Opening remarks

You know that feeling when you think are done, but then you realize you are not even close and you don't have time to do anything about it?

In this talk we'll go on a journey with a developer, who just finished his application. He's happy because he's done early and there's still 24 hours before the application has to be released, but then he learns that he has 4000 vulnerabilities in his application and there's no way he'll be able to fix them all. He needs a miracle and whatever it is it needs to be automated.

We'll explore the good, the bad and the fun of minifying container images. We'll see the side effects of image minification on the existing vulnerability scanners and exploits and how they will be disrupted and broken. We'll also investigate a number of additional container obfuscation techniques that will make vulnerability scanners completely blind.

You will learn what it takes to build minimal container images and how to make sure you have only the components you need to reduce the attack surface of your containers. You will learn about what's truely necessary for your containers to function. You will also learn how it's possible to automate container image minification leveraging low level Linux kernel interfaces and application analysis.

The vulnerability scanner limitations exposed in this talk shouldn't be there. They are there because users don't demand something better. The call to action in this talk is to ask for better products and not to accept the current status quo. It's time for change!

This is a 5 minutes speaking slot for Champion Sponsors.

Your new container build system is up and running. But suddenly ops are complaining that the images are difficult to maintain and they don't even run on the ARM boxes. And users are complaining that the images aren't signed and the CVE count is through the roof. What do you do?

This talk will guide you through the basics of making your build reliable and repeatable with support for multiple architectures and a low CVE count that keeps your users happy.

We will cover:

• the importance of making your builds reproducible for security and maintainability
• building in CI/CD and the cloud
• handling multi-arch images
• dealing with updaing images and CVEs
• advanced concerns: attestations, SLSA and SBOMs

Want to save yourself time and pain? Come to this talk.

This is a 5 minutes speaking slot for Champion Sponsors.

Anyone working with Kubernetes knows how hard it is to put out a Kubernetes release. But actually, how are releases cut? This talk is for cloud-native practitioners who care about the environmental impact of their work. Focusing on insight into daily life, the tools, and the methodologies, the release engineers have a strong identity of the ecological consideration at every step.

We'll explore key aspects such as the automation tools that streamline the release process, the challenges of ensuring efficient resource usage, and the design principles that promote sustainability. Through practical demonstrations, we'll showcase best practices like optimizing CI/CD pipelines and leveraging containerization for minimal resource consumption. Participants will be equipped with actionable knowledge to enhance the sustainability of their Kubernetes releases. The key takeaway would be how the existing tools could be adapted and shared by more of the project, like image promoters.

As Kubernetes adoption continues to grow, so does the complexity of managing persistent storage, especially when dealing with pre-existing data. Imagine the case of data management softwares that would want to provision a volume with the data that was present in the source volume or the case of configuring a volume for a VirtualMachine with disk image already populated in the volume.

For all these use cases using traditional approach to populate the data is not straight forward and requires a lot of complex logic. Volume Populators is the feature that enables seamless, dynamic provisioning of volumes pre-loaded with data.

In this talk, I will demystify Kubernetes Volume Populators, showcasing how they work under the hood and how they can be leveraged to simplify data management workflows. This will also include a live demo showcasing a step-by-step setup and configuration.

This session will guide you through the process of building a complete observability stack from the ground up using raw telemetry data ingested directly into a datastore, combining a variety of open source signals including OpenTelemetry and Prometheus formats.

We’ll start by leveraging our existing telemetry — likely logs and metrics — for maximum effectiveness — because telemetry without action is just storage. We'll delve into the foundational aspects of creating OLAP cubes, essential for efficient data analysis and real-time insights. We’ll transform and enrich telemetry data to make it actionable — and show how to optimize storage and query performance to handle large-scale data with ease.

We’ll use this data for creating insightful visualizations with tools like Perses. I’ll show how to create well-formed time-series data even when the underlying data has gaps or varying granularity, and we’ll add robust alerting.

Drawing from experience with proprietary and open source observability tools, we’ll then evolve our monitoring by filling in instrumentation gaps and adding application telemetry. We’ll use automations like eBPF to fully observe a massively distributed cloud database offering.

This talk will equip you with the knowledge to implement a scalable, secure, and efficient open source observability stack tailored to your unique needs. Whether you're starting from scratch or looking to enhance your existing observability infrastructure, join me to discover practical strategies and innovative solutions that you can implement today.

Kubernetes does a lot of things well, but it's not the only orchestrator. Did you know Meta's Twine orchestrator has millions of machines in a single cluster, Google's Borg doesn't run OCI containers, Amazon ECS has no API versions, and Hashicorp's Nomad is a single binary with built in scheduler and cluster federation? There are opportunities to look at past and present systems to learn about features and architecture decisions that can benefit Kubernetes too.

As the complexity of your Kubernetes environments grows, so does the complexity of debugging all that complexity. Developers face issues such as replicating the environments locally to test features and/or bugs properly. Developers also face the problem of debugging packages and package dependencies, as images are sometimes sourced from an entire Linux operating system like Ubuntu. Lastly, when multiple environments use non-essential components, tracking the root cause and debugging the configuration drift between environments becomes a nightmare. Not to mention storage and network bandwidth costs, which are notoriously high in cloud environments.

Minimalistic images enhance the development and operational aspects of software projects for developers. They enable more efficient, secure, and reliable software delivery, particularly in agile and DevOps environments where speed and security are paramount. Ephemeral containers are designed to be short-lived and are often used for specific tasks like debugging or running temporary jobs. When combined with minimalistic images, the result is a highly efficient, focused, and secure environment.

In this talk, we aim to identify the operational cost of using bloated images and offer a better path forward for increased efficiency, security, and maintenance in the context of debugging and error resolution. This ultimately leads to operational bliss, allowing the developer to focus on pushing features and increasing productivity.

Picture yourself in a cozy after-work evening spent with your lovely Kubernetes-aware grandma. She asks you about your day, which you mostly spent working with eBPF. Can you describe it in gradma-friendly words?

We know our sweet spot is the kitchen lingo, so we'll uncover the secrets of eBPF to our grandmas, presenting it as the secret ingredient for transforming a tiny family-owned restaurants into a Michelin-star kitchen brigade.

Leveraging our trademarked Grandma Benchmark™, we'll use simple food analogies to explain eBPF for those that never head of it. The session will cover the basics of the technology and the current state of the art, how it enables real-time analysis of network packets, and how it's employed in large-scale cloud native projects. We will explore a parallelism between eBPF and how chefs orchestrate their kitchens, to ensure all food is served with top-notch quality, with no client getting food poisoned (or hacked).

Congrats - you’ve finally deployed a new ultra-secure “distroless” image with no shell, package manager or extraneous utilities. All was great until you hit an issue in prod and now you’ve no idea how to debug it!

Join me for a hands-on demonstration of various ways to troubleshoot these images without sacrificing the security as well as a discussion of the pros and cons of adopting distroless.

Some of the base image types we'll research:
* Google Distroless
* Wolfi
* scratch

This talk will showcase, through use-cases, how & why to collect OS-level data using eBPF & feed it into CNCF observability tools; Prometheus, OpenTelemetry, Headlamp, etc. We’ll discuss which situations eBPF is good for, learn what characteristics to consider & learn how to find, manage & interact with eBPF programs.

We’ll first use low-level tools & libraries to implement the data pipeline then move to high-level tooling that takes care of much of the tedium of working with eBPF. For this we’ll make use of the CNCF project Inspektor Gadget.

Use-cases we will demo:
* Generating alerts anytime a shell is opened on your system
* Profiling performance of a slow running app
* Investigating a crashing app by generating an strace-like log across your cluster
* Investigating network latency issues in a cluster

By the end of the talk the audience should have practical knowledge of working with eBPF & a good understanding of the tools that are available to help them with their tasks.

As the demand on software availability and proximity to our end-users trend towards a more diverse set of deployments for better availability and faster connectivity, whether in Cloud or at the Edge, the requirements on our delivery capabilities continue to challenge existing solutions. While Kubernetes and Service Meshes tackle a number of use cases in the Cloud today, our customer needs have already evolved beyond those capabilities

To meet these ever-evolving deployment scenarios and increasing set of use cases this talk will introduce two CNCF projects, NATS and wasmCloud, that work harmoniously together to address exactly these types of demands

We will start with an overview of the foundational concepts for each technology, work through a number of real-world use cases with examples and end the talk with practical takeaways on how to get started today using these for solving your problems along with guidance on how to navigate the journey beyond basics

When you jump in the CNCF Sandbox you will soon (may be approved by the time you see this) meet the new kid, a visualization and dashboards project called Perses. This session will provide attendees with the basics to get started with integrating Prometheus, PromQL, and more with Perses. A journey will be taken from zero to beautiful visualizations seamlessly integrated with Prometheus. This session leaves the attendees with hands-on self-paced workshop content to head home and dive right in to creating their first visualizations and integrations with Prometheus and Perses!

In the world of Kubernetes, dynamic admission controllers have long played a pivotal role in enhancing clusters. For instance, ValidatingWebhookConfiguration empowers users to implement finely-tuned access controls beyond the capabilities of RBAC and MutatingWebhookConfiguration provides advanced defaulting logic. However, this capability often comes at a price – the ease with which they can be misconfigured, potentially leading to cluster disruption and downtime.

Historically, we’ve accepted this fragility as an inevitable trade-off for greater control over our clusters. But what if we could change that narrative?

Enter CEL-based Admission Policies!

In this talk we’ll take a look at what makes admission policies a safer choice for your admission logic and what problems they aim to solve. We will dive into the features and limitations and will also draw comparisons with alternatives, highlighting the problems they solve.

If you’ve ever asked yourself the question, “I’m running Cluster Autoscaler right now, should I switch to Karpenter?”, then this talk is for you! These two projects are alternative solutions for autoscaling nodes in a Kubernetes cluster based on demand. While they share many similarities, there are some important differences as well–differences that can have a meaningful impact on the cost and reliability of your infrastructure. Join us for a data-driven review of the features and limitations of each option. Attendees will learn how workload configuration and cloud inventory affect the decision making process. By examining data from controlled experiments in simulated and live environments, the presenters will illuminate important areas of focus to evaluate when making your choice. At the end of this presentation, you will be equipped with data and tools needed to discover which autoscaler is best for your use case.

Nix is a unique package manager for configuring systems!
It's reproducible and declarative and makes reliable systems.
What does it look like to use Nix in the Cloud Native world?

Do I Nix my development environment?
Do I use NixOS to run production?
Can Nix replace my Dockerfiles for building containers?

In what fun ways can we use Kubernetes and Nix together?

Come join in for a primer and tour of the Nix universe as it applies to us cloud-native nerds!

As always, expect live demos and some performance art :)

In this talk we will explore the complexities of managing stateful Kubernetes workloads in modern cloud environments.

Maintaining state is crucial for many workloads, but existing application-layer solutions like Postgres's WAL or Cassandra's node replication only ensure data consistency - they don't prevent downtime when nodes go offline or are interrupted.

To address these challenges, we introduce container state replication, a new approach that enables zero-downtime migrations for stateful workloads on Kubernetes.

We will then introduce Drafter, an open-source framework that can standardize live migration on Kubernetes. The session will feature a live demo showing Drafter's ability to replicate and migrate stateful workloads on Kubernetes across continents without downtime or network disruption.

Attendees will learn about the limitations of traditional application-layer replication solutions and how container state replication can enable true zero-downtime live migrations.

SPIFFE promises to be an industry game-changer using workload identity to empower platform engineering and security teams to deliver highly automated and secure intra-service communication across any cloud or platform. Workloads that run in the cloud invariably will begin life on a laptop. For developers to properly embrace SPIFFE and build highly automated, identity-aware applications, they need to test their applications with SPIFFE natively into their local environment.

This session will provide valuable insights and practical solutions, allowing developers to test their applications locally end-to-end and ensure seamless integration with other microservices applications, enhancing their work efficiency and productivity. It showcases the different solutions for getting SPIFFE Verifiable Identities to workstations and extending existing SPIFFE infrastructure to the edge.

Virtualization is ubiquitous in the modern cloud era, and understanding virtualization is crucial for building cloud applications. One of the emerging virtualization technologies is WebAssembly, which has been claimed as the third wave of compute, alongside virtual machines and containers. This talk explores the history and evolution of virtualization, and the audience will learn how virtual machines, containers and WebAssembly work. This talk will compare and contrast different virtualization technologies, highlighting their unique strengths and weaknesses by focusing on four critical areas of virtualization:

• Resource utilization
• Portability and manageability
• Application deployment
• Security

Attendees will have a deeper understanding of classical virtualization and delve into a more unfamiliar world of WebAssembly, and know how to leverage on the strengths of each technology and make informed decisions about their usage in various scenarios.

In the evolving cloud native landscape of software development, the paradigm of "shifting left" has championed embedding security, and its complexity, into the development lifecycle (SDLC). Platform Engineering challenges that convention by advocating for a "shift down" strategy—integrating a strong security posture as a core component of the platform, particularly with Kubernetes, rather than overwhelming the development teams.

Platform engineering teams can embed governance and scalable security controls within the infrastructure, freeing developers to focus on code and business value, instead of being an afterthought or a blocker for the developers productivity.

With this talk, attendees will walk away with real life examples based on successful implementations for regulated entities like financial companies, including actionable best practices about cloud native security controls and threat models.

In this session, the speaker will dive into the problem of log collection and processing in Kubernetes environments. Despite there are many tools and projects that one can use to collect logs from k8s environments, not all the details are always covered and well understood.

The speaker will explore how different container runtimes can produce different log formats and what operations are required in order to extract useful information from them. With this session, the speaker will present how a complex set of operations required, can be simplified by using the Opentelemetry Collector's native support for container logs' parsing and how this can play along with logs coming from instrumented applications. In addition, the speaker will run a live demo for some common scenarios to illustrate how OpenTelemetry ecosystem aims to make k8s logs' collection and processing robust and easy.

Last but not least, as an active contributor, the speaker will share the latest project's updates (and what is coming next) providing the audience with a clearer understanding of the ideal logs processing landscape and inspire individuals to actively participate in the ongoing efforts within the OpenTelemetry ecosystem.

Being in a Nigerian university, depending on what state you school sometimes means that your education falls short in terms of the problems we are exposed to and the topics we explore in class.
To fill this gap we formed NARSDA, a small group primarily focused on astronomy based research, this semester we decided to take our heads out of the cloud and focus on some local problems facing your school.
In this session we will discuss how we built an edge device to monitor atmospheric conditions in our school, how we leveraged Prometheus, grafana and MQTT to collect and generate meaningful insights from the data and finally how we plan on using the data to cut down emissions and possibly save an endangered bird native to our local.

We’ve all heard the saying “It’s not about the destination, it’s about the journey,” well the same can be said of database Operators. It’s not about which Operator you are using to deploy your database to Kubernetes it’s about what you are trying to accomplish with what you are deploying.

A quick search on OperatorHub.io lists 49 Database focused Operators and 11 PostgreSQL operators. Each have their own speciality and each have their own lifecycle. Choosing one today as it’s best fitting may no longer be the case soon. I argue that ranking one as better than the next is ineffective, instead you should be focused on the ‘what do I want to do,’ with my database deployment.

This talk will focus on how to use the newest concepts in scaleable database deployment to stop worrying about the “how” and refocus again on the “what”.

In a long running distributed service, time takes a toll, tech debt eats at it. Rising tech debt causes fear of augmenting the system with new features, and inevitably leads to heavy ops, and starts taking a toll on maintenance. In this talk, I present a real example of how Azure Cloud Shell addressed a large tech debt by migrating from a self-managed K8s to a managed serverless infrastructure, through A/B methodology, and the learnings incurred along the way!

Have you ever wanted to enjoy the benefits of a service mesh but didn't want to deal with all the overhead? Projects Linkerd, Knative, and Istio are all highly capable and advanced platforms! But they come with non-trivial installation and management burdens.

What if you could leverage some of the features and power of a service mesh without the overhead? Good news: you can!
This talk will show you how you can run two different, ultra-lightweight solutions to provide some of the powerful service mesh features you love without all the mess. Agenda:

1. The basics of xDS
2. Using a ConfigMap and a sidecar to get service mesh features without a control plane
3. Running a custom lightweight xDS control plane and smart gRPC clients to get service mesh features without a sidecar

In short: How you can get the features you want with a sidecar and no control plane; or a control plane with no sidecar.
Like chocolate and peanut butter: they go great together, but are also great on their own!

Cloud-based serverless applications often face the challenge of cold start times, which can significantly impact user experience. This presentation explores Unikernels, a lightweight virtualization technology that offers a promising solution. Unikernels, characterized by their minimal footprint, contain only the necessary application code and dependencies, resulting in significantly faster boot times compared to traditional VMs.

Specifically, this talk will will delve into the synergy between Unikernels and WebAssembly (WASM). WASM is a binary format for efficient execution of code on the web. We will discuss how Unikernels can be effectively utilized to deploy WASM applications on public clouds, providing efficient hardware-isolation and addressing the cold start problem. By comparing Unikernels with existing approaches like SPIN, we will highlight the unique advantages and potential use cases of this technology.

In the words of Dr. Seuss (or how close I can get to imitate it without GenAI)
Come along, let's explore this land,
Of Unikernels and WASM, hand in hand.
Discover their secrets, their magic and might,
A cloud-computing journey, a wondrous sight.

Are you grappling with the complexities of managing K8s for your application developers? Join us for an insightful session where we share how Intuit has evolved and abstracted its platform and the journey toward migrating 1k+ services to the abstracted paved road.

At Intuit, developers spent more time on infrastructure configuration than coding, and adding to standardization drift. To address this, we developed an AI-native abstracted platform where developers define just the app intent, while platform teams handle infrastructure configuration. This reduces the burden of managing K8s complexity, restores standardization, and eliminates cognitive load for developers, thereby increasing dev velocity.

In this session we will cover the challenges of direct Kubernetes management; our journey to developing an abstraction layer, migrating services, real-world benefits, and lessons learned of an abstracted platform.

When an AI model misbehaves (e.g., it tells you to put glue on pizza), you must investigate how this happened. Sometimes these are accidents caused by the training data, but these incidents can also be due to nefarious activities – we’ve seen ML malware deployed in 2024. At the end of the day AI is still software, so security needs to be established around its creation. The same transparency and accountability must be enforced as with other parts of the software supply chain. Utilizing SLSA (Supply Chain Levels for Software Artifacts) and GUAC (Graph for Understanding Artifact Composition), we can determine the provenance of each dataset and the composition of each model. In this talk, we dive into the anatomy of AI model attacks: identifying bad models, determining the root cause of badness, and finding the blast radius of models affected. Once the data is collected, we can create an SBOM and distribute with the AI model provenance to meet compliance and transparency requirements.

Deploying large OSS LLMs in public/private cloud infrastructure is a complex task. Users inevitably face challenges such as managing huge model files, provisioning GPU resources, configuring model runtime engines, and handling troublesome Day 2 operations like model upgrades or performance tuning.

In this talk, we will present Kaito, an open-source Kubernetes AI toolchain operator, which simplifies these workflows by containerizing the LLM inference service as a cloud-native application. With Kaito, model files are included in container images for better version control; new CRDs and operators streamline the process of GPU provisioning and workload lifecycle management; and “preset” configurations ease the effort of configuring the model runtime engine. Kaito also supports model customizations such as LoRA fine-tuning and RAG for prompt crafting.

Overall, Kaito enables users to manage self-owned OSS LLMs in Kubernetes easily and efficiently, whether in the cloud or on-premises Kubernetes clusters.

Modern video games, even if retro, need to make optimal use of CPU and GPU and increasingly incorporate a number of technologies including spatial/3D, XR, and various types of AI. You know the ones… generative, vector search, RAG, and all the other buzzwords. “Pods of Kon” is a completely (including all media and assets) open source video game (https://bit.ly/podsofkon), first shown at KubeCon 2023 in Chicago. The game both runs on and is about Kubernetes. Its object is to derezz and spawn targets which map to corresponding Kubernetes microservices on the backend that then scale, crash, and recover/compensate. A WASM service is used as the backend controller for access to the various data types and services used by the game including JSON, relational, spatial, graph, and so on.

In this session, we explore the game’s architecture and how each component is optimally used and demonstrate how to build a classic ‘80s video game of the modern age using cloud native patterns.

Your team wastes hours each day constructing sequences of operations to accomplish tasks. Foyle is an AI that translates an operator’s high level intent (e.g. deploy this python code on a GPU) into a sequence of operations (e.g. kubectl commands). Foyle learns this translation automatically, reducing the need for platform teams to create handcrafted tools.

Foyle is an open source AI (foyle.io). To train itself, foyle uses vscode and RunMe.Dev to make playbooks executable. This UX allows Foyle to log intents, actions and human feedback. Using this data, Foyle continuously improves its ability to translate intent into operations.

In this talk you will learn: 1) how we model operations as a sequence prediction problem perfect for LLMs 2) how we create a UX that logs implicit human feedback and 3) how we use this feedback to retrain the model.

This talk will show platform engineers how to use AI to build the next generation of platforms and not just enable AI for others.

If you have not heard of there is a little wave topic of generative AI happening right now, in this session we will get into the world of Vector databases and how Vector databases are particularly well-suited for AI workloads, as they can efficiently store and process high-dimensional data.

This session will help the audience understand how and where to use Vector databases by way of demonstrations. Everything so far sounds amazing and who wouldn't want to learn more about the latest craze, well we also want to arm you about the bad things that happen with data and the dark side to databases in general and how to mitigate that risk of losing this important asset.

Demo heavy session, with the hope that the audience are engaged and educated about the topics of Gen AI and the role Vector Databases have here but also the dark side... it’s not all ChatGPT and ChatBots, a lot of valuable data get embedded into these mission critical databases... You do not want to lose that!

This presentation explores the effectiveness of different runtime threat detection tools in Kubernetes by analyzing real-world attack scenarios. We will discuss real-life incidents in Kubernetes environments that have been reported, covering both external container takeovers, supply-chain attacks, and incidentally open services.

We will take three different runtime threat detection solutions, two open-source and one commercial, and analyze their efficiency via the real-life incidents that aforementioned real-life incidents.

We will cover approaches like rule-based detection, anomaly detection, and XDRs. Attendees will gain insights into their strengths and weaknesses, and how they respond to typical Kubernetes security threats.

Ready to rethink how you handle databases in your microservices? This talk dives into how pairing PostgreSQL with Kubernetes through CloudNativePG can help you break free from vendor lock-in and streamline your database workflows. We’ll cover practical tips on continuous delivery, database changes, and security—all designed to help your team move faster and work smarter.

Deploying large language models (LLMs) is inherently complex, challenging, and expensive. This case study demonstrates how Kubernetes, specifically Kserve with Modelcar OCI storage backend, simplifies the deployment and management of private LLM services.
First, we explore how Kserve enables efficient and scalable model serving within a Kubernetes environment, allowing seamless integration and optimized GPU utilization. Second, we delve into how Modelcar OCI artifacts streamline artifact delivery beyond container images, reducing duplicate storage usage, increasing download speeds, and minimizing governance overhead.
The session will cover implementation details, benefits, best practices, and lessons learned.
Walk away learning how to leverage Kubernetes, Kserve, and OCI artifacts to enhance your MLOps journey, achieving significant efficiency gains and overcoming common challenges in deploying and scaling private LLM services.

The OpenTelemetry (OTel) Operator is a great tool that helps make your life a little easier by managing OTel for you in your Kubernetes cluster, by:
Managing the deployment of the OpenTelemetry Collector
Managing the configuration of a fleet of OpenTelemetry Collectors via OpAMP integration
Injecting and configuring auto-instrumentation into your pods

But what happens when THINGS. DON’T. WORK??

In this talk, Adriana and Reese will cover:
* An overview of the OTel Operator
* Common installation issues
* Common auto-instrumentation issues
* Common OTel Collector deployment issues
* …and how to tackle them all

Attendees will walk away from this session with a better understanding of how they can leverage the Operator, and be empowered to use it with confidence.

A new era of cloud-native applications that are secure by default is emerging. From zero-vulnerability container images to container runtime isolation, we’ll learn how to build secure-by-default Kubernetes applications that don't require complex policy configuration or constant log monitoring.

One of the super powers Kubernetes gives us is our ability to expand the API, modeling our architectures and dependencies with CRDs, leveraging Kubernetes as a platform for building platforms. Getting something up and running can take just minutes, but debugging synchronization problems and unexpected behaviors can take days or weeks for folks just starting out. Compound this problem with a lack of advanced controller creation advice, and a lack of direction on the norms and expectations around spec/status and behavior, and it is easy to see how even hardened engineers with years of experience can fail on their first attempts at writing their first Kubernetes based declarative API.

We cover will some common mistakes and mis-understandings around reconciliation, and explain what we can do instead. And look at unspoken norms around API shapes in spec and status, explain why they are useful, and send you on your way with new found confidence to wield the power of a platform developer.

LinkedIn operates a fleet of several hundred thousand bare metal machines to run thousands of stateless and stateful systems. To operate this fleet, we’ve been building our own bespoke Kubernetes compute management stack to replace an in-house orchestrator.

In the Kubernetes-native ecosystem, GitOps is the go-to approach for deploying applications, with ArgoCD leading the charge by syncing Git repositories with Kubernetes clusters. However, while ArgoCD excels at maintaining deployment consistency, it may not suffice as a standalone continuous deployment (CD) tool. This discussion explores ArgoCD’s limitations, including gaps in security checks, automated rollouts, SLO based rollbacks, and support for advanced branching strategies, questioning whether it can truly be considered a silver bullet or if it should be part of a broader GitOps CD strategy.

Kubernetes is a complex beast. Luckily there are many tools to help tame it, but how complex are those tools themselves? One way to lower the learning curve for new users of Kubernetes and its tools is to have a good graphical user interface (GUI) for them, but do all those tools have a GUI? And how consistent is the user experience between them?
Headlamp is a CNCF Sandbox project that provides a great user experience as a Kubernetes GUI, and is extensible through plugins. With its recently added plugin catalog, users now have the possibility to easily install plugins plugins from 3rd party publishers.
This talk will give a brief overview of Headlamp as an extensible UI and go deeper into how developers can publish GUIs for their tools as Headlamp plugins, in an independent and easy way though ArtifactHub.

The open source community can be siloed at times. People tend to ‘stay in their lane’ and don’t realize what they may be missing out on by not expanding their network. I know time is limited and it’s impossible to participate in every community so how do you become like Kevin Bacon? How do you set yourself up to be connected to people in various communities that you may be able to help or vice versa without being present at every meeting? I’m going to show you how you can channel your inner Kevin Bacon and learn how to expand your network like your funding counted on it!

Flatcar Container Linux was recently accepted into the CNCF, as the very first cloud native operating system. This is a major milestone in the evolution of an OS with a history going back a decade to the original CoreOS, and naturally leads to the question of what comes next. In this lightning talk, we will share where the project is at, and where it is headed as part of CNCF. We will cover governance, community development, recent technical developments, product roadmap, and eventual path to CNCF Graduated status.

Developer Experience (DevX) is a key concept in Platform Engineering and in the cloud native ecosystem. Its primary goal is to empower developers, allowing them to focus on their code and generate business value rather than dealing with Kubernetes and infrastructure complexities.

Thanks to the Open Container Initiative (OCI) standard, the rise of cloud native runtimes has revolutionized how teams build and deploy applications. Developers leverage the same containerized approach from their local development workflows to remote environments. But this still exposes some inherent complexities. What is the right level of abstraction? How to reduce the cognitive load? How to shift down to the platform rather than shift left to the developers?

Let’s see in action how we answer these questions with Score, an open-source workload specification that enables developers to deploy their workloads across a spectrum of runtime platforms like Docker Compose, Kubernetes and more.

Free yourself from the chains of YAML. Collaboratively and visually explore every CNCF project live in the multi-player, multi-cluster Kubernetes environment of the Cloud Native Playground. Experience the self-service empowerment of platform engineering through the extensible cloud native manager, Meshery. With 220+ integrations and a git-integrated collaborative flow, we will explore the sprawling set of patterns and best practice templates for cloud native infrastructure architecture and operation found in the Meshery Catalog. Witness firsthand how individuals are capturing their hard-
learned principles of design and publishing them as public patterns available for the open source community to iterate and create a larger and more diverse set of cloud native patterns.

This is a 5 minutes speaking slot.