KubeDay Colombia 2024

I am going to share the evolution that Kubernetes has had since the beginning of its history, the impact it has had on the technology market and its future. I am going to share my vision from the experience of having worked in 3 of the main contributors to Kubernetes technology. Google, Red Hat and VMware.

As organizations increasingly utilize container images for their production workloads, securing them becomes more critical. What happens if the vulnerability scanners used to scan these images contain vulnerabilities themselves? This talk will explore the hidden risks associated with container vulnerability scanning tools and how to mitigate these potential threats. Container vulnerability scanning tools, like any other software, can have vulnerabilities. If not regularly updated and patched, they can become targets for attackers who exploit these weaknesses to compromise critical systems. Also, these tools often require elevated privileges, leading to misuse or unauthorized access, posing significant security risks. After this session, you'll learn: - False positives and false negatives - Identifying dependency issues - Strategies for isolation and segmentation - Secure configurations - Managing permissions and access - Applying defense-in-depth strategies

The complexity of Kubernetes, combined with the dynamic nature of Role-Based Access Control (RBAC), presents unique security challenges, particularly regarding user actions and access control. This presentation delves into Kubernetes auditing mechanisms to track user activities and analyze potential security issues arising from misconfigured permissions, roles, or user activities. Examination of the Kubernetes auditing landscape, detailing the structure of the Kubernetes Audit API and the critical events that need monitoring. Moreover, we provide a thorough analysis of common user-related security issues within Kubernetes, such as privilege escalation, unauthorized access, and resource misuse, explaining how auditing can be instrumental in their early detection and mitigation. The goal is to equip administrators and security teams with actionable audit insights to protect their Kubernetes deployments against the ever-evolving cyber threat landscape.

We will embark on a journey to unravel the world of Kubernetes resource management, shedding light on foundational primitives and uncovering best practices and real-world scenarios over a 90-minute lab session. We'll demonstrate how requests play a pivotal role in Kubernetes scheduling. We'll delve into the pod Quality of Service (QoS) and its importance in a real-world scenario of node pressure. We will determine pod usage over key cAdvisor metrics, pinpointing a typical situation of a pod being throttled and impacting performance. We will deploy Resource Quotas and Limit Ranges while explaining the lessons learned in multi-tenancy on large Kubernetes deployments. By the end of this session, the audience leaves the room with a clear understanding of how to avoid performance degradation, avoid outages, provide better multi-tenancy, and ultimately reduce cloud costs.

In this comprehensive session, "Mastering Kubernetes Operators with KubeBuilder: Sending Metrics to Prometheus," you will learn how to build and deploy a Kubernetes operator using KubeBuilder, an advanced framework for building Kubernetes APIs. This talk will walk you through the entire process of creating a custom operator, from the initial setup to handling complex resource management. Once your operator is up and running, we will delve into monitoring and observability by integrating it with Prometheus, a leading open-source systems monitoring and alerting toolkit. You will learn how to expose custom metrics from your operator and configure Prometheus to scrape these metrics, providing valuable insights into the health and performance of your Kubernetes workloads.

There’s no one-size-fits-all approach to Kubernetes autoscaling. Fitting the right pieces together requires a deep understanding of the various autoscaling dimensions and the open-source projects that can plug in to meet specific use cases. This session will explore the three key dimensions: cluster, horizontal, and vertical. We’ll start with the tools built into Kubernetes before moving onto the more advanced open-source projects—Karpenter and KEDA, which enhance flexibility and efficiency for each. Attendees will learn: - Strategies for cluster, horizontal and vertical autoscaling, their challenges, and solutions that improve on or replace them - How to assess workload requirements to choose the right mix of autoscaling tailored to specific app needs - Best practices to optimize deployments for peak performance and cost-efficiency for dynamic workloads

The accelerated advancement of technology has exposed a problem: traditional CI/CD processes are no longer sufficient. While these methods have successfully served their purpose, the current developer experience is hindered and testing new features demands substantial resources and complex infrastructures, especially when the size of teams and the complexity of platforms increase. Ephemeral environments offer a powerful solution to this challenge: accelerate release cycles, improve cost efficiency and enhance the developer experience. This talk will focus on understanding ephemeral environments, use cases, and how to transition from a traditional CI/CD model.

Karpenter is a Kubernetes node lifecycle manager launched in 2021 by AWS, it has joined the CNCF SIG Autoscaling and transitioned to the beta phase. Karpenter has become a de facto standard to maximize the scaling properties of Kubernetes, it has been adopted already by Azure into their managed Kubernetes service. As Kubernetes gains widespread adoption across organizations for mission-critical workloads, it becomes crucial to establish standardized approaches to scaling. This encompasses not only the technical aspects but also the rationale behind scaling decisions and the appropriate timing for it. Additionally, it is imperative to evaluate the costs, encompassing operational overheads, cognitive complexities, and environmental repercussions. In this session, we will examine best practices ant techniques that strike a harmonious balance between optimizing performance, controlling costs, and promoting sustainability within Kubernetes environments with Karpenter.

Modern applications, especially those running on containerized platforms like Kubernetes, demand a high level of observability to ensure performance, security, and stability. DevOps practices are crucial, but achieving true visibility into complex Kubernetes environments can be challenging. This talk introduces the concept of Observability Maturity specifically within the context of Kubernetes and OpenTelemetry. We'll explore how to leverage OpenTelemetry, a vendor-neutral observability framework, to instrument your Kubernetes applications and achieve a mature level of observability.