KCD Zürich 2024
2024-06-13
Zürich, Switzerland
as the organisers put it
Relive the exciting moments from Kubernetes Community Days Zürich 2024. Explore our collection of talk videos and event pictures that capture the best of this event.
who it's for
kubernetes engineers, platform engineers, security engineers, site reliability engineers, cloud engineers, observability engineers, devops engineers
topics
Kubernetes runtime checkpoint and restore (CRIU); Kubernetes security incident response techniques; WAF fleet management on AWS with Firewall Manager; IMDSv2 enforcement and cloud credential hardening; stateful workloads partitioning and HPA metrics adapter; Argo CD ApplicationSet failure modes and recovery; Quarkus with langchain4j and RAG with Postgres; Istio Ambient mode node-level mTLS and Waypoint; eBPF detection with Tetragon and Grafana alerts; kubectl and cli productivity tricks (kapp, gron, yq); managing 1000+ clusters and edge Kubernetes
| title | author | length |
|---|---|---|
| KubeCapture: A Live Hacking Showcase on Kubernetes Security | Jonas Felix | 32m |
Live capture the flag demonstration shows a malicious CouchDB image with reverse shell deployed to Docker Hub and catching a cluster that pulls it; attacker… | ||
| Adventures in stateful applications on Kubernetes | Mathis Kretz | 32m |
Shows that Kubernetes StatefulSets handle persistent-data apps but not in-memory, long-lived computations, so a small framework called acbar prototype is built… | ||
| Securing Applications and Managing WAFs at a large scale | Franziska Bühler | 27m |
SBB runs an automated, policy-driven WAF fleet that blocks real exploits and buys patching time: ~200 WAFs on AWS are managed via AWS Firewall Manager +… | ||
| "PIVOT!" — Bouncing between your app, your cluster and your cloud | Christophe Tafani-Dereeper | 28m |
Live demos show attackers using RCE and SSRF to curl the instance metadata service and steal worker node AWS creds, then use those creds to pull images (about… | ||
| Letting Your Containers Dream of Electric Sheep | Cyrill Troxler | 34m |
A Kubernetes runtime snapshots whole containers to disk when idle and restores them in tens of milliseconds, preserving in‑memory state so apps (demo… | ||
| RUD: Rapid Unscheduled Deletion of Critical Infrastructure Workloads | Clément Nussbaumer | 25m |
PostFinance runs 30 vanilla Kubernetes clusters and deploys infra stacks with ArgoCD ApplicationSets. A force-replace sync causes ArgoCD to start deleting… | ||
| Crafting Intelligent Cloud Native applications with Quarkus | Dimitris Andreadis | 36m |
Quarkus integrates with langchain4j to treat LLMs as Java REST clients, showing a working demo that calls OpenAI and local Llama 3, compiles prompts from… | ||
| Reflections on a decade of k8s. How it has been and what the future is holding. | Abdel Sghiouar | 17m |
Kubernetes starts as a decade-old abstraction that promises eventual consistency and keeps simplifying itself — the community recently removed 1.07 million… | ||
| 11 tricks to improve productivity and reduce your frustration with Kubernetes | Tiffany Jernigan | 28m |
Shows exact commands and surprises you can use now: create a multi node kind cluster, use kubectl wait with conditions (default 30s timeout, zero for a single… | ||
| Oh No Our Kubernetes Cluster Has Been Compromised!Will YOU Save the Day? | Benoit Entzmann, Chay Te | 32m |
Cluster alert surfaces via Tetragon eBPF alert in Grafana/Prometheus showing a chroot process inside a kube-controller-manager pod on EC2 nodes; investigation… | ||
| Embracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars | Lin Sun | 32m |
Istio Ambient mode replaces per-pod sidecars with a node-level ztrust tunnel in Rust that upgrades pod-to-pod connections to mTLS and a Waypoint per-namespace… | ||
| Choose Your Own Adventure: The Struggle for Security | Victor Farcic, Whitney Lee | 31m |
Interactive, choose-your-path demo wires an app into an EKS cluster (Crossplane, Argo CD, Contour) and tests cluster, runtime, and pod-to-pod security choices… | ||
| The Swiss Army Knife of Cloud Native Networking | Raymond de Jong | 29m |
Cilium runs eBPF to replace iptables/ipvs and now ships BGP control plane v2 in the upcoming 1.16 (July) to advertise Service and LoadBalancer IPs, with… | ||
| Sustainability Chronicles: Innovate Through Green Technology | Katie Gamanji | 30m |
Kubernetes-focused tools are used to measure and act on real emissions: Kepler DaemonSet using eBPF probes CPU and kernel counters, exports joules → kWh to… | ||
| Kubernetes at the Edge - How Roche is on the way to manage 1000+ clusters | Alexander Hungenberg | 32m |
Roche runs Kubernetes on-prem in labs to avoid cloud privacy and latency limits and aims to scale toward 1000+ clusters by treating Kubernetes as the OS layer… | ||
| Successful Cloud Native Platform Engineering – Hype vs Reality | Andreas Grabner | 29m |
Claims that only 40% of engineering time is productive and that 36% of engineers leave due to bad developer experience drive a platform built as a product… | ||
| nothing matches | ||