that
I
had
did
anybody
else
have
any
other
sort
of
things?
Oh
and
then
the
the
let's
see
if
we
can
do
a
quick
google
search
here,
cubecon
virtual
deal
ten
dollars.
A
A
A
Register
for
virtual
cubecon
here
we
go
all
right,
so
it
looks
like
maybe
the
deal
actually
passed,
but
but
there
we
go
all
right.
Well,
let's
go
ahead
and
get
started.
What
I'm
gonna
do
ray
is
I'm
gonna
go
through
stop
sharing
so
that
they
can
see
us,
but
if
you
want
to
see
the
notes
and
some
of
the
topics
that
we're
going
to
be
hitting
feel
free
to
pull
that
up,
it's
at
the
tgik
dot,
io,
slash
notes
for
all
the
folks
watching.
A
Also,
if
you
want
to
you
can
these
notes
are
always
available
after
the
fact
that
I'll
put
it
down
here
at
tgik,
dot,
io,
slash,
notes,
dash
180,
so
that
should
that
should
work.
Also,
that's
a
that's!
A
stable
link,
that'll
work
over
time,
so
there
we
go
all
right.
So
I'm
going
to
stop
sharing
this
and
take
it
away
ray.
What
are
the
things
that
you?
Okay?
A
Let
me
start
off
by
saying
thank
you
for
doing
the
work
of
being
a
a
release,
lead
like
talking
about
liz,
doing
the
stuff
for
the
cnc
toc.
This
is
not
a
position
to
be
held.
This
is
a
job
to
be
worked,
and
it
very
much
is:
can
you
tell
me
a
little
bit
about
you
know
what
it
means
to
actually
do
one
of
these
things?
What
does
it
mean
to
be
a
release
lead?
A
B
Yeah
so
I'll
start
off
with
the
release
team
first,
so
the
release
team
is
a
group
of
volunteers
from
the
community,
we're
from
all
different
organizations
and
companies.
Small
companies,
big
companies,
I'm
from
susa
byway
rancher.
We
have
students
as
well.
It's
made
up
of
people
who
are
experienced
contributors
to
the
project,
to
the
project
or
brand
new
contributors
as
well.
So
the
team
itself,
it's
responsible
for
the
day-to-day
operations
on
on
creating
a
release
and
organizing
release
and
coordinating
release,
and
what
that
means
means
many
different
things
I'll
go
and
give
you.
B
Yeah,
absolutely
and
and
the
lead
itself
myself
for
1.23
and
james
lavrak
from
jet
sack
he's
really
sleep
for
1.24,
we're
pretty
much
we're
pretty
much
responsible
for
up
all
the
release
activities
and
and
have
that
be
that
ultimate
accountable
person
for
all
the
release.
Tasks
with
that
there's
seven
different
roles
in
a
release
team,
one
being
the
lead
I'll,
just
go
through
each
one,
just
a
little
briefly.
B
So
this
part
of
the
release
team
enhancements
enhancements
is
the
tracks
and
guides
enhancements
that
are
that
targeting
release
they
don't
choose
which
enhancements.
That's
gonna,
be
part
of
part
of
the
release.
That's
probably
one
of
the
misconception
about
one
of
being
on
the
release
team.
Is
that
we're
actually
choosing
things
and
we're
actually
making
the
decisions?
B
It's
not
we're
actually
helping
guide
and
aid
and
and
organize
things
so
that
the
process
and
the
release
process
itself
kind
of
goes
through
as
smooth
as
it
can
so.
Enhancements
helps,
track,
enhance
and
ask
mr
that
are
targeting.
Release
enhancements
are
worked
on
by
special
interest
groups
of
kubernetes
or
cigs,
so
each
so
there's
many
different
cigs
and
they
opt
in
for
what
enhancement
they
want
to
be
part
of
a
release
if
it's
graduating
to
ga
or
going
to
beta
or
introduces
alpha,
so
that's
enhancements
in
a
nutshell.
B
Their
ci
signal
that
tracks
that
that
track
ci
to
make
sure
if
there's
make
sure
that
the
quality
of
the
release
is
great
and
they
they
monitor
the
boards.
If
something,
if
there's
suddenly
goes
an
error,
they
make
sure
that
it's
triaged
to
the
right
sig
example.
You
know
we
in
the
past
we've
had
some
issues
with
some
some
tests
with
like
windows
and
some
storage.
So
they
make
sure
that
sig
storage
is
in
sick
windows,
know
about
that
issue
and
get
that
resolved.
There's
bug
triage,
which,
but.
A
There's
a
certain
amount
of
like
you
know:
if
there's
an
enhancement
and
people
want
to
make
it
and
it's
just
not
coming
together
and
it's
just
not
landing,
there
is
a
role
for
the
release
team
to
be
like.
If
we're
going
to
keep
the
schedule
this,
isn't
you
know
this
isn't
coming
together?
You
know
right.
B
Like
we
do
make
sure
that
all
the
all
the
code
pr's
are
in
and
make
sure
all
the
tests
are
valid,
but
now
you
know
also
they're
passing
to,
and
there
are
plenty
of
times
where
we
do
have
to
remove
a
enhancement
from
a
from
a
release
and
they
can
file
for
exceptions
as
well
in
case
they
want
these.
If
they
know
exactly
like,
we
just
need
one
more
day
to
work
on
this
pr,
and
then
we
could
take
that
into
account
and
part
of
that
part
of
that
decision
making.
A
All
right
well,
and
so
I
know
in
the
notes,
you
know
you
put
some
links
there
and
we
can
go
into
this,
maybe
a
little
bit
after
we
go
through
sort
of
your
favorite
enhancements
and
sort
of
what
people
need
to
know
about
the
release.
But
you
know
you
have
sort
of
about
the
release
team
and
how
you
can
you
know,
get
involved
and
all
you
know
in
in
the
various
roles
and
all
that-
and
I
think
you
know
we're
always
looking
for
for
fresh
faces
and
new
ideas
and
new
energy
right.
B
Yeah
we're
we
always
love
new
new
contributors
and
just
the
whole
project
in
general.
The
release
team
is
great,
there's
actually
a
structured
process
to
help
you
become
a
contributor.
I
like
it,
helps
you
get
those
pr's
in
you
know
it
actually
gives
you
a
look
into
the
landscape
of
all
those
repos.
They
could
be
very
confusing
at
first.
I
know
it
was
very
confusing
for
me,
so
it
kind
of
gives
you
that
guidance
and
you
have
a
mentor
like
they're.
B
A
That's
awesome,
yeah.
No,
it's
a
great
way
for
folks
to
get
involved
so
yeah.
If
anybody
watching
you
know
live
now
or
you
know
catching
the
replay
of
this
wants
to
get
involved.
There's
the
resources
there
in
the
notes-
and
I'm
sure
you
know
ray,
wouldn't
mind
if
you
reached
out
and
and
and
asked
about
it-
and
you
know
you
know,
he
can
definitely
point
you
in
the
right
direction
there
all
right.
Let's
see
carlos
is
saying
that
that
he
is
a
shadow
for
the
release,
notes
for
124.
A
A
Yeah
I
know,
like
the
you
know,
just
early
on
looking
at
the
the
history
of
the
project.
It's
always
been
a
struggle
to
actually
filter
through
all
the
pr's
and
figure
out.
What
are
the
changes
that
really
matter
to
folks
and
like
things
like
in
a
pr
you
can
like
say
hey?
Is
this
release
note
relevant
or
not,
but
even
then
like
being
able
to
actually
pull
out
which
of
those
things
matter?
How
do
you
categorize
them?
How
do
you
actually
make
it
be?
A
You
know
relevant
to
you
know
a
particular
area
but
predict
particular
sig
or
persona
in
terms
of
like
hey.
Are
you
using
kubernetes
you're
administrating
kubernetes,
like
the
docker
shim
stuff,
if
you're
just
a
kubernetes
user,
you
probably
don't
care
about
docker
shim,
it
probably
won't
impact
you,
but
if
you're
a
kubernetes
administrator,
it's
definitely
something
that
may
impact
you
right,
yeah
all
right!
A
Well,
okay!
So,
let's,
let's,
let's
start
going
down
your
your
favorite
enhancements
here.
This
is
a
list
that
you
sent
me.
You
know
heading
up
into
this,
but
you
know
feel
free
to
add
more
stuff
or,
like
you
know,
reorder
these
things
in
any
way.
That
makes
sense
to
you.
What
do
you
want
to
start
with.
B
B
This
last
and
the
last
kubecon
in
los
angeles
in
2021.,
dual
stack
was
actually
introduced
as
alpha
115.,
like
I
mentioned
before,
it
was
refactored
in
1.20.
It
was
because
of
that
service
you
have
to
have
a
service
for
ip
family,
so
it
was
refactored
in
1.21.20
kind
of
went
through
the
alpha
beta,
the
stable
phase
again
so
one
so
120.
The
service
api
did
support
dual
stack
and
then
now
it's
stable
in
1.23.
A
A
A
You
know,
depending
on
sort
of
you
know
whether
you're
talking
to
v4
or
v6,
and
that
ends
up
being
being
a
pretty
big,
pretty
big
change
for
sure,
and
I
think
there's
also
a
lesson
here
about
how
careful
kubernetes
is
in
terms
of
taking
something
to
ga.
If
you
know-
and
I
think
this
is
a
difference
between
open
source
and
products
with
products,
it's
like
well,
a
customer
says
we
need
to
have
v6.
A
B
Yeah
and
the
whole
getting
things
right
as
well.
I
just
want
to
tag
on
this,
so
there's
actually
a
production
writing
this
review
process
that
that
is
now
part
of
the
release
team
process,
so
it
is
required
for
for
for
release.
That
means
that
enhancements
going
into
release
has
to
be
reviewed
by
a
few
selected
folks
who
have
you
know
who
who
are
part
of
the
production,
readiness,
team
or
production
readiness
review
team,
and
they
make
sure
that
those
enhancements
are
ready
or
production
ready.
So.
A
Yeah
exactly-
and
I
think
you
know
this
was
some
of
the
ideas
when
we
were
interested
in
the
kept
process.
Is
that
like
pre-cap,
it
was
just
like
chaos
in
terms
of
what
made
it
into
a
release,
and
we
wanted
to
start
saying
like
do
we
have
like
one
place
where
you
can
go
to
get
the
idea,
and
I
think
you
know
again
the
maturity
of
the
project
right.
A
I
think
you
know
a
lot
of
people
have
a
love-hate
pro.
You
know,
relationship
with
caps
right,
there's
a
lot
to
be
done,
there's
a
formality
to
it,
but
that
also
means
that,
like
hey,
you
know
if
we
ship
something
and
it's
not
ready.
If
we
break
something
on
accident,
that's
definitely
you
know
something
that
our
users
notice
and
and
we're
past
the
point
where
we
can
just
yellow
stuff
in
for
sure
that's
how
we
got
to
where
we're
at
right
now.
B
B
B
Pod
security
and
mission
controller
is
the
replacement
of
pod
security
policy,
so
that
is
now
beta
in
1.23.
There
is
a
great
blog.
I
should
probably
link
it
with
a
little
tutorial
as
well
on
how
to
implement
a
pod
security
mission
controller.
So
it's
it's
it's
another
mission
controller
where
that
can
emit
or
deny
pods
from
running,
based
on
what
the
user
states
on
the
there's
based
on
the
pod
security
standard.
That
is
that
defines
that
the
user
defines
and
there's
three
different
pod
security
standards
that
you
could
do
as
well.
B
So
it's
privileged
baseline,
restricted,
but
one
of
the
big
changes-
I
guess
it's
or
this
is
it's
applied
to
the
namespace
level,
with
the
label
on
the
namespace.
So
if
the
namespace
itself-
let's
say
you
said
it's
you
want
it
all.
Pods
can
be
privileged.
So
that's
one
thing:
that's
introduced.
It's
it's
applied
to
the
namespace
level,
with
the
podcare
mission
controller
and
with
plot
security
standards.
A
Okay,
whereas
like
before,
I
think
folks
try
to
get
super
fine
grain
and,
like
you
know-
and
this
is
something
that
I
think
you
know
it
takes
a
while
for
people
to
really
truly
understand-
is
that,
like
the
the
security
sort
of
cordon
really
is
the
name
space
for
a
lot
of
the
stuff
in
the
control
plane?
I
mean
going
finer
grain
than
that.
A
There
may
be
a
couple
places
where
you
can
do
it,
but
it's
really
hard
to
get
too
much
more
fine
grain
than
the
than
the
name
space
from
a
security
point
of
view.
Yeah
now
do
you
have?
Can
you
summarize
for
folks-
and
this
may
be
putting
you
on
the
spot?
Like
you
know,
there
has
been
a
saga
similar
to
the
docker
shim
stuff
around.
You
know,
pod
security
policies,
the
you
know
the
the
you
know
they
were
released.
They
were,
I
believe,
never
made
it
past
alpha.
A
But
at
the
point
in
the
project,
people
are
we
need
this,
so
a
ton
of
people
started
using
it
and
it
was
a
especially
praying
painful
thing
to
back
away
and
say:
hey
this
isn't
the
right
solution,
even
though
alpha
meant
that
that
was
still
possible
according
to
the
deprecation
policy
practically
so
many
people
have
taken
a
dependency
on
it.
This
was
a
particularly
painful
transition
here.
Do
you
have
I
mean?
Can
you
summarize
for
folks
why
you
know
psps
were
deprecated
and
why
the
pod
security
admission
stuff
is
is,
is
better.
B
B
B
And
so
I
know,
there's
that's
one
of
them,
that's
one.
I
hear
the
most
from
that's
from
internally
within
the
project,
so
they
wanted
to
place.
You
know
we
want
to
do
things
correct,
so
pod
security
mission
controller
is,
is,
was
or
is
that
and
I
know
folks
use
third
party
emission
controllers.
I
mean
there's
open
or
apa
gatekeeper,
there's
kyberno,
which
you
know
a
lot
of
people
from
my
work
work
on
as
well,
so
there's
different.
A
Yeah
lots
of
ways
to
skin
this
cat
for
sure
yeah.
I
think
the
thing
for
me
with
pod
security
policies
is
that,
like
it
was
sort
of
an
explicit
schema,
and
it
was
clear
that,
like
there
was
always
going
to
be
new
things
to
lock
down
and
new
ways
to
evolve
that,
and
it's
like
you
know
it
didn't
feel
like
it
was
going
to
evolve.
A
Well,
as
we
added
more
and
more
things
that
you
wanted
to
lock
down
with
the
with
the
platform
over
time
right,
I
think
you
know
that's
that,
for
me
was
like
okay.
What
does
this
look
like?
After
you
know?
We
play
out
another
10
versions.
Is
the
pod
security
policy
going
to
be
like
300
entries
long
to
be
able
to
do
anything
right?
You
know.
I
think
that
was.
That
was
for
me
what
I
saw
happen
in
there.
So
yeah.
B
Yeah,
so
we
have
a
new
cleanup
controller,
it's
a
bit
of
a
garbage
collection.
So,
as
we
saw
in
the
chat,
there's
some
issues
when
a
job
finishes,
those
pods
remain
yeah,
there's
ips
virtual
ips,
still
there
so
there's
a
new
new
controller
called
the
ttl
controller.
It
cleans
up
jobs
of
contacts
and
pods
of
jobs,
so
that
went
to
ga.
So
it
means
that
you
have
the
ability
to
clean
up
those
jobs
and
pods
after
they
finish,
there's
a
new
field.
B
It's
it's
in
spec
for
the
for
the
job
like
ttl
seconds
after
finish,
so
that
needs
to
be
set.
So
you
you
determine
how
many
seconds
after
finish
and
the
controller
watches
all
the
jobs
and
what
and
compares
the
ttl
seconds
after
finish
with
the
last
transition
time,
and
if
it's
greater
than
now
deletes
the
that
job
or
pot
of
jobs.
A
A
Know
like
was
there
any
talk
of
actually
having
more
generic
ttl
controller,
because
I
know
like
one
of
the
things
that
we'll
see
you
know,
you
know
a
not
uncommon.
Pattern
would
be
hey.
You
have
a
cluster
doing
ci
cd
stuff
and
you
start
to
bring
up
some
resources
or
a
name
space
per
run
right
and
you
want
to
be
like
hey.
You
know
this
name
space
under
no
circumstances
should
it
be
around.
A
B
A
B
A
B
All
right
hpa,
the
horizontal
pod,
auto
scaler
v2
api
is
ga
that
brings
in
the
ability
to
support
custom
metrics,
multiple
metrics.
I
do
want
to
make
a
note
that
the
v1
api
is
not
being
deprecated
just
that
you
could
use
the
v1.
It
could
also
use
the
v2
there's
just
no
plans
currently
for
the
v1
api
being
deprecated
might
in
the
future.
Just
want
to
make
note
of
that
yeah.
So
there's
a
new
behavior
field,
you
should
look
into
it's
called
behavior
to
to.
A
Use
this
so
this
is,
I
mean
so
so.
The
fact
that,
like
we're
going
to
have
multiple
versions,
running
concurrently
is
really
interesting,
and,
and
that's
going
to
be,
it's
going
to
be
interesting
to
see
how
that
pattern
plays
out
and
whether
that's
something
that
influences
new
features
being
introduced
in
the
in
the
future.
A
You
know,
as
we
look
so
say,
like
the
gateway
apis
are
on
networking
right.
How
are
we
going
to
actually
be
able
like
clearly
like
there's
a
lot
of
of
sort
of?
You
know
back
to
the
drawing
board,
thinking
and
some
really
interesting
ideas
coming
from
that,
but
clearly
we're
not
going
to
want
to,
like
you
know,
deprecate
a
lot
of
networking
apis
all
of
a
sudden
that'd
be
hugely
disruptive
for
folks.
A
You
know
my
advice
on
you
know:
I'd
love
to
get
your
opinion
on
this
ray
my
take
on
it
is
that
for
so
many
folks,
the
complexity
of
doing
sort
of
metrics,
driven,
auto
scaling
may
not
be
justified
and
that
you
can
get
away
with
having
something
that
just
sort
of
like
based
on
the
diurnal
cycle,
automatically
scales
things
up
and
down.
Like
you
just
have
sort
of
a
time
based
auto
scaler,
you
know
you
can
you
could
like
there's
a
cheap
and
cheerful.
A
B
A
Oh
I'm,
gonna
like
based
on
sort
of
like
cpu
usage
or
based
on
request
rate,
I'm
gonna
scale,
and
it's
very
easy
like
if
the
if
the,
if
the
the
database
ends
up
being
your
bottleneck,
that
you
end
up
scaling
the
front
end,
and
it
just
makes
matters
worse,
because
you're
now
actually
creating
sort
of
a
larger
fire
hose
pointed
at
sort
of
that.
So
I
think
that's
one
of
the
the
hardest
parts
with
with
with
auto
scaling
is
making
sure
that
you
know
it's
it's.
A
B
A
I
don't,
I
think
you
know
the
the
original
so
like
so
borg
supports
doing
in
place
vertical,
auto
scaling,
and
so
what
you
end
up
doing
is,
is
you
know
the,
and
especially
if
you
need
to
shrink
something,
you
can
always
shrink
something
and
actually
give
back
pilot
you
know,
but
opportunistically
you
can.
Then
actually,
you
know,
increase
the
resource
usage
of,
say.
A
pod
and
board
speak
without
actually
restarting
the
pod
right,
and
I
think
the
the
the
dangerous
thing
with
with
vertical
auto
scaling
is
that
to
impact
it.
A
A
You
know
different
health
checks
and
availability
checks,
readiness
checks
all
set
up
well
and
you're
doing
things
like
disruption,
budgets
and
such
I
think
it
can
probably
work
really
well,
but
you
know
that's
a
big
if
right,
I
think,
there's
so
many
applications
that
are
in
transition
where
it's
like
they
can
take
a
little
bit
of
disruption
a
little
bit
of
restarting,
but
if
you
hit
them
too
hard,
they
fall
over,
especially
when
you're
viewing
things
like
hey.
I
like.
A
Oh,
it
takes
me
10
minutes
to
start
up,
because
I
have
to
prime
all
my
caches.
That
type
of
thing
can
can
really
can
really
impact
you.
Now.
Carlos
is
saying
that
the
the
the
the
difference
here
swap
memory-
I
don't
know
man
swap-
is
dangerous
right,
because
what
you
end
up
seeing
is
that
the
the
performance
you
know
with
and
without
swap
is
it's
like
a
different
machine
that
you're
running
on
right?
A
It
goes
from,
like
you
know,
you're
running
at
this
thing
and
as
soon
as
you
hit
swap
your
performance
drops
through
the
floor
and
and
that
doesn't
necessarily
you
know,
end
well
for
anybody,
and
so
it's
not
uncommon
in
these
cases
to
be
like
look
if
you
need
swath
right,
you're
you're
already
in
a
failure
mode
and
you
need
to
actually
go
up
and
fix
something
so
yeah.
So
prasad
says
that
there's
in-place
vpa.
A
I
know
we
talked
about
that
for
a
long
time,
I'm
not
totally
up
on
what's
going
on
there,
but
I
think
vertical
scaling
in
place.
That's
a
little
bit
of
the
holy
grail,
but
that's
a
hard
thing
to
be
able
to
do
because
now
you're
going
through
and
you're
like
hey,
we
have
to
plumb
that
all
the
way
down
to
the
cri
to
be
able
to
start
doing
that
stuff.
It's
a
much
more
difficult
feature
than
doing
it.
A
Just
at
the
sort
of
the
control
plane
level,
similar
things
for
any
sort
of
a
live
migration.
Right
like
like
these
things
go
hand
in
hand.
If
we
had
live
migration
of
pods
with
in
place
vertical,
then
it's
like
well
move
this
thing
over
here
where
there's
room
and
then
scale
it
up.
Eventually,
maybe
we
want
to
get
on
that,
but
there's
a
race
between
supporting
that
versus
having
the
apps
be
more
flexible
and
be
more
resilient
and
sort
of
being
built.
B
A
Think
that
there's
room
for
more
standard
sets
in
terms
of
advice,
because
I
think
when
people
are
writing
their
initial
pods,
it's
like
how
much
ram
do
you
need
how
much
cpu
and
like
most
application
devs
are
like.
Oh
no
give
it
like.
You
know
four
cpus
and
four
gig
right,
that's
probably
enough
and
then
you'll
find
that
they
use
like
a
fraction
of
that.
So
I
think,
being
able
to
collect
history
and
then
give
advice.
Even
if
you
don't
apply
it
automatically.
A
That's
definitely.
I
think
something
that
that
that
definitely
makes
a
ton
of
sense,
and
I
so
I
think,
there's
there's,
there's,
there's
definitely
room
for
more
tools
to
be
more
widely
deployed
that
are
between
you,
know,
yoloing
and
guessing
and
overestimating
and
then
automatically
applying
it,
which
is
what
you
get
with
vpa
yeah.
The.
A
That's
yes,
yeah
yeah
and
I
think
part
of
the
problem
is
that,
like
what
defines
an
application
right,
I
think
sometimes
people
will
key
it
based
on
the
on
the
the
underlying
container
image
right.
But
you
can
run
the
same
container
image
in
very
different
ways.
Maybe
it's
the
deployment,
maybe
it's
a
set
of
labels.
A
Maybe
it's
the
container
image
plus
the
plus
the
the
the
name
space,
but
it
ends
up
being
actually
difficult
to
be
able
to
say,
like
what
are
the
set
of
characteristics
that
I
want
to
group
so
that
I
can
actually
then
predict
and
profile
this
stuff
over
time,
because
we
don't
like
we
in
some
ways.
Kubernetes
is
too
flexible
in
terms
of
being
able
to
run
a
bunch
of
things.
A
A
B
Yeah,
so
next
one
is
ephemeral,
containers
goes
to
beta,
and
so
a
femoral
container
supports
a
new
command
called
keep
control,
debug,
which
is
another
enhancement,
but
with
the
thermal
containers,
you
can
launch
any
thermal
container
within
a
running
pod
and
share
those
pod
name
spaces.
So
the
perp,
the
intention
of
ephemeral
containers,
is
to
observe
those
other
containers
in
the
pod
and
to
debug
it.
It's
different.
B
You
know
between
cube
control,
I
mean
you
could
always
back
into
into
a
container,
but
not
just
starting
a
process,
but
with
keep
control
debug,
you
could
start
a
new
pod
and,
and
you
could
do
all
your
troubleshooting
there.
This
is
one
kind
of
one
of
my
favorites,
because
I
do
tend
to
troubleshoot
quite
a
bit
so.
A
So
I
haven't
actually
had
a
chance
to
sit
down
and
play
with
ephemeral
containers,
so
I
want
to
ask
you
about
this:
a
little
bit
so
you're
launching
another
container
in
the
pre-existing
pod
right.
Yes,
okay,
I
think
you
know
some
of
the
the
the
reasons
behind
this
is
that,
as
we
look
towards
sort
of
you
know,
rootless
and
minimalist
containers,
you're
not
going
to
have
a
lot
of
the
tools
you
may
not
even
have
a
shell
on
there
to
be
able
to
actually
exec
into
and
do
so.
A
You
want
to
be
able
to
have
your
your
ephemeral
container,
bring
the
tool
set
with
it
versus
assuming
that
the
tool
sits
already
there
and
installed
in
the
container
that
you're
trying
to
debunk.
So
that
all
sounds
great,
but
I
guess,
like
you
know,
do
they
generally
work
with
sort
of
a
combined
process?
Namespace.
A
B
So
I
actually
haven't
tested
it
out
since
it's
been
out,
but
it
does
have
this.
Of
course
it
has
a
shared
network
name
space
and
it's
name
name
space
depending
on
what
volume
is
it
bounce
on
it
as
well?
I
don't
know
actually
what
ability
happened
to
introspect
into
okay,
those
file
systems,
but
I
do
also
want
to
say
that
so
do
some
work
with
six
security
as
well,
so
to
want
to
introduce
that
this
also
adds
in
possibly
another
attack
vector
I
mean
someone
could
also
debugging.
B
You
could
always,
you
know,
do
a
key
patrol
debug
on
your
pod
and
then
you
have
another
attack
vector
so
don't
want.
Do
you
want
to
state
that
as
well?
I
know
it's
great
for
troubleshooting.
I
love
it.
I'm
going
to
love
it
for
troubleshooting.
I
haven't
had
a
chance
to
actually
to
to
test
it
since
since
december
yeah.
So
that's.
A
A
good
point
I
mean
so,
like
I
mean
like
oh
man,
this
stuff
is
fascinating.
I
haven't
been
involved
in
discussions,
but
it
would
be.
I
would
love
to
see
like
a
capability
of
like.
Oh,
if
you,
if
you
attach
an
ephemeral
container,
that
adds
a
new
sort
of
like
label
onto
the
pod
and
then
you
can
have
something
that
says
like
well.
You
know,
you
know
we
don't
want
any
of
these
tainted
pods
to
be
able
to
live
for
too
long,
because,
like
you
know,
somebody
might
have
screwed
them
up
as
they
debug.
A
A
Yeah,
so
let's
see
a
couple
of
comments
here,
so
some
questions
around
sort
of
like
a
vmotion
sort
of
live
migration.
Stuff.
I
don't
know
how
widely
that's
you
know
deployed.
I
think
there's
definitely
people
playing
with
that.
But
let
me
tell
you:
that's
that's
hard
and
it's
hard
from
the
storage
point
of
view
and
and
networking
right
so
doing
a
movement
and
then
making
sure
that
both
the
network
and
the
the
storage
can
follow.
A
It
is
is
not
an
easy
problem
and
I
think
you
know
when
we
look
at
cni,
roughly
there's
two
different
types
of
cni,
there's
cni
that
actually
has
a
pool
of
ip
addresses
per
node,
and
this
works
really
well
with
ipv6,
because
you
know
a
lot
of
times.
You
can
assign
a
whole
subnet
to
that
node
and
that
node.
Then
it
has
its
own
sort
of
space
and
then
there's
cni's,
where
the
ip
addresses
aren't
pre
allocated
to
nodes,
and
so
there's
advantages
and
disadvantages
to
these.
A
If
they're
not
pre-allocated,
you
can
be
more
efficient
in
terms
of
ip
space
usage,
but
it's
slower
to
be
able
to
allocate
an
ip,
because
you
have
to
go
to
some
ipam
system
and
say
give
me
an
ip
and
assign
it
to
this
thing
and
make
sure
everything's
routed.
Whereas
when
you
sort
of
pre-allocate
ips
to
a
node,
it
can
be
a
lot
more
efficient
to
be
able
to
get
something
up
and
running
fast.
A
No
somebody
was
asking
oh
conrad
was
asking
here:
are
there
tools
for
making
better
app
estimates
of
resources
at
this
time?
I
know
that
there
are
some
systems
out
there
that
will
do
some
profiling
and
help.
You
sort
of
you
know,
make
guesses
and
I
think
you
can
run
the
vertical
pod,
auto
scaling
in
a
sort
of
advise
mode,
and
I
I
think
I
did
a
tga
tgik
on
it.
I
know
I
played
with
at
one
point,
but
I'm
wondering
like
ray
or
other
folks
in
the
chat.
Do
you
have
experience
with
this?
B
A
Yeah,
I
think
it's
probably
a
little
bit
dated
now,
but
if
you
go
is
it's
tgik
126
is
where
we
did
the
that's
where
we
did
the
vertical
pod,
auto
scaling
and
let's
see
I'm
loading
this
up
now
and
checking
it
out
yeah.
It
was
me
doing
this
and
I
believe
you
know
this
is
where
you
start
looking
at
the
metric
server
and
all
that.
A
So
it
starts
getting
into
a
lot
of
that
and
if
I
remember
correctly,
there
is
an
advise
mode
there,
so
yeah
so
yeah
conrad.
I
I
encourage
you
to
go
check
that
out
because
there's
at
least
something
there
and
I'm
sure,
there's
community
projects
out
there
too,
that
that
go
beyond.
What's
there
yeah
all
right
and
then
folks
are
talking
about
epbf
and
using
that
for
debugging
yeah.
A
Definitely
you
can
get
a
lot
of
information
there,
but
like
at
some
point
nothing's,
you
know
like
you
want
to
have
a
shell
where
you
can
do
ps
and
see
what's
running,
and
it's
it's
somewhat
difficult
to
do
that
through
a
lot
of
this
sort
of
outside
eppf
based
stuffs
in
terms
of
being
able
to
to
drive
into
that
all
right.
Let's
keep
moving.
We
got
two
more
items
on
your
list
here
right.
We
can
make
it
through.
B
All
right
sounds
good.
Next
one
is
the
auto
reboot
pvcs
from
staple
sets,
which
is
now
alpha.
So
this
is
part
of
that
whole
garbage
collection,
kind
of
theme
I
have
so
this
is
when
you
have
when
you
have
a
simple
sets,
and
you
have
a
and
those
those
pods
and
staple
sets
have
have
a
pvc
and
you
typically
when
you
do
staple
sets
those
pvcs
are
still
around.
A
And
by
removing
the
pvc,
then
that
may
actually
then
cause
the
underlying
volume
to
get
deleted
right,
absolutely
yeah,
okay,
yeah,
because
I
think
originally
with
stateful
set.
There
was
definitely
a
lot
of
paranoia,
and
this
is
some
of
what
makes
stateful
sets
annoying
is
that
you
can
get
them
stuck
in
these
states
where
they're
like.
I
don't
know
what
to
do.
I
need
manual
intervention
because
there's
so
much
paranoia
around
losing
data,
and
I
think
one
of
those
paranoia
decisions
early
on
was
very
much.
A
You
know:
hey
we're
not
going
to
delete
the
claims,
because
that
may
cause
the
data
get
to
get
deleted
and
we
we
don't
want
to
have
anything
that
accidentally
deletes
your
database
out
from
under
you,
but
it
feels
like
there's
enough
experience
now
where
we
can
start
slipping
in
some
of
the
garbage
collection,
some
of
the
stuff
there.
But
you
know,
I
think,
that's
definitely
one
of
those
like
use
that
with
caution
right.
Yes,
absolutely.
B
It
also
means
that
we
know
exactly
what
which
artifact,
where
they
come
from
and
and
verify
that
there's
no
man
in
there,
that's
there's
nothing
unexpected
from
it.
It
also
means
that
the
build
process
is
fully
scripted
and
automated
as
well.
So
we
have
those
the
promise
annotation
files
available.
It's
actually
a
little
bit
more
steps
in
it
as
well.
A
B
So
it
makes
the
whole
software
supply
chain
more
secure,
there's
four
levels
of
salsa
compliance
and
the
project
itself
already
complies
to
various
amounts
of
salsa
levels.
One
two
four
like
the
fourth
one,
which
is
the
most
secure
states,
requires
two-person
review
about
the
changes.
So
we
almost
have
them
like
there.
We
do.
We
have
someone
do
an
lgtm
and
someone
has
to
do.
Another
person
usually
does
doesn't
approve
on
pull
requests,
so
that's
already
kind
of
there.
So
where
do
you
have
a
lot
of
the
steps
between
you?
Don't
have.
A
Now
this
is
really
exciting
stuff,
because
I
think
you
know
more
and
more
everybody's
getting
paranoid
about
supply,
chain
and
open
source-
and
I
think
you
know,
and
and
beyond,
just
the
security
stuff.
There's
an
aspect
to
this
around
licensing
right.
It's
very
easy
to
take
a
dependency
on
something
and
that
may
not
actually
have
a
license
that
we're
okay
with
so
a
big
part
of
this
is
actually
being
able
to
have
that
manifest
that
bill
of
materials.
What
are
all
the
ingredients
that
go
into
this?
B
A
Yeah
yeah-
well,
I
mean
alex,
brings
up
the
log
for
j
stuff
and
I
think
you
know
it's
a
matter
of
time
before
you
know
you
know
it's
easy
to
sort
of
say.
Oh
that's
just
a
java
problem
but,
like
you
know,
there's
going
to
be
a
problem
someplace
in
sort
of
a
go.
You
know
standard
library
at
some
point
where
everybody's
going
to
scramble.
Hopefully
it's
not
going
to
be
as
bad
as
log4j.
A
Now
with
java,
you
can
go
through
and
crack
the
jar
open
and
actually
start
looking
at
symbols.
So
that's
another
way
to
see
if
you're
impacted
from
log
for
j,
but
like
with
something
like
c
plus,
plus
or
or
or
go
you
know
figuring
out.
Oh,
are
you
using
this
api
after
the
fact
may
not
be
easy
right?
It
may
not
be
an
easy
thing
to
do.
A
B
Yeah
when's
the
cubelet
container,
runtime
interface,
the
cri
cube,
went
to
beta,
so
this
is
something
we
need
before
the
docker
gym
removal.
Another
thing
for
software
supply
chain
as
well,
so
taint
based
propagation
analysis.
It's
type
of
analysis
where
you,
okay,
let
me
go
back,
wait,
wait!
What's
it
called
again,
it's
called.
B
I
think
it's
called
tint
based
propagation
analysis,
but
let
me
the
let
me
do
a
summary
back.
We
did
external
security
audits
of
the
project
in
2019..
We
found
out
that
secrets
are
logged
several
different
places.
Oh
yeah,
that's
not
good!
Yes,
so
this
tool-
or
this
type
of
analysis
sees
where
data
is
going,
is
moving
within
within
an
application.
B
So
there's
a
tool,
go
flow
levy
which
make
sure
which
takes
a
look
to
see
if
you're,
if
you're
logging
secrets
pretty
much
that
we're
running
this
tool
in
the
pre-submit,
so
any
pull
requests
that
is
merge
will
the
tool
will
be
read,
and
we
know
that
if
you're,
if
you're,
if
you're
kkpr,
if
your
code,
pr
is
logging
secrets
anywhere.
So
this
is
something
that
we've
we've
added
in
1.23.
B
B
So
that
so
that
cycle
actually
starts
on
monday,
then
it
I
think
the
release
is
april.
I
forgot
what,
what
week,
what
day
in
april,
exactly
really
cycles
about
is
15
weeks,
it's
15
or
16
weeks,
depending
on
the
time
of
the
year,
so
usually
the
end
of
the
release
or
the
end
of
the
year
cycle
is
usually
16
weeks
and
everything
before
that
is
15
weeks,
and
that's
that's
from
when
we
went
from
a
four
release
cadence
to
three
release,
cadence,
so
they'll
start
january
and
in
about
april
awesome.
A
Awesome
and
coke
jen
in
the
chat
is
saying:
hey:
can
we
do
a
tgik
on
on
v4
v6,
dual
stack
yeah?
That
was
actually
one
of
the
alternate
topics
that
we
were
talking
about
here
and
I
I
need
to
find
the
right
way
to
set
that
up
and
actually
play
with
it
right,
because
it's
like
getting
a
good
test
environment
for
dual
stack.
Is
you
know
as
part
of
the
battle
here?
A
It's
just
it's
so
easy
to
fall
into
that
that
v4
everything
seems
to
work
type
of
type
of
motion,
so
yeah
all
right.
Well,
I'm
gonna
give
so
carlos
saying
psa.
Only
kubernetes
only
supports
the
last
three
releases.
Tell
your
friends
to
update.
Often
that
is
definitely
something
that
that
is
a
concern
I
think
we've
been
talking
on
and
off
for
quite
a
while
around
doing
an
lts
and
finding
a
lot
of
folks
together
to
sort
of
make
that
happen.
A
A
lot
of
complications
on
there
and
there's
a
danger
with
an
lts
also
is
that
if
people
get
too
far
behind
doing
one
of
these
updates,
that
may
actually
be
be
difficult
and
they
may
not
right.
So
there's
a
lts
is
a
little
bit
of
a
trap
here
also,
so
I
think
you
know
making
it
easier
to
roll
forward
forward
is
also.
A
You
know
is,
in
my
mind
the
preferred
thing,
but
not
everybody
can
do
that
and
then
I
think
we're
also
at
this
point
we're
down
to
three
releases
a
year
right
yeah.
So
we
were
at
four
it's
down
to
three
that
take
some
of
the
pressure
off
the
release
team,
because
it
is
a
big
job
and-
and
it
also
means
that
that
that
sort
of
that
three
last
three
version-
support
policy
actually
means
more
in
terms
of
time
too.
A
So
that
helps
to
mitigate
that
a
little
bit
then
also,
but
three
releases
a
year
is
still
a
lot.
It's
still
a
lot
of
work,
all
right,
so
any
any
other
folks
in
the
in
the
comments
have
something
otherwise,
like
I'm
gonna,
I'm
gonna.
Let
rey
have
the
last
word
here
and
and
just
say,
thank
you
so
much
ray
for
joining
us.
B
A
All
right
well,
thank
you
so
much
for
being
part
of
it,
and
thanks
for
so
much
for
all
your
work,
making
the
community
go.
I
really
appreciate
it
man.
Thank
you
very
much.
All
right!
Everybody
have
a
great
weekend.
Let's
see,
I
think
you
know
next
tgik,
where
we're.
Actually,
if
you
go
to
tgik
dot,
io,
slash
repo
that'll
go
to
the
github
repo
and
we
actually
have
a
bit
of
a
schedule
and
we
have
a
tbd
for
next
week.
A
So
we'll
go
ahead
and
figure
that
out,
I
will
actually
see
if
we
can
get
somebody
who
can
sign
up
to
do
the
dual
stack
demo,
because
I
think
that
would
be
a
lot
of
fun.
I'm
not
sure
I
necessarily
have
the
depth
at
this
point
to
be
able
to
set
it
up,
but
I
would
love
to
see
somebody
demo
that,
but
then
also
coming
up
on
the
schedule
is
we're
going
to
be
looking
at
carpenter,
which
is
our
supply
chain
coordinator.
A
A
It
was
the
aws
cluster,
auto
scaling
stuff.
That's
what
carpenter
is
so
that's
gonna,
be
that's
gonna,
be
in
two
weeks,
but
I'll
see.
If
I
can
find
somebody
to
do
the
dual
stack
for
next
week.
Thank
you
so
much
ray
and
everybody
have
a
great
weekend
yeah.
Maybe
we
can
twist
josh's
arm
into
doing
the
dual
stack
stuff
and
talk
to
you
all
later
and
stay
safe
and
healthy.
Thank
you.