0.11 cloud-native-rejekts-eu-paris-2024 2024-03-17 2024-03-18 2 00:05 https://cfp.cloud-native.rejekts.io https://cfp.cloud-native.rejekts.io/media/cloud-native-rejekts-eu-paris-2024/img/CNR_EU_Logo_Default_aSmLAOs.png Europe/Paris Arena Opening / Welcome 2024-03-17T09:30:00+01:00 09:30 00:10 Opening remarks cloud-native-rejekts-eu-paris-2024-1002-welcome-to-cloud-native-rejekts-eu-2024- Benazir Khan en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/QGTB3T/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/QGTB3T/feedback/ Arena Talk 2024-03-17T09:40:00+01:00 09:40 00:30 This session explores the expanded capabilities of OCI registries beyond traditional container image storage, focusing on a use case to easing air-gap deployments. Leveraging OCI registries for storing Helm charts and Kubernetes manifests presents a novel approach to manage deployments. The discussion will include key features and capabilities of tools such as Flux and ORAS, highlighting their role in enhancing the functionality of OCI registries. By elaborating on the practical use cases, such as the deployment of signed Helm charts in secure environments, signed GitOps artefacts delivery, this presentation aims to showcase the versatility of OCI registries and their pivotal role in secured software supply-chain. cloud-native-rejekts-eu-paris-2024-918-oci-registry-beyond-container-images-easing-air-gap-deployments Stéphane Este-Gracias en Traditionally, container registries have been primarily used for storing container images. However, their potential extends far beyond this conventional use. This expanded functionality needs to be more well known. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/QWRFYW/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/QWRFYW/feedback/ Arena Sponsor Keynote Speech 2024-03-17T10:10:00+01:00 10:10 00:05 This is a 5 minutes speaking slot for Champion Sponsors. cloud-native-rejekts-eu-paris-2024-1003-microsoft-5-mins-keynote-on-community-initiatives Andy Randall en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/YTLDLB/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/YTLDLB/feedback/ Arena Talk 2024-03-17T10:15:00+01:00 10:15 00:30 You’ve seen the eBPF architecture diagram many times now in presentations: “…and then we compile some C code and attach it to a function in the kernel…”, before moving on. Have you ever wondered what that really means, and what actually happens when you do that? This talk is for you. cloud-native-rejekts-eu-paris-2024-863-how-ebpf-actually-works James Laverack en We’ll take a simple eBPF program and step through everything that happens to it. How it’s compiled, what is eBPF bytecode and what it looks like, how the kernel loads it, how the verifier works, how the JIT compiles it and what to, and finally how the kernel hooks its own function calls with the compiled eBPF. At each step we’ll follow through our example, from source code, to eBPF byte code, to JIT compiled for the running platform. We’ll investigate some relevant parts of the Linux kernel source code, and learn what’s really happening when you run eBPF code. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/39JA3U/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/39JA3U/feedback/ Arena Sponsor Keynote Speech 2024-03-17T10:45:00+01:00 10:45 00:05 This is a 5 minutes speaking slot for Champion Sponsors. cloud-native-rejekts-eu-paris-2024-1004-cisco-5-mins-keynote-on-community-initiatives Stephen Augustus en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/MF3EAL/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/MF3EAL/feedback/ Arena Talk 2024-03-17T11:10:00+01:00 11:10 00:30 Most controllers written for Kubernetes include their own Custom Resource Definition (CRD) - but it’s actually very easy to make mistakes in the CRD design that will cost a lot in longer-term maintenance. Come and hear from Gateway API and Ingress controller maintainers about Charlie Don’t, the Kubernetes developer with the worst luck in designing CRDs, and how you can use his experience to avoid the most common problems with CRD design. You should expect to come away from this session with an understanding of common CRD design errors and the ways you can avoid them. cloud-native-rejekts-eu-paris-2024-904-don-t-do-what-charlie-don-t-does-avoiding-common-crd-design-errors Nick Young en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/TWUHAU/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/TWUHAU/feedback/ Arena Talk 2024-03-17T11:45:00+01:00 11:45 00:30 Our hero, a running application in a Kubernetes development environment, knows that they are destined for greater things! They long to be living in production, serving end users! However, the journey from dev to prod is hard, filled with system design choices concerning cluster provisioning, GitOps, traffic routing, and app config.. And who knows what unseen forces lurk in the shadows! One wrong step could be catastrophic. It is up to you, the audience, to guide our hero and help them grow from an app in development to their final form⎯an app running in production. In this 'Choose Your Own Adventure'-style talk, Whitney and Viktor will present choices that an anthropomorphized app must make as they try to find their way to production. Throughout the presentation, the audience (YOU!) will vote to decide our hero app's path! Can we navigate CNCF projects and avoid dead-ends to get our app to production before the session time elapses? cloud-native-rejekts-eu-paris-2024-1006-choose-your-own-adventure-the-perilous-passage-to-production Viktor FarcicWhitney Lee en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/JDGQQG/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/JDGQQG/feedback/ Arena Talk 2024-03-17T14:00:00+01:00 14:00 00:30 We're all way past understanding why security is a critical piece in our product stacks - from the code, APIs, to the workloads, and runtime. The next step was choosing the scanners and tooling, to ensure a guarded fortress, however all of these come with their own chaos of CVEs, compounding cognitive load. This is where context matters in cloud native security. We'll dive into how you even get started with what matters, from prioritization, daring to remediate - without breaking prod, how to apply better component security, anomaly detection & how eBPF is simplifying this on all the layers. Come armed with tough questions and come away with good practices for ensuring your security choices are always in context. cloud-native-rejekts-eu-paris-2024-948-context-based-security-what-your-cloud-native-apps-really-need Oshrat Nir en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/HLWFXF/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/HLWFXF/feedback/ Arena Talk 2024-03-17T14:35:00+01:00 14:35 00:30 Kubernetes has been put to great use by a wide variety of organizations to manage their workloads, as it hides away a lot of the complexity of managing and scheduling containers. But with each added layer of abstraction, there can be new places for attackers to hide in darkened corners. This talk will examine how attackers can (ab)use little known features of Kubernetes and the components that are commonly deployed as part of cloud-native containerized workloads to persist in compromised systems, sometimes for years at a time. We'll also pinpoint places where, if you don't detect the initial attack, it might be very difficult to spot the attacker lurking in your cluster. cloud-native-rejekts-eu-paris-2024-839-beyond-the-surface-exploring-attacker-persistence-strategies-in-kubernetes Rory McCune en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/ZJEVSY/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/ZJEVSY/feedback/ Arena Talk 2024-03-17T15:10:00+01:00 15:10 00:30 Uber has been migrating all of its stateless compute fleet from a pre-Kubernetes system called Peloton to Kubernetes, in this presentation we want to share with you why we decided to migrate our fleet to Kubernetes, the challenges we've faced and how we're adapting our systems to run millions of workloads on top of dozens of Kubernetes clusters. cloud-native-rejekts-eu-paris-2024-964-migrating-2-million-cpu-cores-to-kubernetes Lucy Sweet en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/DWCTDG/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/DWCTDG/feedback/ Arena Talk 2024-03-17T16:00:00+01:00 16:00 00:30 eBPF has become a key technology in the cloud native ecosystem. It revolutionized the way the Linux kernel is extended as it’s now much easier to add functionality to the kernel. There is a huge variety of tools using eBPF for different purposes such as networking, security, observability, and others. Unfortunately, all those tools have their own tooling for deploying and configuring the eBPF programs, as well as gathering and processing the data produced by them. This, for the developers of such tools, is duplicated (and useless) work and it makes collaboration between different parties more difficult. In this talk, we’ll look at how the Inspektor Gadget project is trying to address this. We’ll deep dive into Inspektor Gadget as a framework that makes it easier to use eBPF in applications and infrastructure for systems data collection; ultimately enabling greater collaboration between different parties. cloud-native-rejekts-eu-paris-2024-982-on-creating-a-common-framework-for-ebpf-data-collection Chris Kuehl en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LMPRM3/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LMPRM3/feedback/ Arena Talk 2024-03-17T16:35:00+01:00 16:35 00:30 In the world of Kubernetes, dynamic admission controllers have long played a pivotal role in enhancing the robustness and adaptability of clusters. For instance, the ValidatingWebhookConfiguration, which empowers users to implement intricate and finely-tuned access controls beyond the capabilities of RBAC. However, this newfound agility often comes at a price – the ease with which they can be misconfigured, potentially leading to cluster disruption and downtime. Historically, we’ve accepted this fragility as an inevitable trade-off for greater control over our clusters. But what if we could change that narrative? Enter ValidatingAdmissionPolicies! In this talk we’ll take a look at what makes ValidatingAdmissionPolicies a safer choice for your validation logic and what problems they aim to solve. We will delve into the world of ValidatingAdmissionPolicies, exploring their features and limitations. We will also draw comparisons with ValidatingWebhookConfigurations, shedding light on the problems they solve. Furthermore, I’ll provide a comprehensive walkthrough on how you can begin leveraging ValidatingAdmissionPolicies today. cloud-native-rejekts-eu-paris-2024-861-from-fragile-to-resilient-validatingadmissionpolicies-strengthen-kubernetes Marcus Noble en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/KCN3QV/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/KCN3QV/feedback/ Arena Talk 2024-03-17T17:10:00+01:00 17:10 00:30 Founders and maintainers of open source projects have a good idea of what is needed from a technology standpoint to grow their project and provide technology value. But there are many other things to consider such as how to talk about the business value, advocacy and marketing activities, and community building that gives the project the needed boost that accelerates the time to project success. In this talk, I will bring my experience and insights on best practices for marketing, advocacy, and community building for open source projects that you can use to help you grow your project. I will outline steps you can take and specific things you can do to improve your success with your project and taking your project through Foundation maturity levels. cloud-native-rejekts-eu-paris-2024-927-open-source-project-growth-the-non-technical-needs-for-driving-project-growth Kim McMahon en Founders and maintainers of open source projects have a good idea of what is needed from a technology standpoint to grow their project and provide technology value. In this talk, I will cover the non-technical things that are important and just down-right critical to project success. * Messaging and outlining the business value of the project and why someone should care. * The go-to-market plan for the open source project. How you will communicate about the project, how to handle project release launches, effective communications, the content plan, the web plan, events, and partnering with other projects to increase your visibility. * Community building including digital platforms, engagement, and how to grow members from users to contributors to advocates. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FZCA3P/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FZCA3P/feedback/ Arena Talk 2024-03-17T17:45:00+01:00 17:45 00:30 The Gateway API was Introduced to Kubernetes in 2019. The project is making steady progress toward becoming the single expressive API for inbound traffic that is portable, extensible, and role-oriented, with over 20 implementations and multiple objects making it to GA recently. This session is about exploring what’s happening in the project. What is the state of the API and the various implementations? We will also cover the GAMMA initiative, which uses the Gateway API as a standard way to describe East-West traffic (AKA mesh traffic). cloud-native-rejekts-eu-paris-2024-876-what-s-new-in-the-kubernetes-gateway-api Abdelfettah SGHIOUAR en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/GQAGX3/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/GQAGX3/feedback/ VIP Area Talk 2024-03-17T11:10:00+01:00 11:10 00:30 Burnout can happen at any point in everyone’s career. But, what happens when burnout is taking place amongst other things? Your s/o having a miscarriage? Veteran dealing with time in service and injuries from it? Becoming unemployed? Let’s discuss realizing you’re approaching or are burned out, the why behind that, and coping mechanisms. cloud-native-rejekts-eu-paris-2024-857-burnout-recognizing-and-managing-burnout /media/cloud-native-rejekts-eu-paris-2024/submissions/WPUDHQ/Burnout_Recognizing_and_Managing_B_1Digobp.png Chris Short en Also available at https://chrisshort.net/cfp/burnout++ What is Burnout? Definitions (sourced) Who it impacts? Yes. Even kids deal with this. Personal Story Thread: The year of yes can turn into years of “please stop” Burnout+ Veteran Injured (disabled veteran; disability in general) Have Kids (always stressful or worrisome) Contribute to open source (never feel like you’re doing your best) Have a side hustle (Yeah, I wrote a weekly newsletter for six years) Dealing with it all (do it before you snap) Introduce a Little Chaos A miscarriage A job lost/layoffs A global pandemic Toxic family members Personal Story Thread: A Netflix series that hit WAY too close to home Welcome to burnout++ — Managing the Chaos Friends & Family - Prioritize family, tell your friends, be forward Compartmentalization (lock it in a box for short bursts) !!!WARNING!!! The truth will set you free; be honest with yourself Medical Conditions Can Occur Due to Burnout Increased anxiety (all the way up to paralyzing panic attacks) Fatigue, repetitive use injuries, etc. Clouded thoughts Mood swings High blood pressure (living in the red) Far Worse Fight or Flight You can be in a constant fight mode; this is what, “The fog of war,” kinda comes from This feeling is built into our DNA Being aware of your body and the remedies needed to center yourself Meditation, grounding, situational awareness, and much more Everything is interconnected When I get anxious; I don’t think clearly When I get anxious; my blood pressure goes up When I get anxious; my pain levels go up This interconnectedness has completely wiped me out before (story about the last panic attack) All this starts like a snowball heading down a mountain; once you get to the end you have a devastating avalanche If the anxiety builds daily over time a blow up is bound to happen Acceptance The sooner you accept the situation you’re in the sooner you can improve it DevOps the shit out of it (“Martian” Science Meme) Forgiveness This is not entirely your fault Give yourself some grace Reach out to a friend Accept who you are This will get better Moving Forward Keep yourself organized Realize that you need to be able to communicate effectively what’s happening to you and what you’re going through Find habits that genuinely bring you peace Let go of your fears Notes and Anecdotes How many of you have weighed leaving a certification course at lunch because you were in so much pain? How many of you didn’t end up leaving because you realized you didn’t have enough pain meds to not make you feel guilty about laying in bed all afternoon? Sources https://burnoutindex.yerbo.co/ https://www.psychologytoday.com/us/blog/high-octane-women/201311/the-tell-tale-signs-burnout-do-you-have-them https://www.mayoclinic.org/healthy-lifestyle/adult-health/in-depth/burnout/art-20046642 https://www.helpguide.org/articles/stress/burnout-prevention-and-recovery.htm https://www.ncbi.nlm.nih.gov/books/NBK279286/ https://www.verywellmind.com/stress-and-burnout-symptoms-and-causes-3144516 https://www.forbes.com/sites/learnvest/2013/04/01/10-signs-youre-burning-out-and-what-to-do-about-it/#6389dff9625b https://www.thoracic.org/patients/patient-resources/resources/burnout-syndrome.pdf https://www.merriam-webster.com/dictionary/burnout https://globalnews.ca/news/3639388/burnout-syndrome-symptoms-stress/ https://www.theguardian.com/women-in-leadership/2016/jan/21/spot-the-signs-of-burnout-before-it-hits-you http://news.bbc.co.uk/sport2/hi/academy/4244782.stm https://devopsish.com/292/ https://chrisshort.net/life-after-devopsish/ https://hbr.org/2023/04/a-two-minute-burnout-checkup https://hbr.org/2023/05/when-your-employee-tells-you-theyre-burned-out false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/WPUDHQ/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/WPUDHQ/feedback/ VIP Area Talk 2024-03-17T11:45:00+01:00 11:45 00:30 "Have I considered every angle with this decision, or could a bias have crept in?" - is a common question that’ll prompt you to critically assess potential biases. As the cloud-native landscape evolves, the governance structures overseeing these environments play a pivotal role in shaping the trajectory of inclusivity of projects. Join us for an exploration, where we as contributors to CNCF projects and release teams share firsthand experiences, emphasizing the pivotal role of empathy in cloud-native development. Discover the analogy of empathy as a muscle and learn how to cultivate it. Drawing a clear distinction between empathy and sympathy, shifting from a "know it all" mindset to a "learn it all" and “two-word check-in” for concise emotional expression. Prioritizing open dialogue, the talk suggests creating a safe space, establishing a common language, and empowering attendees to integrate empathy into decision-making for a more inclusive, bias-aware Cloud Native environment. cloud-native-rejekts-eu-paris-2024-942-empathy-in-cloud-native-governance-addressing-bias-for-inclusive-decisions Kunal KushwahaAakansha Priya en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LLBFT8/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LLBFT8/feedback/ VIP Area Talk 2024-03-17T14:35:00+01:00 14:35 00:30 Elevate your Argo Rollouts experience with the Gateway API Plugin! Argo Rollouts excels in progressive delivery, including canary and blue/green deployments. Thanks to CNCF's Gateway API project, we now have a standardized interface for mastering progressive delivery. Bid farewell to complex custom gateway integrations. The Gateway API Plugin broadens your options, simplifying delivery management across cloud platforms. Join us for a demo focused on Istio's newly added support for GatewayAPI. Witness seamless transitions between application versions, orchestrated by Argo Rollouts. cloud-native-rejekts-eu-paris-2024-899-progressive-delivery-with-istio-and-gateway-api-plugin-for-argo-rollouts Alessandro Vozza en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/NLYLSK/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/NLYLSK/feedback/ VIP Area Talk 2024-03-17T15:10:00+01:00 15:10 00:30 The key to successful Chat Ops is to be able to identify the important information in a timely manner using the best communications channel for a team (which could range from Slack to a bespoke App), and then enable the ops team to take appropriate action. The CNCF project Fluent Bit, has a number of core characteristics (event-driven and stream analytics features) that allow us to recognize critical events and event patterns as they occur without losing the benefits of traditional log analytics and observability tools. Using Fluent Bit’s connectivity and extensibility allows us to spot critical events and immediately communicate with the right ops staff using social channels or apps in a flexible and versatile manner and return actions to trigger suitable Fluent Bit events. All of which creates the opportunity to react more quickly and even become proactive/preventative. cloud-native-rejekts-eu-paris-2024-895-fluent-bit-the-engine-to-power-chat-ops Patrick Stephens en In this session, we’ll look at these capabilities of Fluent Bit that can help us not just get data to the tools for metrics visualization and alarms and post-event analysis but also help us to react more quickly and potentially pre-emptively and show a thought-provoking demo of how Fluent Bit could be used to help empower ops so that we can look after our ‘pets’ or avoid the ‘cattle’ stampeding. This presentation puts emphasis on the often-overlooked opportunities that CNCF’s Fluent Bit can offer in the operational space. The novelty and uniqueness of this presentation will help convey the value and opportunities that Fluent Bit can offer. This is a presentation that hasn’t been seen before at Kubecon The session presenters are engaged with the Fluent Bit project. Phil Wilkins is the author of a book on Fluentd and currently authoring a book on Fluent Bit with Kubernetes. Both Patrick & Phil have previously presented at CNCF meetups and other conferences. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LXXPWR/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LXXPWR/feedback/ VIP Area Talk 2024-03-17T16:00:00+01:00 16:00 00:30 As I have been working with my new Apple Mac M1 for over a year, I was wondering why ARM is not used more in regular application workload scenarios? ARM for desktop computing is really stable, seamless, reliable and for me a game changer - when will we recognize the same for our servers? Especially in times when energy and raw materials are expensive, we should also benefit from the efficiency of ARM technology in our Data Centers. So what’s missing? We have Kubernetes on ARM, we have the main operating systems supporting ARM, we have a lot of application software and programming languages supporting ARM out of the box, why don't we use this potential in large scale? Join the talk to get more insights on the current state of the ecosystem, open source and cloud native landscape. Let’s find out if it is possible to create out of the results a real future business case for ARM based revolution in our Data Centers. cloud-native-rejekts-eu-paris-2024-886-will-arm-be-the-new-mainstream-in-our-data-centers- Tobias Schneck en Similar to ARM for the desktop, ARM for cloud native workload could be a game changer and make operation of our workload more efficient and cheaper. The big hyperscalers such as AWS, Google, Azure already have ARM based machines available in their data centers. We already see huge potential for ARM in edge devices in IOT use cases, but also at classical on-premise or edge data centers. Running future application stacks in a most efficient way will save energy. Lower energy usage, with fewer devices for hosting the same amount of machines, means also lower costs. That efficiency makes it attractive for everyone, including on-premise data centers. The talk will show what is already possible and where there are limitations in the CNCF ecosystem. A live demo will show differences during build- and run-time on a characteristic application stack for enterprise workload. The audience will see if the technology has a real chance to be the “next thing” at their datacenter by using cloud native technologies. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/N7MTPK/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/N7MTPK/feedback/ VIP Area Talk 2024-03-17T16:35:00+01:00 16:35 00:30 A lot of users have adopted Cluster API because of its enhanced ability to manage Kubernetes clusters. Are you struggling to manage your growing infrastructure because the complexity involved in managing multiple providers across diverse deployments can be challenging? Join us as we introduce the Cluster API Operator, a tool that simplifies the deployment and management of Cluster API providers. It utilizes a flexible, GitOps-based approach for real-world scenarios. In this talk, we cover an overview of the Cluster API Operator project and the challenges faced in managing multiple Cluster API providers across numerous clusters and regions. We also explore how a declarative GitOps approach enhances cluster management, ensuring consistency and reliability. We'll demonstrate the process of installing and upgrading providers, making customizations, and deploying providers in isolated environments throughout various regions. cloud-native-rejekts-eu-paris-2024-865-using-gitops-to-simplify-cluster-api-provider-management Mikhail FedosinDanil Grigorev en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/8EK3UD/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/8EK3UD/feedback/ VIP Area Talk 2024-03-17T17:10:00+01:00 17:10 00:30 As the amount of cloud-native applications continues to rise, there is an unprecedented surge in the demand for backing services, amplifying the need for automated provisioning. We will embark on a journey to demystify the complexity of managing and connecting backing services. Crossplane, a multi-cloud control plane, will take center stage as we explore its capabilities to automate the provisioning of backing services and expose simple, abstracted interfaces for developers to claim those. The second component in this magical symphony are ServiceBindings that enable the automated supply of the required information for the connections between applications and their required backing services in a consistent way. This session is your compass to navigate the enchantment of effortless backing service provisioning and consumption and will illustrate how this dynamic duo enhances developer productivity, reduces operational overhead, and facilitates the seamless deployment of applications. cloud-native-rejekts-eu-paris-2024-825-the-magic-of-backing-service-provisioning-and-consumption-with-crossplane-and-servicebindings Timo Salm en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/AH8RBP/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/AH8RBP/feedback/ Arena Talk 2024-03-18T09:30:00+01:00 09:30 00:30 Whether you're new to Kubernetes or a seasoned veteran, understanding the details of Pod creation and networking is essential. This talk unravels the intricacies of Kubernetes networking by building the simplest of CNIs (Container Network Interface) from scratch. A CNI plugin is a crucial component, enabling communication between containers in a Kubernetes cluster. In just a few lines of code, we'll explore the creation of Pods, how they are assigned IP addresses, and the role of virtual Ethernet pairs in connecting them to the broader cluster. Gain practical insights into real-world scenarios, discover the significance of CNIs in the CNCF and understand why it's fundamental for any engineer operating Kubernetes. This talk equips you with practical knowledge to navigate Kubernetes networking with confidence by empowering attendees with essential CNI concepts and providing a clear understanding of its role in shaping the containerized world. cloud-native-rejekts-eu-paris-2024-833-demystifying-cni-writing-a-cni-from-scratch Filip Nikolic en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/HHNFJH/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/HHNFJH/feedback/ Arena Talk 2024-03-18T10:05:00+01:00 10:05 00:30 Imagine navigating a bustling city, traditional observability is like relying on street signs, traffic lights, and a map —useful, but overwhelming with data. Our talk explores the shift to Systems Thinking, akin to seeing the city as an interconnected system rather than just individual signs and lights. We will explore the challenges of traditional observability in Kubernetes, introduce Systems Thinking for a holistic perspective, apply Systems Thinking concepts to Kubernetes and discuss practical techniques using OpenTelemetry to observe Kubernetes entities effectively. It's like upgrading from navigating streets to understanding the entire urban ecosystem, providing a comprehensive view of system health and interactions. cloud-native-rejekts-eu-paris-2024-841-kubernetes-as-entities-applying-systems-thinking-to-observe-k8s-beyond-metrics-traces-and-logs /media/cloud-native-rejekts-eu-paris-2024/submissions/FNNCU3/shibuyapaper_4BDMJUL.jpeg Miguel Luna en In the realm of Kubernetes, Observability traditionally revolves around Logs, Metrics, and Traces, offering valuable insights into system performance and behaviour. However, this approach often falls short in managing the overwhelming volume of generated data or grasping the intricate interactions among Kubernetes components, failing to present users with a simplified view of the system's health according to their needs. To attain true comprehensive observability, a paradigm shift is essential. Applying 'Systems Thinking' provides a framework for understanding the relationships between different resources and their mutual impact. Join us in this discussion where we will delve into: 1. The challenges associated with using the conventional 3 Pillars Observability approach in the context of Kubernetes. 2. An introduction to Systems Thinking concepts and how they can be utilised to identify Kubernetes entities, establish boundaries, understand functions, and formalise relationships. 3. Applying Systems Thinking techniques such as abstraction and decomposition to facilitate a more holistic perspective of Kubernetes. 4. Practical strategies for observing Kubernetes entities using the inherent correlation capabilities of the OpenTelemetry project. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FNNCU3/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FNNCU3/feedback/ Arena Talk 2024-03-18T10:40:00+01:00 10:40 00:30 Kubernetes is a platform for building platforms, but for some organizations, embracing its distributed and granular nature can easily lead to fragmented platform mayhem. As platforms engineers tasked to automate the provisioning of infrastructure and/or services, (through IaaC, templating or custom code in pipelines) it sometimes might feel like we are just gluing components together. Enter Crossplane, which enables you to bake your abstractions within the Kubernetes API without the need for building custom operators. Define the blueprints you need for provisioning infrastructure and the ones your developers need to deploy their services, reducing their cognitive load. In this talk, I will discuss how you can leverage Crossplane and ClusterAPI for effective platform delivery, while minimizing the coding effort of your platform team and your developer's exposure to the Kubernetes' nitty gritty. Are you one of those people who think there are too many CRDs? Let me challenge that! cloud-native-rejekts-eu-paris-2024-818-too-many-crds-i-say-not-enough-leveraging-crossplane-clusterapi-for-effective-platform-delivery Carlos Mestre del Pino en As the knowledge and exposure to Kubernetes grows, so does the set of tools and components which form the platforms we build, but the fragmented nature of Kubernetes can pose a challenge to platform teams. While most of us are already building abstractions with Helm charts or OpenTofu modules (among others), Crossplane allows us to do so in a Kubernetes pseudo-native way, without needing to write custom operators. Being able to build your own abstractions into the Kubernetes API and have your own CRDs (Crossplane's XRDs) so easily is an incredibly powerful feature of Crossplane, and more people should be made aware of it. Given that there are organizations and teams who are skeptical about the abundance of CRDs, I would like provide a moment to, not only challenge that perception, but also to invite them to reflect on the way they are building their platforms. The talk serves as a practical guide as well as a reflection, encouraging platform engineers to think about how Crossplane can help them defining their precise blueprints for infrastructure and service provisioning. It is not only a technical talk about how to build platforms with Crossplane, but it also includes a discussion about making efficient use of CRDs. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/NFRNHS/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/NFRNHS/feedback/ Arena Talk 2024-03-18T11:30:00+01:00 11:30 00:30 Crossplane Composition functions are one of the most consequential new features in the project's history. Crossplane is a CNCF project that allows users to manage anything (like S3 buckets of Gitlab repositories) in a Kubernetes-native manner. Composition Functions run in a pipeline to create a desired state using any programming language, allowing platform engineers to easily create and manage complex infrastructure deployments. Since graduating to beta in November 2023 functions have been rapidly adopted by the Crossplane community. This talk will help engineers get up to speed with Composition Functions. We'll go over their design and runtime concerns of Functions in a K8s cluster. We'll then cover how to use functions to build out cloud infrastructure using field patching and Go templates. Finally we'll discuss the basics of writing distributing your own functions in languages like Python and Go. cloud-native-rejekts-eu-paris-2024-937-crossplane-composition-functions-step-by-step Stefano Borrelli en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/W9DAEB/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/W9DAEB/feedback/ Arena Talk 2024-03-18T12:05:00+01:00 12:05 00:30 Jenkins has been one of the most popular automation servers in the world. It is widely used for CI/CD purposes in cloud environments. You may have heard that Jenkins is not cloud native, and of course it is true. You may have heard that Jenkins controllers are a legacy monolith from the 2000s. That is not true, it is quite **cloud friendly** if used right. And yes we tried to make Jenkins cloud native, but it didn’t quite work. Why? I have been involved in Jenkins architecture projects for more than ten years, including pluggable storage, multi-tenant Jenkins, cloud native agents, breaking down the controller monolith, Kubernetes integrations, etc., etc. Some of these efforts worked, some didn’t. But it was a great learning experience that can be used by developers and maintainers of other projects that consider re-platforming them to make cloud- and Kubernetes-native. I'll talk about the technical assumptions and mistakes we made in Jenkins, and how it worked. What to keep in mind when doing the re-platforming? And do you even need it? cloud-native-rejekts-eu-paris-2024-985-cloud-friendly-jenkins-how-we-failed-to-make-jenkins-cloud-native-and-what-we-learned- Oleg Nenashev en Jenkins has evolved a lot. It integrates with many tools and projects from the CNCF landscape. With their help you can make Jenkins cloud friendly and get the most of that in your Kubernetes clusters. My talk will go way beyond the “let’s provision agents in Kubernetes” and cover attempts to make Jenkins fully compliant with the CNCF definition. Almost all projects succeeded, but Jenkins is not cloud native for sure. So what went wrong? The key benefit is showing what obstacles to expect, and why one has to be careful about the assumptions they make. We also discuss what is the difference between Cloud Friendly and Cloud Native, and why the prior is someone really needs. It could be a good retro for those who are yet to start their cloud native migration projects. - https://www.jenkins.io/blog/2018/07/30/introducing-cloud-native-sig/ - https://www.jenkins.io/project/roadmap/ - https://jenkins-x.io/ - https://www.jenkins.io/doc/book/using/pluggable-storage/ - https://www.jenkins.io/projects/jenkins-operator/ - https://github.com/jenkinsci/jenkinsfile-runner false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/MZPS7T/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/MZPS7T/feedback/ Arena Talk 2024-03-18T14:00:00+01:00 14:00 00:30 Have you ever had a need to steer the incoming traffic to a subset of Kubernetes nodes? What about translating the source IP of traffic leaving the cluster to a fixed set of pre-defined addresses, all while maintaining high reliability and achieving sub-second failover times? In this session we will walk you through a series of scenarios covering various aspects of ingress and egress Kubernetes traffic engineering using Cilium. We will demonstrate deployment scenarios and best practices that will help guide you through most common design patterns. While doing this we will be using industry-standard protocols, like BGP, to achieve high availability and open source solutions, like Egress Gateway, to implement functionality not provided by Kubernetes natively. cloud-native-rejekts-eu-paris-2024-832-external-traffic-engineering-with-cilium Piotr JabłońskiMichael Kashin en Integrating cloud-native applications into existing, non-Kubernetes environments brings a lot of new challenges for infrastructure professionals. These legacy environments often dictate the need for fine-grained control of traffic going over a security perimeter with stateful inspection on firewalls and intrusion detection systems. Whether you’re doing it to stay compliant with industry regulations or to improve your security posture, the problems still need to be addressed and the burden lies on the team managing the Kubernetes cluster. Very few talks and tutorials about Kubernetes networking focus on external traffic and often gloss over the details of integration with the wider IT ecosystem. With this session the audience has a chance to get a deeper understanding of typical patterns for ingress and egress traffic engineering. This is beneficial as provided examples and design patterns can be reused in any Kubernetes cluster. We don’t assume much networking knowledge, but the tutorial is a mix of intermediate and more advanced topics. Whether you’re deploying in the cloud, hybrid or multi-site environments, this tutorial will have something to address your needs. If you bring your laptop, you can also follow along our hands-on labs, designed to demonstrate the explained concepts. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/TRGD9S/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/TRGD9S/feedback/ Arena Talk 2024-03-18T14:35:00+01:00 14:35 00:30 Have you heard about Gateway API, but find yourself wondering how to start leveraging its benefits? Supported by over 25 implementations, Gateway API is the next generation of Kubernetes Networking APIs. If you want to understand HOW and why to upgrade, this talk is for you. In this session, Lior and Mattia, holding distinct leading roles in Gateway API development, will share their experience and embark on a complete, step-by-step, real-world migration from Ingress, and implementation-specific configurations to Gateway API. They’ll talk about decision factors, and when Gateway API can provide significant benefits over current deployments. They’ll focus on ingress2gateway and its pivotal role in the migration journey, and continue with common pitfalls and challenges where you’ll also find answers to questions like “How do I shift my DNS?” or “How to handle TLS configurations?”. Finally, you’ll learn how you can get involved, and how your voice can influence future development plans. cloud-native-rejekts-eu-paris-2024-914-unlocking-the-gateway-a-practical-guide-from-ingress-to-gateway-api Lior LiebermanMattia Lavacca en With Gateway API recently graduating to General Availability (GA) and gaining increased support from major cloud providers and leading mesh projects, more and more people are interested in upgrading to the API. This talk stands apart as more than just an introduction. It will bridge that gap and offer tangible, real-world examples that resonate with the audience. It will introduce ingress2gateway, a tool designed within SIG-Network to make the migration less intimidating, providing a robust entry point and easy support for different mesh projects and cloud providers. The talk will tackle common challenges head-on, addressing burning questions like "How do I test my Gateway?" and "How do I safely shift DNS?" or "What if I need to relocate a certificate to the Gateway?" and “How do I even choose an implementation?” By the end of this session, our anticipation is that the audience will emerge not only more confident but equipped with practical insights to dive into Gateway API, explore its features, and unlock its benefits with newfound confidence. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/KEYQD9/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/KEYQD9/feedback/ Arena Talk 2024-03-18T15:10:00+01:00 15:10 00:30 Imagine a world where security threats lurk in the shadows of your cloud-native applications, hidden amongst the complex web of microservices and serverless functions. You, the hero of this story, are armed with a powerful tool: OpenTelemetry. But unlike Sherlock Holmes, you don't need a magnifying glass and keen observation. OpenTelemetry is your AI assistant, your Skynet, granting you the ability to see the unseen and unravel the mysteries of your cloud environment. We'll kick off by exploring the paradigm shift from monolithic structures to cloud-native and microservices architectures. Then, we'll delve into how OpenTelemetry offers invaluable visibility and potential security enhancements for our applications. However, relying solely on OpenTelemetry isn't sufficient; traditional security tools lag in securing microservices. Skeptical? We'll provide concrete examples. Now, picture an attack striking your own cluster – chilling, isn't it? That's why real-time runtime security is indispensable. In conclusion, we'll draw insightful conclusions on the powers of OpenTelemetry and runtime security for your microservice applications. cloud-native-rejekts-eu-paris-2024-994-from-sherlock-to-skynet-navigating-cloud-native-terrain-with-opentelemetry-and-runtime-security Arsh SharmaRamiro Berrelleza en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/UJAZR9/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/UJAZR9/feedback/ Arena Talk 2024-03-18T15:45:00+01:00 15:45 00:30 The landscape of CNCF projects related to Kubernetes is famously vast and rich, each helping its users solve the problems it was designed for. When it comes to using those tools though, even if they provide a graphical/textual user-interface, users still have to set up or run those different UIs, which may be inconsistent in configuration, design, and experience. In this talk, we share how the Headlamp project has accomplished this, and demonstrate a range of plug-ins that highlight the capabilities of those cloud-native tools, while integrating them in a single UI for a coherent user experience. We will share the process we followed and how other projects can onboard into Headlamp. cloud-native-rejekts-eu-paris-2024-917-bringing-it-all-together-unifying-multiple-cloud-native-projects-into-a-coherent-ui-experience Joaquim Rocha en The landscape of CNCF projects related to Kubernetes is famously vast and rich, each helping its users solve the problems it was designed for. When it comes to using those tools though, even if they provide a graphical/textual user-interface, users still have to set up or run those different UIs, which may be inconsistent in configuration, design, and experience. What is needed is a common, vendor-neutral, graphical UI platform focused on Kubernetes, on which those various projects can offer their own experience in a unified, consistent way. Headlamp is a CNCF Sandbox project designed to enable this scenario via an extensible GUI with support for plug-ins. In this talk, we share how the Headlamp project has accomplished this, and demonstrate a range of plug-ins that highlight the capabilities of those cloud-native tools, while integrating them in a single UI for a coherent user experience. We will share the process we followed and how other projects can onboard into Headlamp. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/D93NPJ/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/D93NPJ/feedback/ Arena Talk 2024-03-18T16:30:00+01:00 16:30 00:30 Exposed secrets like API keys and other credentials are the crown jewels of organizations but continue to be a persistent vulnerability within security. The majority of security breaches leverage secrets at some point during the attack path. This presentation sheds light on the various methods used by attackers to discover and exploit these secrets in different technologies. This manual will include how to: Abuse GitHub public API Gain unauthorized access to private git repos Decompile containers Decompile mobile applications from the App and Play Stores We combine novel research, real-life attack paths, and live demos to prove exactly the steps attackers take, revealing their playbook. Recent research has shown that git repositories are treasure troves full of secrets. A year-long study showed that 10 million secrets were pushed into public repositories in 2022 alone. We will show exactly how adversaries abuse the public GitHub API to uncover these secrets, even leaking secrets live to show how quickly attackers discover and exploit it. Public source code, however, is only the tip of the iceberg as private code repositories have proven to be much more valuable targets. We will demonstrate how to gain unauthorized access to private git repositories and discover secrets deep in their history. This will include supply chain poisoning, developer phishing, and configuration exploitation among other techniques. Finally, this talk will dive into decompiling containers, packages, and mobile applications to be able to uncover the huge amount of secrets buried within revealing how shockingly common it is to find hard-coded secrets. Knowing how attackers operate is essential in building effective defenses, understanding the attacker's playbook allows you to understand their next moves. This presentation is perfect for anyone wanting to know how to prevent attackers from getting old of your crown jewels. cloud-native-rejekts-eu-paris-2024-979-the-attacker-s-guide-to-exploiting-secrets-in-the-universe Mackenzie Jackson en #Section 1 - Introduction to Secrets ###Part 1: What are secrets Most attendees will likely have a good understanding of secrets but to ensure everyone is on the same page we quickly break down exactly what they are and why they are so sensitive. ###Part 2: How attackers use secrets, the anatomy of recent attacks Secrets are more than just an opportunity for initial access, they can be discovered and used at all stages of an attack. In this section, we break down recent high-profile breaches to show how attackers discovered and used secrets at different stages including 2022 Uber Breach, 2023 CircleCI breach, and 2021 Codecov breach. #Section 2 - Exploiting secrets in source code ###Part 1: Abusing the GitHub Public API GitHub contains a huge amount of data, more than a billion commits were made publicly in 2022. The GitHub public events API https://api.github.com/events is a firehose of data that contains everything that happens publicly. This API can be abused to identify high-value targets such as company employees and used to discover literally millions of secrets. ###Part 2: Scanning networks for exposed .git directories Private repositories are a much more fruitful resource when it comes to discovering secrets. One way of gaining access to these private repositories is to scan public servers. Recent research shows 2 million IP addresses had .git folder structure accessible to the public. We break down how to scan networks for these folders and scan these for secrets. ###Part 3: Finding misconfigurations in git servers Git server misconfigurations are another very common way to gain access to private repositories. This was the case when all of Twitch’s source code was leaked due to a configuration change. In this section, we explore how to identify weak or broken access in git servers. ###Part 4: Buying access and phishing Buying access can feel like cheating but the nature of git means that multiple employees have access to repositories and if all else fails you can fall back to the trusted techniques of phishing for access or buying credentials from the dark web. During this section, we will show the example of the Uber breach in 2022 where credentials were phished and sold granting an attacker access to the network and source code. #Section 3 - Secrets in compiled applications ###Part 1: Overview of secrets in compiled applications Moving away from source code and git repositories we begin our exploration into how we can discover secrets in compiled applications, in both Docker images and Android mobile applications. ###Part 2: Anatomy of a Docker Image During this section, we use tools like Dive to show exactly how docker images are made up and how they can be easily reversed with tools. ###Part 3: Scanning for secrets in docker images We do a quick demo of using secrets detection tools to discover secrets inside docker images. We will also do new unreleased research to show how 5% of Docker images contain secrets and exactly what are the most common types of secrets to find. During this section we will look at the CodeCov breach to show how malicious actors have used these methods in a real attack. ###Part 4: Secrets in Android and IOS mobile applications During this section, we focus on research showing how common it is to discover secrets inside mobile applications. This will include research that shows about half of applications on the Play Store contain at least 1 plain text credential with 10% of these secrets being critical. We will also walk through the result from a penetration test involving a tier 1 bank that was breached due to hardcoded secrets in their mobile application. ###Part 5: Demo - decompiling and scanning Here we will show how to pipe together multiple open-source tools to be able to extract APKs and IPAs from the Google Play Store and Apple App Store, decompile them and quickly scan them for secrets. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LBCQWB/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LBCQWB/feedback/ Arena Talk 2024-03-18T17:05:00+01:00 17:05 00:30 Imagine the inevitable has already happened—you’ve had a security breach—and you’re now dealing with the aftermath. Organisations must act fast to ensure business returns to operations quickly while also figuring out how to prevent similar incidents in the future. By adopting new use cases, engineering teams are simultaneously accelerating the deployment of sensitive data across multi-cloud architectures and tapping into new risk factors. In this talk, we will use the “Data Security Bang” analogy and learnings from resilience engineering to answer questions such as: How could we do more left of bang (prevention) to help with the speed of right of bang (remediation)? The audience will be guided through a set of example scenarios using Kanister, OPA, and Prometheus, in which they can make decisions on data security to guide the way towards a more robust infrastructure. cloud-native-rejekts-eu-paris-2024-820-the-bang-when-bad-things-happen-to-your-data Anais UrlichsMichael Cade en Both speakers combine their expertise to bring more awareness to data security. Anais has several years of experience in the cloud native security space, where she has helped dozens of users to implement open source security scanning with Trivy. Michael Cade is an expert in all things data storage and management for cloud native environments. A lot of the time, people will talk in isolation about both topics. Resulting, security professionals are unaware of database management processes and, thus, do not provide the right guidance on preventing and dealing with incidents. Looking at this table of data breaches from 2021: https://github.com/rapid7/data/blob/main/2021-cloud-misconfigurations/2021-cloud-misconfigurations.csv Most misconfiguration issues expose customer/user data publicly due to misconfigured and insecure data storage. This risk can be minimised through the right policies and security scanning. However, in cases where no misconfiguration is identified, our data security depends on the right data protection and disaster recovery strategies to ensure the availability of our data services. In this talk, the speakers will go through trial incidents ("the bang") to showcase the best strategies for minimising the damage to businesses and customers and also to share strategies for reducing the risk of similar issues in the future. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/YAYJS8/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/YAYJS8/feedback/ Arena Lightning Talk 2024-03-18T17:40:00+01:00 17:40 00:05 "Ever noticed how the Linux file system structure simplifies the way we organize data? Interestingly, Kubernetes clusters can follow a similar logic. But when it comes to managing a multitude of clusters—talking double digits here—it becomes a monumental challenge. That's where KCP comes in, allowing you to mount remote clusters as workspaces, offering a solution to the complexity of managing numerous clusters. The analogy to the Linux file system isn't just a handy comparison; it's a game-changer for navigating and organizing a large count of clusters, simplifying the way we handle an extensive cluster landscape." cloud-native-rejekts-eu-paris-2024-870-unlocking-new-possibilities-bridging-linux-and-kubernetes Mangirdas en "Unlocking New Possibilities: Bridging Linux and Kubernetes" Platform engineering thrives on Linux and Kubernetes, reveling in the structured approach and adaptability of the Linux filesystem. But what if we could blend these worlds? Imagine harnessing Linux's concepts—like directory trees and mounts—within Kubernetes: Mount your dev-cluster: kubeconfig mount dev-cluster clusters:dev Or access the prod-cluster: kubeconfig mount prod-cluster clusters:prod Navigate effortlessly: kubeconfig cd clusters:prod This session delves into a powerful revelation: innovation doesn’t always demand new tools. Instead, let's explore how revisiting established principles can revolutionize our approach. Join us to discover how leveraging proven strategies from one domain can dynamically transform another, opening doors to new efficiencies and possibilities. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/JUBTCX/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/JUBTCX/feedback/ Arena Lightning Talk 2024-03-18T17:45:00+01:00 17:45 00:05 Kubernetes Operators have become a transformative influence in the world of container orchestration. In this lightning talk, I will explain the core operations of Kubernetes Operators and explore their real-world impact. In just 5 minutes, you'll discover why Kubernetes Operators matter, explore their practical use cases, and learn how they can help you maximize the capabilities of your containerized applications. In this talk, I will provide an introduction to what Kubernetes Operators are and why they are significant. We will quickly explore the Kubernetes Operator ecosystem and its role in streamlining application operations. To conclude, I will share case studies where Operators can improve the scalability, reliability, and efficiency of applications. cloud-native-rejekts-eu-paris-2024-894-kubernetes-operators-the-power-of-automation /media/cloud-native-rejekts-eu-paris-2024/submissions/HUSACY/edith-profile-photo_VNIVKVV.jpg Edith Puclla en This Talk is for attendees who want to cut through the complexity and understand how Kubernetes Operators simplify application management. Whether you're a newcomer to Kubernetes or a seasoned pro, this presentation offers valuable insights. By the end of this Lightning Talk, attendees will Have a clear understanding of what Kubernetes Operators are and why they are essential. Gain insight into the diverse range of Operators available and their real-world applications. Walk away with a sense of empowerment, ready to explore the world of Kubernetes Operators further. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/HUSACY/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/HUSACY/feedback/ Arena Lightning Talk 2024-03-18T17:50:00+01:00 17:50 00:05 Practical lessons for Kubernetes "Production Ready" By default Kubernetes is not a secure environment, and that's a fact. There are a lot of articles and applications around telling you that you should improve security, but actually it is not an easy task. Also you have lots of tech buddies creating new things on your cluster, so enforcement is your best friend and periodic checks can be your allies. Fortunately, CEL, the language adopted by Kubernetes for validating policies and enforcement, is here to help and make it easier to start protecting your workloads and environment. In this talk, we'll take 5 minutes to show how the top 5 best practices can be implemented with CEL on Kubernetes. No other tool is necessary, and this may help you to implement your own protections as well! cloud-native-rejekts-eu-paris-2024-827-cel-to-the-rescue-applying-the-common-expression-language-to-secure-hundreds-of-servers-at-once- João Brito en 90% of respondents in Red Hat’s State of Kubernetes security report 2023 had at least one security incident in the past 12 months, with attacks on Kubernetes environments increasing by 300% over the last two years. Many early practitioners believe Kubernetes is secure, but reality is very different. Fortunately, there are several tools which can be used to enhance Kubernetes security and enforce best practices. CEL's adoption represents a significant opportunity, not only in admission policies but also within the larger Kubernetes ecosystem. With its debut in version 1.26, and its extension to authentication from version 1.29 onwards, this is an opportune moment to discuss the language and elucidate the advantages of its practical adoption. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LNNLSQ/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LNNLSQ/feedback/ Arena Lightning Talk 2024-03-18T17:55:00+01:00 17:55 00:05 Picture a scene where I'm enjoying a big plate of spaghetti, and my dear grandma, totally unaware of the deep tech world I work in, curiously asks about my job, like she does every xmas. Seizing this wonderful opportunity, I dove deep into the rabbit hole of container orchestration, trying to make it relatable through her favorite topic—food! I ended up explaining Kubernetes to her and she started serving homemade biscuits as they were apps. cloud-native-rejekts-eu-paris-2024-803-i-explained-kubernetes-to-my-grandma- /media/cloud-native-rejekts-eu-paris-2024/submissions/FUT7EF/Untitled_Z9bZI2h.png Matteo Bianchi en In this lighthearted and engaging lightning talk, I share my unconventional approach to demystifying Kubernetes by explaining it to my Italian grandma, using food analogies. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FUT7EF/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FUT7EF/feedback/ Arena Sponsor Keynote Speech 2024-03-18T18:30:00+01:00 18:30 00:05 This is a 5 minutes speaking slot for Champion Sponsors. cloud-native-rejekts-eu-paris-2024-1005-suse-5-mins-closing-keynote-on-community-initiatives Divya Mohan en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/WTV9DM/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/WTV9DM/feedback/ VIP Area Talk 2024-03-18T09:30:00+01:00 09:30 00:30 Dex is a CNCF Sandbox project implementing an OIDC identity and OAuth 2.0 provider that is often used in Kubernetes-based environments. A well-known issue with authentication using OIDC occurs when you need it on a CLI-only machine. For example, it affects you if you’re using Dex as the identity provider for your Kubernetes or CI system — e.g., you want to exchange the tokens from CI or Kubernetes ServiceAccount with Dex to authenticate in a simple and secure manner. Since this authentication requires performing a redirect, which is challenging in a browserless environment, you need another approach to make it happen. The OAuth 2.0 Token Exchange specification (RFC 8693) addresses this issue, yet requires you to have it implemented in your provider, such as Dex. With this feature recently introduced in Dex, keeping your cloud native infrastructure secure has become much easier. In this talk, I will explain how you can leverage the token exchange in Dex and demonstrate practical cases where it will help you. cloud-native-rejekts-eu-paris-2024-872-exchanging-third-party-tokens-in-dex-and-how-it-helps-you-to-build-a-secure-cloud-native-environment Maksim Nabokikh en Dex can perform as an essential building block of the cloud native infrastructure built on self-hosted, Open Source, CNCF-backed solutions — with which Dex easily integrates — for both production and non-production use cases. Therefore, delivering such features that encourage new applications of Dex and showcasing them is beneficial to get a bigger community of Dex adopters and potential project contributors. It becomes even more relevant when we consider a growing focus on fostering security for cloud native environments. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LLZZTA/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/LLZZTA/feedback/ VIP Area Talk 2024-03-18T10:05:00+01:00 10:05 00:30 There are many highly effective cloud native OSS security tools, which can be a blessing and a curse. It’s a blessing because there is good coverage; it’s a curse because it can be overwhelming trying to understand which tools do what. Beyond that practitioners usually don’t want a point solution, they want tools that work together. In this session, we’ll look at some key tools in the CNCF security landscape. We'll discuss how these tools secure key areas as an application moves from the developer desktop to being deployed. After attending this session, participants will have a much better understanding of not only what it takes to protect their cloud native environments but also which tools can help them achieve that goal. cloud-native-rejekts-eu-paris-2024-920-understanding-the-cloud-native-security-landscape Mike Coleman en false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/P3K7UB/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/P3K7UB/feedback/ VIP Area Talk 2024-03-18T10:40:00+01:00 10:40 00:30 Understanding what is happening in your cluster can be challenging. How can you quickly and easily tell if your cluster and apps are healthy, well utilized and running as expected? In this tutorial, we'll look at various aspects of Kubernetes observability, and present multiple OSS solutions from the CNCF landscape and beyond to achieve that. We will start with tools that simply query the Kubernetes API and deliver the output in an easy-to-understand UI (e.g. Skooner, k9s), go over sidecar-based and eBPF-based services meshes (e.g. Istio/Kiali, Cilium/Hubble UI) and end with application-side logging and monitoring (e.g. OpenTelemetry, fluentd, Jaeger, Grafana). Each level of observability demands a certain price in terms of configuration and runtime overhead. In turn the quality and depth of the information is different. The intended take-away is to get an understanding which type of tooling is the right one for a given purpose. Most options will be shown in a live demonstration. cloud-native-rejekts-eu-paris-2024-949-a-hitchhiker-s-guide-to-cncf-oss-observability-solutions-around-kubernetes Matthias HaeusslerTiffany Jernigan en Out of the box, vanilla Kubernetes provides a few tools to help with observability such as basic logging with kubectl logs and basic metrics if you have metrics-server. This alone is not enough. We don't have fine-grained metrics, logs, data retention, or tracing, for example. These things can empower you when planning cluster capacity, troubleshooting bugs, or proactively anticipating operational issues, which are all steps in being production ready. We want to help others decide which aspects and technologies should be considered when approaching observability of their clusters and apps. We will show them one way to set up an observability stack using some of the many tools in the CNCF landscape as well as other OSS technologies that we have personal experience with. We will also talk about how mature these solutions are, what they can bring now and what to expect in the future. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/8ZR3VA/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/8ZR3VA/feedback/ VIP Area Talk 2024-03-18T11:30:00+01:00 11:30 00:30 Deploying OpenTelemetry Collector on Kubernetes is straightforward with Helm charts and the Operator. However, achieving a robust and production-quality observability pipeline requires thoughtful configuration and experimentation. In this talk, Juraci and Yuri draw from their real-world experience to guide you through the process of designing and implementing telemetry pipelines in Kubernetes. They delve into the intricacies of building resilient pipelines with OpenTelemetry Collector by exploring through a live demo around topics like the load-balancing exporter, memory-limiting and batching processors, as well as the internal sending queues, delivering a production-ready telemetry pipeline. By attending this talk, you will get a deep understanding of common strategies for designing telemetry pipelines in Kubernetes and the practical knowledge to apply them effectively to your specific requirements. cloud-native-rejekts-eu-paris-2024-983-building-resilient-observability-pipelines-in-kubernetes-with-opentelemetry-collector Yuri Oliveira SaJuraci Paixão Kröhling en As contributors to the OpenTelemetry Collector and Operator, we frequently encounter users who are able to get started with those components for testing and proof-of-concept environments, but are not confident enough to run it in production. This session will empower users to reliably use the OpenTelemetry Collector and Operator in production, by explaining and demonstrating the use of strategies such as load balancing, batching, concurrency, and general resiliency techniques. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/CRAQLT/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/CRAQLT/feedback/ VIP Area Talk 2024-03-18T12:05:00+01:00 12:05 00:30 Markdown is something you are already using. But do you colocate your internal docs with code? We will unpack how to use open source to record and share tribal knowledge buried in your team's bash aliases & histories – ensuring code and internal docs will no longer diverge. We'll illustrate how Notebooks, Devcontainers, Web Components, and the VS Code platform, first conceived for analysis, excel at delivering runnable internal docs, reliably describing your team’s tasks, workflows, and solutions. An IDE for Ops is a human-centric approach that isn’t mutually exclusive with CI/CD. We will learn: 1. Open tech applied for shareable and reliable docs via notebooks 2. How to bridge terminal, browser, and editor 3. Complementary nature with existing best practices This approach paves the way to DevX & OpsX equilibrium. Allowing devs to trust abstractions (pipelines and internal platforms) while teams owning them benefit from the transparency of runnable docs' self-documenting properties. cloud-native-rejekts-eu-paris-2024-945-an-ide-for-ops-should-be-integral-to-your-docs /media/cloud-native-rejekts-eu-paris-2024/submissions/FPVXV8/markdown_3ZrdQeH.png Sebastian Tiedtke en Since the rise of the Docs as Code approach, with tools like Python’s Sphinx, Jekyll, Mkdocs, Docusaurus, and rustdoc, we've seen improved frameworks and communities helping us consistently deliver high-quality external documentation. However, what about your team’s internal docs? The docs your team relies on to develop, test, and break/fix infra, services, and do development daily? In practice, efforts to “fully script everything” fall flat, and written internal docs - a snapshot in time - are quickly outdated. Fully scripting everything (inside and outside pipelines) isn't just complex. It's often brittle, too. Especially the closer automation gets to the engineer; human interfaces starkly differ from uniform machines. This talk emphasizes the need for improved internal documentation. Documentation needs to clearly explain the WHAT and WHY, while also providing a step-by-step HOW, allowing contributors, developers, and users to better understand key aspects such as: - The purpose of different technologies and services - Navigating various platforms for project management and collaboration (like GitHub, GitLab, etc.) - Identifying personal/service credentials and user-specific configurations - Determining where and when to run scripts or pipelines, etc This approach paves the way for effective knowledge sharing. Traditionally, teams rely on intensive onboarding to acquire project-specific knowledge, without formal training or prior experience. Any existing documentation, if available, often becomes outdated quickly. Join this session to explore a better approach to maintaining up-to-date, user-friendly, and runnable documentation that spreads know-how instead of allowing it to fall into the realm of tribal knowledge. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FPVXV8/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/FPVXV8/feedback/ VIP Area Talk 2024-03-18T15:10:00+01:00 15:10 00:30 As a company, we manage hundreds of clusters across multiple users. Achieving consistent, repeatable, and verifiable configurations, all while maintaining a single source of truth, is paramount. That's why we are big fans of the GitOps approach, with a special fondness for Flux. However, the journey doesn’t end once you select a GitOps tool; in fact, it has just started. The “Day 2” problems of GitOps force you to figure out answers to multiple questions: How to structure your git repositories? How to reuse your configuration? And how do you ensure customer separation? In real life, you also have to handle aspects such as security, configuration layout migrations or providing safe extension points for your users. Oh, and even if you answer all the questions, it’s still possible to accidentally delete a cluster in a really fancy way. In this talk, I want to share our real-life experience resulting from running, structuring, migrating, and, yes, making errors with our GitOps setup. cloud-native-rejekts-eu-paris-2024-831-no-gitops-pain-no-platform-gain-day-2-challenges-of-managing-kubernetes-fleets-with-gitops Łukasz Piątkowski en GitOps has really taken flight recently and more and more companies are adopting the GitOps principles. Still, the journey only starts with deploying a GitOps tool. You have to plan and prepare the structure of your git repositories, do upgrades and migrations, and ensure monitoring and security. In this session, I want to share our most important learnings we’ve gained at Giant Swarm from solving some of these challenges head-on, while doing Kubernetes fleet management at a large scale for companies like Adidas or Vodafone. We will base our talk on the Flux project, but our learnings are universal and apply to any GitOps tool. Our discussion will include: Approaches to structuring multi-repository GitOps configs: Explore various methods, weighing up their pros and cons. How to keep your GitOps configuration DRY, but elastic: How to share, enhance, and lock the configuration, while still allowing flexibility for customers. Explaining common operations: Learn how to execute the most common duties, like adding a new app or a new tenant, when using a multi-repository setup. Identifying challenges and areas for improvement: Examine potential pitfalls and opportunities for enhancing our processes. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/KHFPCL/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/KHFPCL/feedback/ VIP Area Talk 2024-03-18T15:45:00+01:00 15:45 00:30 Various studies show that more than half of engineers suffer from imposter syndrome. Based on other sources and industries, these numbers might be even higher for women and underrepresented people. It is undeniable that imposter syndrome also has a stifling effect on community contributions. Can we dare to imagine how much potential could be unlocked if we were to provide more support to our peers suffering from it? This talk aims to bring light to the conversation around imposter syndrome and provide strategies on how to tackle it in cloud native communities. To illustrate better, the presenters will first talk about their personal experience with imposter syndrome. Together, we will explore how to recognize imposter syndrome and the role microaggressions and discrimination play in exacerbating it. The main portion of the talk will then focus on providing people with tools to overcome imposter syndrome together. cloud-native-rejekts-eu-paris-2024-849-you-re-good-enough-combating-imposter-syndrome-in-cloud-native-communities Kat YangIda Furjesova en We want our talk to encourage members of the cloud native community to actively overcome their imposter syndrome. In doing so, we aim to help individuals reach their full potential by increasing contributions, building confidence, and making the existing community more inviting for new members and underrepresented people. The presenters will use their mentor-mentee relationship as an example to illustrate the ways they support each other in overcoming imposter syndrome. Through this talk they will invite others to do the same in their own communities. false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/ZVKV3Q/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/ZVKV3Q/feedback/ VIP Area Talk 2024-03-18T16:30:00+01:00 16:30 00:30 Storage, Persistence and Databases are important parts of most Kubernetes operations. It is a broad topic which this talk tries to demystify. We will go over how Kubernetes storage works, how CSI fits into it, which storage provider options are out there, and how to select the right one for your environment. Another topic I will talk about is backups and disaster recovery, which will be covered by explaining how CSI Snapshots work and how to make your backups ransomware-proof. There are also Storage patterns that do not use normal file systems, like S3-style Object Storage and Databases. I will give you some inspiration how and where to integrate them into your applications with the goal to decrease cost and increase performance. I am going to share some practical experiences on running SQL Databases in your clusters and how to ensure reliability and ease of use. cloud-native-rejekts-eu-paris-2024-935-the-storage-crashcourse-from-csi-to-databases Benjamin Ritter en This is a overview talk targeting an beginner to intermediate level audience. The following topics are covered: - The Kubernetes Persistence Model (PVs, PVCs, Provisioning, Storage Classes) - What is CSI? - Selecting a Storage Provider (Local Path, Cloud Provider CSI drivers, Ceph, Longhorn and JuiceFS) - Backups with K8up - When is S3 a better fit - Databases in a cluster (Experiences with CNPG, Zalando Postgres and MySQL Operator) false https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/9HD3FC/ https://cfp.cloud-native.rejekts.io/cloud-native-rejekts-eu-paris-2024/talk/9HD3FC/feedback/