Cloud Native Rejekts NA 2021
2021-10-09
-- online --
as the organisers put it
Schedule, talks and talk submissions for Cloud Native Rejekts NA (Los Angeles + Hybrid) 2021
who it's for
platform engineers, site reliability engineers, kubernetes operators, security engineers, open-source project maintainers, Go developers
topics
Go dependency analysis; eBPF probes for Kubernetes; container escape and privilege escalation; OpenTelemetry tracing with Linkerd; Ray hyperparameter search on Kubernetes; Kubernetes feature migration issues; Envoy API gateway (Emissary Ingress); Terraform driving Helm releases; PSP to OPA Rego migration; Wasm runtimes on Kubernetes (Krustlet/Wasmtime); Tinkerbell bare metal provisioning
| title | author | length |
|---|---|---|
| depstat: Analyzing a Go Project’s Dependencies | Arsh Sharma | 20m |
depstat is a CLI that computes four concrete metrics—number of direct deps, transitive deps, total deps and max depth—and exposes subcommands depstat stats… | ||
| Bringing the power of eBPF tools to your k8s web UI | Marga Manterola, Joaquim Rocha | 28m |
Built a kubernetes-aware eBPF workflow: Inspektor Gadget runs a gadget pod daemonset and a kubectl plugin to inject BCC/eBPF probes per node and translate pod… | ||
| Hijack a Kubernetes Cluster - a Walkthrough | Nico Meisenzahl | 34m |
A vulnerable ping web app allows command injection (semicolon) to spawn /bin/bash and open a reverse shell to an attacker VM; from the container the mounted… | ||
| There’s No Free Lunch but Can I Have a Free Sandwich With Observability? | Łukasz Piątkowski | 29m |
A full observability stack uses Linkerd plus Nginx Ingress Controller, Prometheus, Jaeger, Loki (via promtail) and Grafana to extract metrics, logs and traces… | ||
| Ray on Public-Cloud k8s - experiments, lessons & best practices | Madhuri Yechuri, Chi Su, Anne Marie Holler | 28m |
Runs Ray + Ludwig Tune hyperparameter search across 12 tabular datasets with up to 300 epochs per job and some single runs equivalent to 30 days of compute… | ||
| Avoid Spikes: Unexpected Kubernetes Behaviors | Joe Thompson | 26m |
Kubernetes releases three times a year and that cadence causes surprising breakage: pod security policy deprecated in 1.21 removed in 1.25 forces migration off… | ||
| Growing the Community around CNCF Incubation project Emissary Ingress | Cindy Mullins | 20m |
Emissary Ingress is an Envoy‑based Kubernetes API gateway that reached CNCF Incubation after v1.0 (Jan 2020) and a 2.0 developer preview; project metrics… | ||
| Don’t Read the Manual: Automating Helm Provisioning with Terraform | Scott Reu | 31m |
Shows Terraform driving Helm by creating a GKE cluster and a Helm release that runs Vault, with Terraform changing 5→7 Vault pods and producing a new Helm… | ||
| Say goodbye to PSP! Migrate your PSP rules to OPA with no hassle | Stefano Chierici | 28m |
PSP is scheduled for removal in Kubernetes 1.25 and this shows an automated migration path: kube-policy-advisor scans a live cluster or a single YAML and runs… | ||
| Troubleshooting Kubernetes CRDs is too damn hard | Nick Young | 26m |
Argues that the true usability metric for CRDs is the troubleshooting distance — how many kubectl calls it takes to find a root cause — and shows concrete… | ||
| How We Can Create a Thriving Wasm Ecosystem | Taylor Thomas, Matt Butcher | 31m |
Overview of concrete tooling and results: Wasmtime runs WASI modules with ahead‑of‑time caching and experimental preinit that cuts startup to microseconds… | ||
| Tinkerbell, a deep dive into the magic of cloud native bare metal | Daniel Finneran | 29m |
Tinkerbell is a microservice workflow engine that provisions bare metal by pulling containerized actions into an in‑memory OS (hook/linuxkit) and executing… | ||
| Talk Deep Dive | Arsh Sharma, Mark Coleman | 10m |
A small three‑month CNCF mentorship project builds and merges depstat into the Kubernetes repo, implemented as a cobra CLI and wired into a prow cron job that… | ||
| Talk Deep Dive | Marga Manterola, Joaquim Rocha, Mark Coleman | 13m |
eBPF tooling that maps kernel tracepoints to Kubernetes pods by matching mount and PID namespaces actually exists as Inspektor Gadget, providing two streams of… | ||
| Talk Deep Dive | Nico Meisenzahl, Vincent Batts | 04m |
Demo shows cluster hijack is frighteningly easy and argues security pods belong in every build pipeline. Concrete fixes: don't run privileged pods, use… | ||
| Talk Deep Dive | Łukasz Piątkowski, Andrew Randall | 08m |
Explains how Kubernetes observability is practical today with demo code published and reusable libraries and shows that metrics use Prometheus as de facto… | ||
| Talk Deep Dive | Madhuri Yechuri, Chi Su, Anne Marie Holler, Andrew Randall | 10m |
Compares traditional cluster autoscaler to a policy-aware nodeless controller that chooses spot/preemptable VMs or Fargate based on app SLOs, and runs as an… | ||
| Talk Deep Dive | Joe Thompson, Chris Kühl | 19m |
Kubernetes often surprises because its architecture produces expected-but-different outcomes: nodePort bypasses network policy in some CNIs so external traffic… | ||
| Talk Deep Dive | Cindy Mullins, Vincent Batts | 11m |
Emissary Ingress enters CNCF incubation in spring 2021 and immediately shows measurable community growth with increased Slack channel activity and more user… | ||
| Talk Deep Dive | Scott Reu, Vincent Batts | 07m |
Argues that Terraform handles imports and idempotency so it’s the practical choice for stateful infra, and shows patterns to manage Helm charts via Terraform +… | ||
| Talk Deep Dive | Stefano Chierici, Andrew Randall | 12m |
Explains why PodSecurityPolicy is limited and shows a working tool called kube-policy-advisor that auto-generates Rego policies from existing PSPs, targets… | ||
| Talk Deep Dive | Nick Young, Chris Kühl | 12m |
Starts Kubernetes work on v1.1 in 2016 and moves to build an ingress controller backed by a custom CRD HTTPProxy that enforces multi-tenant routing rules… | ||
| Talk Deep Dive | Taylor Thomas, Matt Butcher, Chris Kühl | 12m |
Argues that WebAssembly brings the browser security model and near-instant startup to cloud workloads, positioning it between VMs and containers; cites early… | ||
| Talk Deep Dive | Daniel Finneran, Mark Coleman | 14m |
Shows a working Tinkerbell + Cluster API stack that actually provisions large metal servers and boots OS images in seconds, not minutes. Demonstrates a Cluster… | ||
| nothing matches | ||