2025-03-30 –, The Nash
Shipping both the OS and Kubernetes as immutable, verifiable images sure has benefits for security, supply chain management, and compliance. But don't we just shift the load from security to operations? Doesn't the lack of flexibility and the restrictiveness add significant overhead for developers and operators?
Quite the opposite! In this talk, we present how immutable Kubernetes images on an immutable operating system can help separate the concerns of distribution and Kubernetes maintenance, simplify day 2 operations, and make in-place updates painless. The talk will discuss systemd-sysext and the benefits it brings to the Kubernetes ecosystem. We will showcase production ready provisioning-time node composition in ClusterAPI, and dive into OS level live in-place updates, illustrating our concepts with live demos throughout the presentation. All demos in our presentation are simple and self-guiding; our audience will easily be able to reenact at their own leisure.
Thilo is an engineering manager for Microsoft and works on Linux OS distributions and Linux Security at Azure. Thilo's team helps maintaining Flatcar Container Linux. He has given talks at FOSDEM, FrOSCon, KubeCon, Open Source Summit, Cloud-Native Rejekts, and various meetups like Kubernetes Community Days.
Thilo started his career in embedded systems with hardware design and roll-your-own /from scratch embedded Linux, kernel and plumbing level development, and later virtualisation. After working for various cloud providers in engineering and management positions, he went full cloud native in 2019. Nowadays Thilo works on operating systems for cloud-native environments with a special focus on Flatcar Container Linux.