Kubernetes with Cilium in AWS - Experience Report!
•
0 recomendaciones•60 vistas
Cloud Native Night, Munich, September 2023, Bernhard Schaidhammer === Please download slides if blurred! === Cilium is a powerful tool for network policies and also encryption between the Kubernetes nodes. Cilium hooks deep into Kubernetes in the network stack as an plugin and can even replace the AWS CNI Plugin. This talk will share our project experiences. Topics involve: - Network Policies - Encryption - Hubble (Observability) - Installation - CLI Usage (Hubble / Cilium)
Denunciar
Compartir
Denunciar
Compartir
Descargar para leer sin conexión
Recomendados
OpenNebulaConf 2013 - Keynote: Enabling Scientific Workflows on FermiCloud us...
The FermiCloud Project has been operating an Infrastructure-as-a-Service private Cloud using OpenNebula since the fall of 2010. FermiCloud has made significant contributions in X.509-based authentication and authorization, accounting, fabric deployment and high-availability cloud infrastructure. Our current program of work, carried out jointly with KISTI, focuses on interoperability and federation with the goal of running scientific cloud-based workflows across multiple clouds. I will identify some of the technical challenges that remain to be solved in widespread cloud deployment, as well as lessons that we have learned from grid computing and applied to the cloud environment.
Bio:
Steven C. Timm, PhD. is the group leader of the FermiGrid Services Group in the Grid and Cloud Computing Department at Fermi National Accelerator Laboratory, Batavia Illinois, USA, where he has been on the computing staff since 2000 with various responsibilities in large-scale distributed computing. He is the lead of the FermiCloud project and also responsible for leading the operations of the FermiGrid authentication and authorization servers and batch servers. Dr. Timm received his M.S. in Computer Science from Andrews University andhis Ph.D. in Physics from Carnegie Mellon University.
Enabling Scientific Workflows on FermiCloud using OpenNebula
Fermilab operates a large particle physics lab and generates large amounts of data. The FermiCloud project was created to provide cloud computing resources for Fermilab's scientific programs. FermiCloud uses OpenNebula to manage virtual machines on a fault-tolerant infrastructure split between two buildings. The goals of FermiCloud are to support scientific workflows through an IaaS cloud with high availability.
Cloud Native Bern 05.2023 — Zero Trust Visibility
As the adoption of Kubernetes continues to grow, so does the need for securing containerized applications and their data. One effective security model that has gained popularity is Zero Trust Networking, which assumes that all resources, devices and users are untrusted, and access to resources is granted only after proper authentication and authorization. However, implementing Zero Trust Networking in Kubernetes can be challenging, given the dynamic nature of containerized workloads and the complexity of network policies.
In this presentation, we will explore how to implement Zero Trust Networking in Kubernetes using Cilium, Hubble & Grafana. We will start by setting up Cilium on a Kubernetes cluster, which provides network security by enforcing identity-based access control policies using eBPF. Next, we will export Network Policy Verdict metrics using Hubble, which allows us to visualize network policies and track security events in real-time. Finally, we will use a Grafana dashboard to visualize these metrics and demonstrate how to secure a Kubernetes namespace without affecting existing traffic in the namespace.
By the end of this presentation, attendees will have a good understanding of the importance of Zero Trust Networking in Kubernetes and how to implement it using Cilium, Hubble & Grafana. They will also learn how to secure a Kubernetes namespace and monitor network policies using a Grafana dashboard.
4. CNCF kubernetes Comparison of-existing-cni-plugins-for-kubernetes
This document compares existing CNI plugins for Kubernetes and provides descriptions of popular plugins like Flannel, Calico, Kube-router, and AWS VPC CNI. It explains that CNI plugins provide the interface between container runtimes and network implementations, and describes the CNI workflow and requirements for pod networking in Kubernetes.
ContainerDays Hamburg 2023 — Cilium Workshop.pdf
This document outlines an agenda for a workshop on Kubernetes networking with eBPF and Cilium. The workshop covers various topics including principles of eBPF and Cilium, Kubernetes networking, cluster mesh, security, observability, service mesh, and Tetragon. It provides overviews and examples for each topic. The workshop is presented by Raphaël Pinson who works on Cilium at Isovalent.
Comparison of existing cni plugins for kubernetes
Comparison of existing cni plugins for kubernetes. We compare existing CNI plugins by different features.
Security Tips to run Docker in Production
When you are designing a production environment security is essential. All the Docker ecosystem but in particular Docker Swarm allows us to ship our containers out of our laptop, how can we make this process safe? During my talk, I will share tips around production environment, immutability and how troubleshooting common attack as code injection with Docker. Static analysis of our images, content trust with Notary to make our journey secure.
How can we setup a cluster on the main cloud providers with VPN and node labeling to expose only a portion of our cluster? I will also show what Docker provides (Content Trust, Static Analysis) but also open source alternatives as Notary, centos/clair and Cilium.
In the end of this talk, we had a better idea around how manage Docker in production.
5 Ways to Secure Your Containers for Docker and Beyond
Presented by Tim Mackey, Senior Technology Evangelist, Black Duck Software on August 17.
To use containers safely, you need to be aware of potential security issues and the tools you need for securing container-based systems. Secure production use of containers requires an understanding of how attackers might seek to compromise the container, and what you should be aware of to minimize that potential risk.
Tim Mackey, Senior Technical Evangelist at Black Duck Software, provides guidance for developing container security policies and procedures around threats such as:
1. Network security
2. Access control
3. Tamper management and trust
4. Denial of service and SLAs
5. Vulnerabilities
Register today to learn about the biggest security challenges you face when deploying containers, and how you can effectively deal with those threats.
Watch the webinar on BrightTalk: http://bit.ly/2bpdswg
Recomendados
OpenNebulaConf 2013 - Keynote: Enabling Scientific Workflows on FermiCloud us...
The FermiCloud Project has been operating an Infrastructure-as-a-Service private Cloud using OpenNebula since the fall of 2010. FermiCloud has made significant contributions in X.509-based authentication and authorization, accounting, fabric deployment and high-availability cloud infrastructure. Our current program of work, carried out jointly with KISTI, focuses on interoperability and federation with the goal of running scientific cloud-based workflows across multiple clouds. I will identify some of the technical challenges that remain to be solved in widespread cloud deployment, as well as lessons that we have learned from grid computing and applied to the cloud environment.
Bio:
Steven C. Timm, PhD. is the group leader of the FermiGrid Services Group in the Grid and Cloud Computing Department at Fermi National Accelerator Laboratory, Batavia Illinois, USA, where he has been on the computing staff since 2000 with various responsibilities in large-scale distributed computing. He is the lead of the FermiCloud project and also responsible for leading the operations of the FermiGrid authentication and authorization servers and batch servers. Dr. Timm received his M.S. in Computer Science from Andrews University andhis Ph.D. in Physics from Carnegie Mellon University.
Enabling Scientific Workflows on FermiCloud using OpenNebula
Fermilab operates a large particle physics lab and generates large amounts of data. The FermiCloud project was created to provide cloud computing resources for Fermilab's scientific programs. FermiCloud uses OpenNebula to manage virtual machines on a fault-tolerant infrastructure split between two buildings. The goals of FermiCloud are to support scientific workflows through an IaaS cloud with high availability.
Cloud Native Bern 05.2023 — Zero Trust Visibility
As the adoption of Kubernetes continues to grow, so does the need for securing containerized applications and their data. One effective security model that has gained popularity is Zero Trust Networking, which assumes that all resources, devices and users are untrusted, and access to resources is granted only after proper authentication and authorization. However, implementing Zero Trust Networking in Kubernetes can be challenging, given the dynamic nature of containerized workloads and the complexity of network policies.
In this presentation, we will explore how to implement Zero Trust Networking in Kubernetes using Cilium, Hubble & Grafana. We will start by setting up Cilium on a Kubernetes cluster, which provides network security by enforcing identity-based access control policies using eBPF. Next, we will export Network Policy Verdict metrics using Hubble, which allows us to visualize network policies and track security events in real-time. Finally, we will use a Grafana dashboard to visualize these metrics and demonstrate how to secure a Kubernetes namespace without affecting existing traffic in the namespace.
By the end of this presentation, attendees will have a good understanding of the importance of Zero Trust Networking in Kubernetes and how to implement it using Cilium, Hubble & Grafana. They will also learn how to secure a Kubernetes namespace and monitor network policies using a Grafana dashboard.
4. CNCF kubernetes Comparison of-existing-cni-plugins-for-kubernetes
This document compares existing CNI plugins for Kubernetes and provides descriptions of popular plugins like Flannel, Calico, Kube-router, and AWS VPC CNI. It explains that CNI plugins provide the interface between container runtimes and network implementations, and describes the CNI workflow and requirements for pod networking in Kubernetes.
ContainerDays Hamburg 2023 — Cilium Workshop.pdf
This document outlines an agenda for a workshop on Kubernetes networking with eBPF and Cilium. The workshop covers various topics including principles of eBPF and Cilium, Kubernetes networking, cluster mesh, security, observability, service mesh, and Tetragon. It provides overviews and examples for each topic. The workshop is presented by Raphaël Pinson who works on Cilium at Isovalent.
Comparison of existing cni plugins for kubernetes
Comparison of existing cni plugins for kubernetes. We compare existing CNI plugins by different features.
Security Tips to run Docker in Production
When you are designing a production environment security is essential. All the Docker ecosystem but in particular Docker Swarm allows us to ship our containers out of our laptop, how can we make this process safe? During my talk, I will share tips around production environment, immutability and how troubleshooting common attack as code injection with Docker. Static analysis of our images, content trust with Notary to make our journey secure.
How can we setup a cluster on the main cloud providers with VPN and node labeling to expose only a portion of our cluster? I will also show what Docker provides (Content Trust, Static Analysis) but also open source alternatives as Notary, centos/clair and Cilium.
In the end of this talk, we had a better idea around how manage Docker in production.
5 Ways to Secure Your Containers for Docker and Beyond
Presented by Tim Mackey, Senior Technology Evangelist, Black Duck Software on August 17.
To use containers safely, you need to be aware of potential security issues and the tools you need for securing container-based systems. Secure production use of containers requires an understanding of how attackers might seek to compromise the container, and what you should be aware of to minimize that potential risk.
Tim Mackey, Senior Technical Evangelist at Black Duck Software, provides guidance for developing container security policies and procedures around threats such as:
1. Network security
2. Access control
3. Tamper management and trust
4. Denial of service and SLAs
5. Vulnerabilities
Register today to learn about the biggest security challenges you face when deploying containers, and how you can effectively deal with those threats.
Watch the webinar on BrightTalk: http://bit.ly/2bpdswg
Santander DevopsandCloudDays 2021 - Hardening containers.pdf
Quick talk about the basics of hardening containers in Kubernetes / Openshift. Hosted by Santander.
https://www.youtube.com/watch?v=UvGUKRwcHFg&list=PLwjS7M0kkf3KsE5uFtSrLzJS_IY8Ug7Yv&index=42
Kubernetes security with AWS
This document provides an overview of Kasun Madura Rathnayaka and his experience with Kubernetes and AWS. It then lists 10 best practices for securing Kubernetes clusters deployed on AWS: 1) Update Kubernetes to the latest stable version, 2) Harden node security, 3) Secure cloud metadata access, 4) Enable role-based access control, 5) Secure Tiller or Helm 3, 6) Secure container image and registry usage, 7) Assess container privileges, 8) Implement auditing and alerts, 9) Consider deployment and runtime security, and 10) Properly manage credentials and secrets. Specific techniques are provided for implementing each best practice.
OpenStack Tokyo 2015: Connecting the Dots with Neutron
Mohammad Banikazemi and Phil Estes from IBM discuss unifying the virtualized networking layers between containers and VMs using Neutron and Docker's libnetwork pluggable API, filling the gap with recently announced Project Kuryr
Luca Relandini - Microservices and containers networking: Contiv, deep dive a...
Contiv provides a higher level of networking abstraction for microservices: it provides built-in service discovery and service routing for scale out services, working with schedulers like Docker Swarm, Kubernetes, Mesos and Openshift. A powerful policy-based management that makes networking on large scale easy. We will see some code examples, use cases and an easy tutorial on the web. This session is a follow up to the successful sessions at Codemotion Rome and Amsterdam in 2016: we'll go deeper into the architecture and the use cases.
Explore the World of Cilium, Tetragon & eBPF
Come explore the World of Cilium with us!
In this workshop, you'll have the opportunity to discover about Cilium and Tetragon, and the kernel technology that makes them possible, eBPF.
Through a collection of hands-on labs (available at https://labs-map.isovalent.com/) and the presenter's support, you'll be able to explore many topics covering Cloud Native Networking, Security, and Observability. In this gamified approach, you'll also be able to earn badges for completing labs.
Whether you're a Platform Engineer, SRE, Network Engineer, SecOps Professional, Cloud Architect, and more, you'll certainly find subjects to explore in this session!
End-to-end IoT solutions with Java and Eclipse IoT
This document discusses using Java and the Eclipse IoT project for end-to-end IoT solutions. It describes how Java can be used for sensors/actuators, gateways to connect devices to networks, and cloud backends for device management. It also outlines how the Eclipse IoT projects like Kura, Paho, Californium, and Moquette can be used at each level of a typical IoT solution.
Kubernetes and container security
Everyone heard about Kubernetes. Everyone wants to use this tool. However, sometimes we forget about security, which is essential throughout the container lifecycle.
Therefore, our journey with Kubernetes security should begin in the build stage when writing the code becomes the container image.
Kubernetes provides innate security advantages, and together with solid container protection, it will be invincible.
During the sessions, we will review all those features and highlight which are mandatory to use. We will discuss the main vulnerabilities which may cause compromising your system.
Contacts:
LinkedIn - https://www.linkedin.com/in/vshynkar/
GitHub - https://github.com/sqerison
-------------------------------------------------------------------------------------
Materials from the video:
The policies and docker files examples:
https://gist.github.com/sqerison/43365e30ee62298d9757deeab7643a90
The repo with the helm chart used in a demo:
https://github.com/sqerison/argo-rollouts-demo
Tools that showed in the last section:
https://github.com/armosec/kubescape
https://github.com/aquasecurity/kube-bench
https://github.com/controlplaneio/kubectl-kubesec
https://github.com/Shopify/kubeaudit#installation
https://github.com/eldadru/ksniff
Further learning.
A book released by CISA (Cybersecurity and Infrastructure Security Agency):
https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF
O`REILLY Kubernetes Security:
https://kubernetes-security.info/
O`REILLY Container Security:
https://info.aquasec.com/container-security-book
Thanks for watching!
Kubernetes Security Best Practices for DevOps
For many DevOps teams, Kubernetes has become an enterprise IT mandate, but like previous waves of infrastructure change, Kubernetes security best practices must be followed throughout the container life cycle. Join us for a discussion around Kubernetes security challenges and best practices. You will learn how to:
Stay on top of ongoing Kubernetes hygiene by hardening your nodes, employing RBAC best practices, etc.;
Secure your production workloads;
Thwart an attack, with a live demo.
Protecting host with calico
Project Calico is an open-source networking project that provides layer 3 networking for scalable datacenter deployments using a more efficient implementation than traditional overlays. Calico is able to secure network interfaces on hosts using the same security policy model used for workloads. It supports building components like Calicoctl and Calico/node, and defines two types of endpoints - host endpoints for static interfaces and workload endpoints for dynamically managed interfaces. To run Calico and secure host interfaces, basic connectivity and policy is created, host endpoint objects are created in etcd for each interface, and additional security policies can be applied.
Ceph Day Amsterdam 2015 - Deploying flash storage for Ceph without compromisi...
Mellanox presented on optimizing Ceph performance over flash storage using high-performance interconnect solutions. Mellanox provides end-to-end Ethernet and InfiniBand solutions that can accelerate Ceph clusters today. Adding RDMA support to the Ceph messaging layer, as is being done in the XioMessenger project, will further optimize performance when using flash storage. Several customer deployments of Ceph powered storage solutions were highlighted that leverage Mellanox's 40GbE and InfiniBand networking.
Container security within Cisco Container Platform
The document discusses security within Cisco Container Platform. It provides an overview of the security model and features, including platform hardening through the Cisco Secure Development Lifecycle process, role-based access control for Kubernetes, and secure multi-tenancy capabilities in Kubernetes clusters. It also covers container and Kubernetes security best practices like encryption, authentication, and network policies that are supported in Cisco Container Platform. The presentation concludes with a demo of secure multi-tenancy in Kubernetes clusters.
CoreOS and cloud provider integration: simple cloud-init example at Exoscale
In this presentation done during the Zurich FLOSS and IT geeks meetup January 8th, 2015, we briefly explained how you can build an ecosystem of
Kubernetes
This document provides an overview of container orchestration with Kubernetes. It begins with recapping container and Docker concepts like namespaces, cgroups, and union filesystems. It then introduces Kubernetes architecture including components like kube-apiserver, kubelet and kube-proxy. Common Kubernetes objects like pods, services, replica sets and deployments are described. The document also covers Kubernetes networking with options like NodePort, LoadBalancer and Ingress. Additional topics include service discovery, logging/monitoring and persistent storage.
Docker Security Overview
This document summarizes Docker security features as of release 1.12. It discusses key security modules like namespaces, cgroups, capabilities, seccomp, AppArmor/SELinux that provide access control and isolation in Docker containers. It also covers multi-tenant security, image signing, TLS for daemon access, and best practices like using official images and regular updates.
EBPF and Linux Networking
In this session, we’ll review how previous efforts, including Netfilter, Berkley Packet Filter (BPF), Open vSwitch (OVS), and TC, approached the problem of extensibility. We’ll show you an open source solution available within the Red Hat Enterprise Linux kernel, where extending and merging some of the existing concepts leads to an extensible framework that satisfies the networking needs of datacenter and cloud virtualization.
[KubeCon NA 2020] containerd: Rootless Containers 2020
Rootless Containers means running the container runtimes (e.g. runc, containerd, and kubelet) as well as the containers without the host root privileges. The most significant advantage of Rootless Containers is that it can mitigate potential container-breakout vulnerability of the runtimes, but it is also useful for isolating multi-user environments on HPC hosts. This talk will contain the introduction to rootless containers and deep-dive topics about the recent updates such as Seccomp User Notification. The main focus will be on containerd (CNCF Graduated Project) and its consumer projects including Kubernetes and Docker/Moby, but topics about other runtimes will be discussed as well.
https://sched.co/fGWc
Lessson 2
This document discusses firewalls and VPNs. It covers firewall types like application layer firewalls and proxy servers. It describes firewall processing modes such as packet filtering, circuit-level gateways, and hybrid firewalls. It also discusses common firewall architectures including dual-homed firewalls, screened host firewalls and screened subnet firewalls with DMZs. The document emphasizes the importance of properly configuring and managing firewalls according to best practices. It also covers content filters and securing remote connections using VPN technology.
Considerations for Operating an OpenStack Cloud
All Things Open 2014 - Day 2
Thursday, October 23rd, 2014
Mark Voelker
Technical Leader with Cisco
Cloud/OpenStack
Considerations for Operating an OpenStack Cloud
Introduction to Filecoin
This document provides an introduction to Filecoin, including:
1) Core concepts of Filecoin such as using IPFS for data retrieval and Filecoin for data persistence and verifiability on a decentralized storage network.
2) Examples of how storage helpers can simplify storing and retrieving data on Filecoin by handling dealmaking and verification.
3) An overview of the different layers that make up a Web3-enabled architecture using Filecoin and IPFS for decentralized storage.
Linux Kernel Security Overview - KCA 2009
Overview of Linux Kernel Security presented at Kernel Conference Australia 2009, in Brisbane, QLD.
Provides historical context of Linux kernel security features and discusses their ongoing development in reference to the NSA's 1998 secure OS paper, "The Inevitability of Failure".
Mit ChatGPT Dinosaurier besiegen - Möglichkeiten und Grenzen von LLM für die ...
Generative AI for Developers, 27.05.2024, Bonn (Martin Binder, Lead IT Consultant bei QAware)
Die kritische Infrastruktur wird nach wie vor von Dinosauriersystemen aus dem letzten Jahrtausend getragen. Die Ablösung dieser Altsysteme ist ein drängendes Problem der Digitalisierung in Deutschland. In meinem Projekt musste ich in wenigen Wochen ein 30 Jahre altes System auf Basis von IBM iSeries (AS/400) mit RPG-Code analysieren. Überraschenderweise kannte ChatGPT die RGP-Referenz von IBM. Mithilfe von ChatGPT konnte ich mich schnell einarbeiten und so ein brauchbares Arbeitsverständnis des Systems erreichen. Aber wo Licht ist, ist auch Schatten: ChatGPT hat kein Kontextverständnis, ist unvollständig und neigt zu Fehlschlüssen. Als Vorgeschmack hier der Powermove: ChatGPT nach jeder Antwort grundsätzlich danach fragen, was es falsch gemacht hat. Du wirst überrascht sein!
50 Shades of K8s Autoscaling #JavaLand24.pdf
JavaLand 2024, April 2024, Mario-Leander Reimer
== Dokument bitte herunterladen, falls unscharf! Please download slides if blurred! ==
Abstract:
Elasticity and unlimited scalability are the holy grail for any cloud-native application. Now you might think: “That’s easy!!! I just run my containers on a Kubernetes cluster and I am done.” But is it really that simple?
Turns out it’s not! Your application as well as your cloud infrastructure and K8s cluster need to address and support these non-functional requirements.
This session will have a detailed and also practical look at the different ways of autoscaling in Kubernetes. We will give an overview of the technical foundations and prerequisites, and then showcase several frameworks and technologies that can be used to flexibly autoscale your cluster and your cloud-native workloads.
Más contenido relacionado
Similar a Kubernetes with Cilium in AWS - Experience Report!
Santander DevopsandCloudDays 2021 - Hardening containers.pdf
Quick talk about the basics of hardening containers in Kubernetes / Openshift. Hosted by Santander.
https://www.youtube.com/watch?v=UvGUKRwcHFg&list=PLwjS7M0kkf3KsE5uFtSrLzJS_IY8Ug7Yv&index=42
Kubernetes security with AWS
This document provides an overview of Kasun Madura Rathnayaka and his experience with Kubernetes and AWS. It then lists 10 best practices for securing Kubernetes clusters deployed on AWS: 1) Update Kubernetes to the latest stable version, 2) Harden node security, 3) Secure cloud metadata access, 4) Enable role-based access control, 5) Secure Tiller or Helm 3, 6) Secure container image and registry usage, 7) Assess container privileges, 8) Implement auditing and alerts, 9) Consider deployment and runtime security, and 10) Properly manage credentials and secrets. Specific techniques are provided for implementing each best practice.
OpenStack Tokyo 2015: Connecting the Dots with Neutron
Mohammad Banikazemi and Phil Estes from IBM discuss unifying the virtualized networking layers between containers and VMs using Neutron and Docker's libnetwork pluggable API, filling the gap with recently announced Project Kuryr
Luca Relandini - Microservices and containers networking: Contiv, deep dive a...
Contiv provides a higher level of networking abstraction for microservices: it provides built-in service discovery and service routing for scale out services, working with schedulers like Docker Swarm, Kubernetes, Mesos and Openshift. A powerful policy-based management that makes networking on large scale easy. We will see some code examples, use cases and an easy tutorial on the web. This session is a follow up to the successful sessions at Codemotion Rome and Amsterdam in 2016: we'll go deeper into the architecture and the use cases.
Explore the World of Cilium, Tetragon & eBPF
Come explore the World of Cilium with us!
In this workshop, you'll have the opportunity to discover about Cilium and Tetragon, and the kernel technology that makes them possible, eBPF.
Through a collection of hands-on labs (available at https://labs-map.isovalent.com/) and the presenter's support, you'll be able to explore many topics covering Cloud Native Networking, Security, and Observability. In this gamified approach, you'll also be able to earn badges for completing labs.
Whether you're a Platform Engineer, SRE, Network Engineer, SecOps Professional, Cloud Architect, and more, you'll certainly find subjects to explore in this session!
End-to-end IoT solutions with Java and Eclipse IoT
This document discusses using Java and the Eclipse IoT project for end-to-end IoT solutions. It describes how Java can be used for sensors/actuators, gateways to connect devices to networks, and cloud backends for device management. It also outlines how the Eclipse IoT projects like Kura, Paho, Californium, and Moquette can be used at each level of a typical IoT solution.
Kubernetes and container security
Everyone heard about Kubernetes. Everyone wants to use this tool. However, sometimes we forget about security, which is essential throughout the container lifecycle.
Therefore, our journey with Kubernetes security should begin in the build stage when writing the code becomes the container image.
Kubernetes provides innate security advantages, and together with solid container protection, it will be invincible.
During the sessions, we will review all those features and highlight which are mandatory to use. We will discuss the main vulnerabilities which may cause compromising your system.
Contacts:
LinkedIn - https://www.linkedin.com/in/vshynkar/
GitHub - https://github.com/sqerison
-------------------------------------------------------------------------------------
Materials from the video:
The policies and docker files examples:
https://gist.github.com/sqerison/43365e30ee62298d9757deeab7643a90
The repo with the helm chart used in a demo:
https://github.com/sqerison/argo-rollouts-demo
Tools that showed in the last section:
https://github.com/armosec/kubescape
https://github.com/aquasecurity/kube-bench
https://github.com/controlplaneio/kubectl-kubesec
https://github.com/Shopify/kubeaudit#installation
https://github.com/eldadru/ksniff
Further learning.
A book released by CISA (Cybersecurity and Infrastructure Security Agency):
https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF
O`REILLY Kubernetes Security:
https://kubernetes-security.info/
O`REILLY Container Security:
https://info.aquasec.com/container-security-book
Thanks for watching!
Kubernetes Security Best Practices for DevOps
For many DevOps teams, Kubernetes has become an enterprise IT mandate, but like previous waves of infrastructure change, Kubernetes security best practices must be followed throughout the container life cycle. Join us for a discussion around Kubernetes security challenges and best practices. You will learn how to:
Stay on top of ongoing Kubernetes hygiene by hardening your nodes, employing RBAC best practices, etc.;
Secure your production workloads;
Thwart an attack, with a live demo.
Protecting host with calico
Project Calico is an open-source networking project that provides layer 3 networking for scalable datacenter deployments using a more efficient implementation than traditional overlays. Calico is able to secure network interfaces on hosts using the same security policy model used for workloads. It supports building components like Calicoctl and Calico/node, and defines two types of endpoints - host endpoints for static interfaces and workload endpoints for dynamically managed interfaces. To run Calico and secure host interfaces, basic connectivity and policy is created, host endpoint objects are created in etcd for each interface, and additional security policies can be applied.
Ceph Day Amsterdam 2015 - Deploying flash storage for Ceph without compromisi...
Mellanox presented on optimizing Ceph performance over flash storage using high-performance interconnect solutions. Mellanox provides end-to-end Ethernet and InfiniBand solutions that can accelerate Ceph clusters today. Adding RDMA support to the Ceph messaging layer, as is being done in the XioMessenger project, will further optimize performance when using flash storage. Several customer deployments of Ceph powered storage solutions were highlighted that leverage Mellanox's 40GbE and InfiniBand networking.
Container security within Cisco Container Platform
The document discusses security within Cisco Container Platform. It provides an overview of the security model and features, including platform hardening through the Cisco Secure Development Lifecycle process, role-based access control for Kubernetes, and secure multi-tenancy capabilities in Kubernetes clusters. It also covers container and Kubernetes security best practices like encryption, authentication, and network policies that are supported in Cisco Container Platform. The presentation concludes with a demo of secure multi-tenancy in Kubernetes clusters.
CoreOS and cloud provider integration: simple cloud-init example at Exoscale
In this presentation done during the Zurich FLOSS and IT geeks meetup January 8th, 2015, we briefly explained how you can build an ecosystem of
Kubernetes
This document provides an overview of container orchestration with Kubernetes. It begins with recapping container and Docker concepts like namespaces, cgroups, and union filesystems. It then introduces Kubernetes architecture including components like kube-apiserver, kubelet and kube-proxy. Common Kubernetes objects like pods, services, replica sets and deployments are described. The document also covers Kubernetes networking with options like NodePort, LoadBalancer and Ingress. Additional topics include service discovery, logging/monitoring and persistent storage.
Docker Security Overview
This document summarizes Docker security features as of release 1.12. It discusses key security modules like namespaces, cgroups, capabilities, seccomp, AppArmor/SELinux that provide access control and isolation in Docker containers. It also covers multi-tenant security, image signing, TLS for daemon access, and best practices like using official images and regular updates.
EBPF and Linux Networking
In this session, we’ll review how previous efforts, including Netfilter, Berkley Packet Filter (BPF), Open vSwitch (OVS), and TC, approached the problem of extensibility. We’ll show you an open source solution available within the Red Hat Enterprise Linux kernel, where extending and merging some of the existing concepts leads to an extensible framework that satisfies the networking needs of datacenter and cloud virtualization.
[KubeCon NA 2020] containerd: Rootless Containers 2020
Rootless Containers means running the container runtimes (e.g. runc, containerd, and kubelet) as well as the containers without the host root privileges. The most significant advantage of Rootless Containers is that it can mitigate potential container-breakout vulnerability of the runtimes, but it is also useful for isolating multi-user environments on HPC hosts. This talk will contain the introduction to rootless containers and deep-dive topics about the recent updates such as Seccomp User Notification. The main focus will be on containerd (CNCF Graduated Project) and its consumer projects including Kubernetes and Docker/Moby, but topics about other runtimes will be discussed as well.
https://sched.co/fGWc
Lessson 2
This document discusses firewalls and VPNs. It covers firewall types like application layer firewalls and proxy servers. It describes firewall processing modes such as packet filtering, circuit-level gateways, and hybrid firewalls. It also discusses common firewall architectures including dual-homed firewalls, screened host firewalls and screened subnet firewalls with DMZs. The document emphasizes the importance of properly configuring and managing firewalls according to best practices. It also covers content filters and securing remote connections using VPN technology.
Considerations for Operating an OpenStack Cloud
All Things Open 2014 - Day 2
Thursday, October 23rd, 2014
Mark Voelker
Technical Leader with Cisco
Cloud/OpenStack
Considerations for Operating an OpenStack Cloud
Introduction to Filecoin
This document provides an introduction to Filecoin, including:
1) Core concepts of Filecoin such as using IPFS for data retrieval and Filecoin for data persistence and verifiability on a decentralized storage network.
2) Examples of how storage helpers can simplify storing and retrieving data on Filecoin by handling dealmaking and verification.
3) An overview of the different layers that make up a Web3-enabled architecture using Filecoin and IPFS for decentralized storage.
Linux Kernel Security Overview - KCA 2009
Overview of Linux Kernel Security presented at Kernel Conference Australia 2009, in Brisbane, QLD.
Provides historical context of Linux kernel security features and discusses their ongoing development in reference to the NSA's 1998 secure OS paper, "The Inevitability of Failure".
Similar a Kubernetes with Cilium in AWS - Experience Report! (20)
Santander DevopsandCloudDays 2021 - Hardening containers.pdf
Santander DevopsandCloudDays 2021 - Hardening containers.pdf
OpenStack Tokyo 2015: Connecting the Dots with Neutron
OpenStack Tokyo 2015: Connecting the Dots with Neutron
Luca Relandini - Microservices and containers networking: Contiv, deep dive a...
Luca Relandini - Microservices and containers networking: Contiv, deep dive a...
End-to-end IoT solutions with Java and Eclipse IoT
End-to-end IoT solutions with Java and Eclipse IoT
Ceph Day Amsterdam 2015 - Deploying flash storage for Ceph without compromisi...
Ceph Day Amsterdam 2015 - Deploying flash storage for Ceph without compromisi...
Container security within Cisco Container Platform
Container security within Cisco Container Platform
CoreOS and cloud provider integration: simple cloud-init example at Exoscale
CoreOS and cloud provider integration: simple cloud-init example at Exoscale
[KubeCon NA 2020] containerd: Rootless Containers 2020
[KubeCon NA 2020] containerd: Rootless Containers 2020
Más de QAware GmbH
Mit ChatGPT Dinosaurier besiegen - Möglichkeiten und Grenzen von LLM für die ...
Generative AI for Developers, 27.05.2024, Bonn (Martin Binder, Lead IT Consultant bei QAware)
Die kritische Infrastruktur wird nach wie vor von Dinosauriersystemen aus dem letzten Jahrtausend getragen. Die Ablösung dieser Altsysteme ist ein drängendes Problem der Digitalisierung in Deutschland. In meinem Projekt musste ich in wenigen Wochen ein 30 Jahre altes System auf Basis von IBM iSeries (AS/400) mit RPG-Code analysieren. Überraschenderweise kannte ChatGPT die RGP-Referenz von IBM. Mithilfe von ChatGPT konnte ich mich schnell einarbeiten und so ein brauchbares Arbeitsverständnis des Systems erreichen. Aber wo Licht ist, ist auch Schatten: ChatGPT hat kein Kontextverständnis, ist unvollständig und neigt zu Fehlschlüssen. Als Vorgeschmack hier der Powermove: ChatGPT nach jeder Antwort grundsätzlich danach fragen, was es falsch gemacht hat. Du wirst überrascht sein!
50 Shades of K8s Autoscaling #JavaLand24.pdf
JavaLand 2024, April 2024, Mario-Leander Reimer
== Dokument bitte herunterladen, falls unscharf! Please download slides if blurred! ==
Abstract:
Elasticity and unlimited scalability are the holy grail for any cloud-native application. Now you might think: “That’s easy!!! I just run my containers on a Kubernetes cluster and I am done.” But is it really that simple?
Turns out it’s not! Your application as well as your cloud infrastructure and K8s cluster need to address and support these non-functional requirements.
This session will have a detailed and also practical look at the different ways of autoscaling in Kubernetes. We will give an overview of the technical foundations and prerequisites, and then showcase several frameworks and technologies that can be used to flexibly autoscale your cluster and your cloud-native workloads.
Make Agile Great - PM-Erfahrungen aus zwei virtuellen internationalen SAFe-Pr...
GPM Regionalgruppe Chemnitz (Patrick Albert)
Wegen ihres Umfangs und Komplexität sind größere SAFe-Programme bereits in Präsenz hinsichtlich ihres Managements und ihrer Steuerung anspruchsvoll. Aufgrund von COVID19 jedoch war eine Verlegung in den virtuellen Raum im beschriebenen Praxisfall unausweichlich. Das Management hatte hierbei sicherzustellen, dass die Programmziele trotz des verminderten Kontaktes allen beteiligten Teams dauerhaft klar und präsent sind und dass die in den Teams umgesetzten Funktionen außerdem den genannten Programmzielen dienen.
Besonders wichtig ist dieses Alignment im Rahmen der regelmäßigen PI-Plannings, in welchen alle Teams gleichzeitig die jeweils kommenden Iterationen planen und dabei auch teamübergreifende Abhängigkeiten zuverlässig berücksichtigen müssen.
Es werden Erfolgsfaktoren für den virtuellen Einsatz von SAFe herausgearbeitet und beleuchtet.
Fully-managed Cloud-native Databases: The path to indefinite scale @ CNN Mainz
When it comes to the question: "Where do we actually store our application data?", we are spoilt for choice, especially when it comes to the major cloud providers.
The simple and often completely valid answer is still the classic relational database! It is very suitable for many areas of application, as the technology is tried and tested and can cover a very broad spectrum. It is therefore not surprising that all major cloud providers offer this as a "managed service".
For some years now, however, there have also been so-called cloud-native databases that have been specially developed for the requirements of the cloud. The big promise: "Infinite scalability"
In a large customer project, we have been using such a database productively for over 4 years with Azure CosmosDB. The presentation will deal with the following questions, among others
What does "upscalability" mean in practice ?
What do you have to pay attention to when designing?
What are the actual limits?
What other special features do I get?
When do I need a cloud-native database?
But that's not all! We also look beyond Azure to the other two major cloud providers: AWS and Google Cloud. With DynamoDB and Datastore/Firestore, they have similar products on offer.
Down the Ivory Tower towards Agile Architecture
iSAQB Software Architecture Gathering – Digital 2023, November 2023
Architecture for agile projects must be defined and described differently, as well as continuously developed and evolved. Not all decisions are made at once, nor are they all known right from the start of the project. This sessions presents various useful and lightweight methods, tools and team topologies that can be applied in (large) agile projects to avoid uncontrolled growth and architectural erosion but without acting from the ivory tower and thus suffocating team autonomy.
"Mixed" Scrum-Teams – Die richtige Mischung macht's!
IT-Tage 2023, Frankfurt am Main (Patrick Albert)
Die Rollen und insbesondere deren Zuständigkeiten sind in Scrum recht klar geregelt: Der Product Owner sorgt für das "Was", der Scrum Master für das "Wie" und die Developer für die eigentliche Umsetzung. Solange es sich dabei um ein internes Projekt mit einem komplett internen Team handelt, sind damit bereits die zentralen Fragen beantwortet. Ein wenig differenzierter zu betrachten sind allerdings Teams mit mehreren Parteien wie etwa beim Einsatz von Dienstleistern. Muss etwa zwingend der Kunde den Product Owner stellen oder kann dieser auch auf der Seite des Dienstleisters stehen? Falls alle Developer vom gleichen Dienstleister bereitgestellt werden, würde diese Konstellation sicherlich einige Kommunikationswege verkürzen. Allerdings hat ein Product Owner auf der Seite eines Dienstleisters sicher nicht die gleichen Verbindungen zu den Stakeholdern (Nutzer, Geldgeber, ...) des Produkts wie ein interner Product Owner – wie also könnte er ihre Anforderungen dann gut vor dem Team vertreten? Ähnliche Fragen stellen sich auch für den Scrum Master und das Development-Team. In den meisten Fällen gibt es für verschiedene Konstellationen jeweils Vor- und Nachteile – und zwar sowohl für den Kunden als auch für den Dienstleister. Wichtig bei der Entscheidung für eine dieser Konstellationen ist außerdem die Art des Projekts, der Kreis der Stakeholder, das zur Verfügung stehende Budget, der Zeitrahmen und noch einiges mehr.
Dieser Vortrag beleuchtet verschiedene dieser Varianten und zeigt Vorteile, Nachteile und Risiken auf.
Make Developers Fly: Principles for Platform Engineering
Make Developers Fly – Helping developers to build better applications
Cloud Native Night, Mainz, November 2023, Alex Krause
Platform Engineering is the next stage of DevOps and accelerates software developers even more to build applications faster and bring products rapidly to the customers. In this meetup, we show you the key principles of platform engineering, as we experienced them in our projects, and additionally show you a better way to manage your internal software platforms.
PRINCIPLES FOR PLATFORM ENGINEERING, Alex Krause
How do we help our developers to fly instead of crashing miserablely? The answer is Platform Engineering, a discipline for building internal developer platforms (IDPs) to simplify software delivery for product teams. In this talk, you'll learn how Platform Engineering evolved from the DevOps movement and what principles and best practices make for a good implementation. Finally, we'll take a look at reference architectures that can support your platform.
Der Tod der Testpyramide? – Frontend-Testing mit Playwright
Codineers Rosenheim Meetup, 2. November 2023 (Dominik Haas, QAware)
Wer kennt es nicht: Langsame, instabile und wartungsintensive Tests von Frontends und die Schmerzen damit.
Aber in den letzten Jahren und Monaten hat sich hier viel getan und Playwright ist der vielversprechende neue Stern der Web-Automatisierung.
Ich werde in meinem Talk über das Testen von Frontends sprechen und speziell auf Playwright als spannendes Werkzeug eingehen.
Neben der praktischen Einführung möchte ich auch mit Euch über Best Practices sprechen und einen Versuch wagen die Testpyramide zu töten (oder sie zumindest etwas zu beschädigen).
Was kommt nach den SPAs
Sie kennen doch bestimmt das "Gesetz des Instruments": Wer als Werkzeug nur ein modernes Frontend-Framework hat, löst jedes Problem mit einer Single Page-Applikation. So oder so ähnlich, nur halt mit Hammer und Nagel lautet es, beschreibt jedoch ganz gut die aktuelle Situation der JavaScript-Welt. Auf nahezu jede Anforderung wird mit einer aufgeblähten, clientseitig gerenderten SPA geantwortet. Doch ist es schön langsam an der Zeit, dass wir uns fragen sollten: Ist das wirklich alles? Und die Antwort lautet ziemlich sicher "Nein". Doch genau diesem Thema widmen wir uns und werfen einen Blick auf die Alternativen und da gibt es viele.
Im React-Ökosystem findet aktuell ein kleiner Umbruch statt. Mit Server Side Rendering, Static Site Generation, Server Components und Frameworks wie Next verschiebt sich ein Teil der Arbeit in Richtung Server. Dieser Trend ist auch bei Vue, Svelte und Angular zu beobachten. Und genau das ist es, was die sogenannten Meta-Frameworks ausmacht. Uns als EntwicklerInnen gibt das mehr Flexibilität, um auf Anforderungen reagieren zu können. Sie müssen nicht mehr den kompletten Quellcode zum Client übertragen, haben bessere Caching-Möglichkeiten und auch die Suchmaschinen sind Ihnen dankbar.
Dieser Vortrag gibt Ihnen einen Überblick über die wichtigsten Features von Meta-Frameworks und wo und vor allem wie sie gewinnbringend eingesetzt werden können.
Cloud Migration mit KI: der Turbo
Digital Future Congress (DFC) 2023, September 2023, München, Andreas Zitzelsberger (Business Unit Director bei QAware)
== Dokument bitte herunterladen, falls unscharf! Please download slides if blurred! ==
Alt-Systeme in die Cloud migrieren – mit sechs Leitplanken geht das effizient und sicher. Neu: Künstliche Intelligenz kann jetzt zum Turbo werden! Wir nutzen KI bei der Cloud-Migration und zeigen in diesem Vortrag, was geht und was nicht.
Migration von stark regulierten Anwendungen in die Cloud: Dem Teufel die See...
MedTech Stars, Webkonferenz, September 2023, Josef Adersberger (CEO bei QAware)
== Dokument bitte herunterladen, falls unscharf! Please download slides if blurred! ==
Der Vortrag „Migration von stark regulierten Anwendungen in die Cloud: Dem Teufel die Seele verkaufen oder Himmel auf Erden?“ erkundet das wachsende Bedürfnis und die Herausforderungen, medizinische Anwendungen in die Cloud zu migrieren.
Bei den entsprechenden Anwendungen stellt laut einer Umfrage der Datenschutz für 82% der Anwendungen die größte Herausforderung dar, um den Schritt in die Cloud zu machen. Trotzdem wächst der Druck, diesen Schritt zu vollziehen, aufgrund des Innovations- und Digitalisierungsbedarfs, der durch gesetzliche Initiativen wie das Krankenhaus-Zukunftsgesetz, gestiegene Patientenerwartungen und den immer klareren medizinischen Impact der Digitalisierung angetrieben wird.
Die zentrale Frage, die in diesem Vortrag erörtert wird, ist, wie man hochregulierte Anwendungen schrittweise in die Cloud migrieren kann. Hierzu werden wir einen Ansatz vorstellen und anhand von exemplarischen Anwendungen demonstrieren, wie eine solche Migration erfolgreich durchgeführt werden kann. Abschließend fassen wir den Vortrag mit fünf leitenden Prinzipien zusammen, die bei der Migration von stark regulierten Anwendungen in die Cloud beachtet werden sollten. Diese Prinzipien bieten einen nützlichen Leitfaden für Unternehmen und Institutionen, die den Umzug ihrer Anwendungen in die Cloud erwägen, und sollen dazu beitragen, die Herausforderungen der Cloud-Migration in diesem hochregulierten Bereich erfolgreich zu bewältigen.
Aus blau wird grün! Ansätze und Technologien für nachhaltige Kubernetes-Cluster
SAA 2023 | Software Architecture Alliance, September 2023, München, Mario-Leander Reimer (@LeanderReimer, CTO bei QAware)
== Dokument bitte herunterladen, falls unscharf! Please download slides if blurred! ==
Die Cloud hat bereits heute einen größeren CO2-Fußabdruck als die Luftfahrtindustrie, mit steigender Digitalisierung und Cloudifizierung wird sich dieser Trend fortsetzen, wenn wir nichts dagegen unternehmen. Viele Kubernetes-basierte Installationen sind gemessen am eigentlich benötigten Ressourcen Bedarf stark überdimensioniert und tragen so unnötig zur globalen Erwärmung bei. Wie sieht die Energiebilanz Ihres Clusters und Workloads aus?
In diesem Vortrag zeigen wir Ansätze und Technologien, die dabei helfen K8s-Cluster grün(er) zu machen. Zunächst braucht es Transparenz: Wie sieht die Energiebilanz des Clusters und seiner Workloads aus? Erst danach lassen sich diese gezielt auf ihre Energiesparsamkeit hin optimieren. Und das ist gar nicht so schwer, also packen wir es an!
Endlich gute API Tests. Boldly Testing APIs Where No One Has Tested Before.
SAA 2023 | Software Architecture Alliance, September 2023, München, Ildikó Tárkányi (Senior Software Engineer bei QAware)
== Dokument bitte herunterladen, falls unscharf! Please download slides if blurred! ==
Der Traum von den unendlichen Weiten der Daten ist schnell ausgeträumt, wenn wir unsere APIs nicht im Griff haben. Dabei ist es egal, ob wir uns APIs zwischen unseren Services, zwischen Frontend und Backend oder zu Fremdsystemen anschauen - APIs sind ein fundamentaler Bestandteil unserer Softwarearchitektur und ohne Testautomatisierung geht gar nichts.
Schlecht geschriebene Integrationstests mit selbst erfundenen Testfällen für unsere APIs können richtig nerven: Wir rufen die APIs auf und hoffen, dass genau das zurückkommt, was wir erwarten.
Das geht auch anders: Wir werfen einen Blick auf andere Testansätze, bewerten, welche Aspekte diese jeweils testen und schauen zum Beispiel auf:
• Contract Based Testing
• Black Box Testing der OpenAPI Specs
• Trace-basiertes Testing
50 Shades of K8s Autoscaling
Container Days 2023, September 2023, Hamburg, Mario-Leander Reimer (@LeanderReimer, CTO @QAware).
== Dokument bitte herunterladen, falls unscharf! Please download slides if blurred! ==
Elasticity and unlimited scalability are the holy grail for any cloud-native application. Now you might think: “That’s easy!!! I just run my containers on a Kubernetes cluster and I am done.” But is it really that simple?
Turns out it’s not! Your application as well as your cloud infrastructure and K8s cluster need to address and support these non-functional requirements.
This session will have a detailed and also practical look at the different ways of autoscaling in Kubernetes. We will give an overview of the technical foundations and prerequisites, and then showcase several frameworks and technologies that can be used to flexibly autoscale your cluster and your cloud-native workloads.
Kontinuierliche Sicherheitstests für APIs mit Testkube und OWASP ZAP
This document discusses continuous API security testing using OWASP ZAP on Kubernetes. It proposes running ZAP scans against microservices continuously or on-demand directly in the Kubernetes cluster. This would find vulnerabilities earlier in the development process compared to only running security tests at the end. The document outlines how Testkube, a Kubernetes-native testing framework, could be used to orchestrate and run ZAP scans as tests against microservices to achieve continuous security testing. Demo projects are referenced to show how this approach could work.
Service Mesh Pain & Gain. Experiences from a client project.
Cloud Native Night, Mainz, September 2023, Markus Zimmermann
=== Please download slides if blurred! ===
The topic of service mesh is still present at every major DevOps conference and is the subject of controversial discussions.
A service mesh comes with the promise of implementing cross-functional requirements of microservices such as observability or secure communication without changes within the services. The operational effort and the integration of the services within the service mesh should also be problem-free.
But do the common service mesh implementations keep these promises? In a client project we have gained experience with Linkerd and can say: we did not achieve the benefits without pain. We want to share these experiences and what you can take away for your next project!
50 Shades of K8s Autoscaling
WeAreDevelopers World Congress 2023, July 2023, Mario-Leander Reimer
=== Please download slides if blurred! ===
Elasticity and unlimited scalability are the holy grail for any cloud-native application. Now you might think: “That’s easy!!! I just run my containers on a Kubernetes cluster and I am done.” But is it really that simple?
Turns out it’s not! Your application as well as your cloud infrastructure and K8s cluster need to address and support these non-functional requirements.
This session will have a detailed and also practical look at the different ways of autoscaling in Kubernetes.
We will give an overview of the technical foundations and prerequisites, and then showcase several frameworks and technologies that can be used to flexibly autoscale your cluster and your cloud-native workloads.
Blue turns green! Approaches and technologies for sustainable K8s clusters.
Kubernetes Community Days Munich 2023, Juli 2023, Mario-Leander Reimer
The cloud already has a larger CO2 footprint than the worldwide aviation industry. With increasing digitalization and cloudification this trend will continue if we don't do anything about it. Many Kubernetes installations are greatly oversized in terms of the resources actually required and thus contribute unnecessarily to global warming. What is the energy balance of your cluster and its workloads?
In this session we will discuss approaches and technologies that help to make K8s clusters green(er). First of all, transparency is needed: what is the energy balance of the cluster and its workloads? Only then we can start to optimize for better energy efficiency. And it's not that difficult, so let's get started!
Per Anhalter zu Cloud Nativen API Gateways
Mastering Kubernetes 2023, Juli 2023, Sonja Wegner
Gute APIs sind das Herzstück erfolgreicher digitaler Produkte und Cloud-nativer Anwendungen. Doch schlecht verwaltete APIs werden schnell zum Albtraum. Damit es kein böses Erwachen gibt, setzen wir auf API Gateways: Diese sind etabliert und bekannt und helfen uns bei der Verwaltung der APIs. Sie regeln unter anderem Traffic Management, Rollout-Szenarien, Versionierung, Zugriffskontrolle und Diagnostizierbarkeit.
In diesem Vortrag werden wir das Cloud-native API-Gateway-Ökosystem näher betrachten: Gloo, KrakenD, Kong, Envoy et al. Aber welches davon ist das Richtige für den Einsatz im nächsten Projekt? Lasst es uns herausfinden!
Aus blau wird grün! Ansätze und Technologien für nachhaltige Kubernetes-Cluster
Mastering Kubernetes 2023, Juli 2023, Mario-Leander Reimer
Die Cloud hat bereits heute einen größeren CO2-Fußabdruck als die Luftfahrtindustrie, mit steigender Digitalisierung und Cloudifizierung wird sich dieser Trend fortsetzen, wenn wir nichts dagegen unternehmen. Viele Kubernetes-basierte Installationen sind gemessen am eigentlich benötigten Ressourcen Bedarf stark überdimensioniert und tragen so unnötig zur globalen Erwärmung bei. Wie sieht die Energiebilanz Ihres Clusters und Workloads aus?
In diesem Vortrag zeigen wir Ansätze und Technologien, die dabei helfen K8s-Cluster grün(er) zu machen. Zunächst braucht es Transparenz: Wie sieht die Energiebilanz des Clusters und seiner Workloads aus? Erst danach lassen sich diese gezielt auf ihre Energiesparsamkeit hin optimieren. Und das ist gar nicht so schwer, also packen wir es an!
Más de QAware GmbH (20)
Mit ChatGPT Dinosaurier besiegen - Möglichkeiten und Grenzen von LLM für die ...
Mit ChatGPT Dinosaurier besiegen - Möglichkeiten und Grenzen von LLM für die ...
Make Agile Great - PM-Erfahrungen aus zwei virtuellen internationalen SAFe-Pr...
Make Agile Great - PM-Erfahrungen aus zwei virtuellen internationalen SAFe-Pr...
Fully-managed Cloud-native Databases: The path to indefinite scale @ CNN Mainz
Fully-managed Cloud-native Databases: The path to indefinite scale @ CNN Mainz
"Mixed" Scrum-Teams – Die richtige Mischung macht's!
"Mixed" Scrum-Teams – Die richtige Mischung macht's!
Make Developers Fly: Principles for Platform Engineering
Make Developers Fly: Principles for Platform Engineering
Der Tod der Testpyramide? – Frontend-Testing mit Playwright
Der Tod der Testpyramide? – Frontend-Testing mit Playwright
Migration von stark regulierten Anwendungen in die Cloud: Dem Teufel die See...
Migration von stark regulierten Anwendungen in die Cloud: Dem Teufel die See...
Aus blau wird grün! Ansätze und Technologien für nachhaltige Kubernetes-Cluster
Aus blau wird grün! Ansätze und Technologien für nachhaltige Kubernetes-Cluster
Endlich gute API Tests. Boldly Testing APIs Where No One Has Tested Before.
Endlich gute API Tests. Boldly Testing APIs Where No One Has Tested Before.
Kontinuierliche Sicherheitstests für APIs mit Testkube und OWASP ZAP
Kontinuierliche Sicherheitstests für APIs mit Testkube und OWASP ZAP
Service Mesh Pain & Gain. Experiences from a client project.
Service Mesh Pain & Gain. Experiences from a client project.
Blue turns green! Approaches and technologies for sustainable K8s clusters.
Blue turns green! Approaches and technologies for sustainable K8s clusters.
Aus blau wird grün! Ansätze und Technologien für nachhaltige Kubernetes-Cluster
Aus blau wird grün! Ansätze und Technologien für nachhaltige Kubernetes-Cluster
Último
How Can Hiring A Mobile App Development Company Help Your Business Grow?
ToXSL Technologies is an award-winning Mobile App Development Company in Dubai that helps businesses reshape their digital possibilities with custom app services. As a top app development company in Dubai, we offer highly engaging iOS & Android app solutions. https://rb.gy/necdnt
Hand Rolled Applicative User Validation Code Kata
Could you use a simple piece of Scala validation code (granted, a very simplistic one too!) that you can rewrite, now and again, to refresh your basic understanding of Applicative operators <*>, <*, *>?
The goal is not to write perfect code showcasing validation, but rather, to provide a small, rough-and ready exercise to reinforce your muscle-memory.
Despite its grandiose-sounding title, this deck consists of just three slides showing the Scala 3 code to be rewritten whenever the details of the operators begin to fade away.
The code is my rough and ready translation of a Haskell user-validation program found in a book called Finding Success (and Failure) in Haskell - Fall in love with applicative functors.
Modelling Up - DDDEurope 2024 - Amsterdam
What to do when you have a perfect model for your software but you are constrained by an imperfect business model?
This talk explores the challenges of bringing modelling rigour to the business and strategy levels, and talking to your non-technical counterparts in the process.
All you need to know about Spring Boot and GraalVM
All you need to know about Spring Boot and GraalVM 🐰
UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions
The UI5 tooling is the development and build tooling of UI5. It is built in a modular and extensible way so that it can be easily extended by your needs. This session will showcase various tooling extensions which can boost your development experience by far so that you can really work offline, transpile your code in your project to use even newer versions of EcmaScript (than 2022 which is supported right now by the UI5 tooling), consume any npm package of your choice in your project, using different kind of proxies, and even stitching UI5 projects during development together to mimic your target environment.
UI5con 2024 - Bring Your Own Design System
How do you combine the OpenUI5/SAPUI5 programming model with a design system that makes its controls available as Web Components? Since OpenUI5/SAPUI5 1.120, the framework supports the integration of any Web Components. This makes it possible, for example, to natively embed own Web Components of your design system which are created with Stencil. The integration embeds the Web Components in a way that they can be used naturally in XMLViews, like with standard UI5 controls, and can be bound with data binding. Learn how you can also make use of the Web Components base class in OpenUI5/SAPUI5 to also integrate your Web Components and get inspired by the solution to generate a custom UI5 library providing the Web Components control wrappers for the native ones.
Preparing Non - Technical Founders for Engaging a Tech Agency
Preparing non-technical founders before engaging a tech agency is crucial for the success of their projects. It starts with clearly defining their vision and goals, conducting thorough market research, and gaining a basic understanding of relevant technologies. Setting realistic expectations and preparing a detailed project brief are essential steps. Founders should select a tech agency with a proven track record and establish clear communication channels. Additionally, addressing legal and contractual considerations and planning for post-launch support are vital to ensure a smooth and successful collaboration. This preparation empowers non-technical founders to effectively communicate their needs and work seamlessly with their chosen tech agency.Visit our site to get more details about this. Contact us today www.ishtechnologies.com.au
Enums On Steroids - let's look at sealed classes !
These are slides for my session"Enums On Steroids - let's look at sealed classes !" - delivered among others, on Devoxx UK 2024 conference
Microservice Teams - How the cloud changes the way we work
A lot of technical challenges and complexity come with building a cloud-native and distributed architecture. The way we develop backend software has fundamentally changed in the last ten years. Managing a microservices architecture demands a lot of us to ensure observability and operational resiliency. But did you also change the way you run your development teams?
Sven will talk about Atlassian’s journey from a monolith to a multi-tenanted architecture and how it affected the way the engineering teams work. You will learn how we shifted to service ownership, moved to more autonomous teams (and its challenges), and established platform and enablement teams.
Project Management: The Role of Project Dashboards.pdf
Project management is a crucial aspect of any organization, ensuring that projects are completed efficiently and effectively. One of the key tools used in project management is the project dashboard, which provides a comprehensive view of project progress and performance. In this article, we will explore the role of project dashboards in project management, highlighting their key features and benefits.
8 Best Automated Android App Testing Tool and Framework in 2024.pdf
Regarding mobile operating systems, two major players dominate our thoughts: Android and iPhone. With Android leading the market, software development companies are focused on delivering apps compatible with this OS. Ensuring an app's functionality across various Android devices, OS versions, and hardware specifications is critical, making Android app testing essential.
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers. This video you can watch from my youtube channel at https://youtu.be/m-F-mZA3MkU
Mobile App Development Company In Noida | Drona Infotech
Drona Infotech is a premier mobile app development company in Noida, providing cutting-edge solutions for businesses.
Visit Us For : https://www.dronainfotech.com/mobile-application-development/
Oracle 23c New Features For DBAs and Developers.pptx
Most important New features of Oracle 23c for DBAs and Developers. You can get more idea from my youtube channel video from https://youtu.be/XvL5WtaC20A
Measures in SQL (SIGMOD 2024, Santiago, Chile)
SQL has attained widespread adoption, but Business Intelligence tools still use their own higher level languages based upon a multidimensional paradigm. Composable calculations are what is missing from SQL, and we propose a new kind of column, called a measure, that attaches a calculation to a table. Like regular tables, tables with measures are composable and closed when used in queries.
SQL-with-measures has the power, conciseness and reusability of multidimensional languages but retains SQL semantics. Measure invocations can be expanded in place to simple, clear SQL.
To define the evaluation semantics for measures, we introduce context-sensitive expressions (a way to evaluate multidimensional expressions that is consistent with existing SQL semantics), a concept called evaluation context, and several operations for setting and modifying the evaluation context.
A talk at SIGMOD, June 9–15, 2024, Santiago, Chile
Authors: Julian Hyde (Google) and John Fremlin (Google)
https://doi.org/10.1145/3626246.3653374
How to write a program in any programming language
How to write a program in any programming language
E-commerce Development Services- Hornet Dynamics
For any business hoping to succeed in the digital age, having a strong online presence is crucial. We offer Ecommerce Development Services that are customized according to your business requirements and client preferences, enabling you to create a dynamic, safe, and user-friendly online store.
What next after learning python programming basics
What next after learning python programming basics
Último (20)
How Can Hiring A Mobile App Development Company Help Your Business Grow?
How Can Hiring A Mobile App Development Company Help Your Business Grow?
All you need to know about Spring Boot and GraalVM
All you need to know about Spring Boot and GraalVM
UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions
UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions
Preparing Non - Technical Founders for Engaging a Tech Agency
Preparing Non - Technical Founders for Engaging a Tech Agency
Enums On Steroids - let's look at sealed classes !
Enums On Steroids - let's look at sealed classes !
Microservice Teams - How the cloud changes the way we work
Microservice Teams - How the cloud changes the way we work
Project Management: The Role of Project Dashboards.pdf
Project Management: The Role of Project Dashboards.pdf
8 Best Automated Android App Testing Tool and Framework in 2024.pdf
8 Best Automated Android App Testing Tool and Framework in 2024.pdf
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptx
Mobile App Development Company In Noida | Drona Infotech
Mobile App Development Company In Noida | Drona Infotech
Oracle 23c New Features For DBAs and Developers.pptx
Oracle 23c New Features For DBAs and Developers.pptx
How to write a program in any programming language
How to write a program in any programming language
What next after learning python programming basics
What next after learning python programming basics
YAML crash COURSE how to write yaml file for adding configuring details
YAML crash COURSE how to write yaml file for adding configuring details
Kubernetes with Cilium in AWS - Experience Report!
- 2. Cilium and Hubble 1. What is Cilium? 2. The setting? 3. eBPF 4. Network Policies 5. Hubble 6. My experience so far
- 3. What is Cilium? Cilium is an open source software for providing, securing and observing network connectivity between container workloads - cloud native, and fueled by the revolutionary Kernel technology eBPF. Cilium is an open-source eBPF-based networking, security und observability plugin for kubernetes Cilium is a CNI = (Container Network Interface) https://cilium.io/
- 4. Cilium
- 5. The Setting ● We want security and observability ● Linux is wide spread in the container/cloud landscape ● Encryption, Observability & Security must be installed on top in the user space ○ Limited access to kernel resources ○ Often sidecar proxy ○ Kernelmodule -> Complex and there are runtime risks
- 6. eBPF basics - https://ebpf.io/ extended Berkley Paket Filter ● Also known as “General purpose execution engine”. 1. Part of the linux kernel 2. Can run sandboxed programs in an privileged context 3. Extending kernel capabilities safely and efficiently without changing the kernel code 4. Compiled natively with a JIT 5. Protected through a verifier Example: Manipulating TCP/IP Traffic or collecting metrices
- 7. Cilium
- 8. Cilium Identities ● Kubernetes is dynamic in nature (Pod Scaling, …). ● In Kubernetes each pod has it’s own ip address and all it’s ports available. ● Cilium abstracts network security from network addresses ● => Security is based on identities - on kubernetes labels
- 9. Cilium Network Policies Network Policies work on the “Default Deny Principle” ● Identity based network security. Based on kubernetes labels. Beispiel: Label app=my-cat-gw is allowed to connect to app=my-cat-backend ● Layer 4 capabilities are also possible Beispiel: my-cat-gw darf nur auf Port 8080 von my-cat-backend zugreifen ● Layer 7 (HTTP und RPC) policies are possible.* Beispiel: my-cat-gw can access /api/cat-shop/articles/[0-9]+ with GET. *Standard Kubernetes Network Policies cannot do that.
- 10. Cilium Network Policies ● Cilium’s network policies can also be based on DNS. Example: Label my-cat-service can access api.cat.com ● Cilium learns the IP address and will allow or deny traffic ● Wildcard mechanism Example: *.catz.com DONT: Use DNS based network policies for cluster internal communication. Use pure identity based policies.
- 11. Cilium Network Policies Some examples
- 12. Hubble Hubble is a fully distributed networking and security observability platform. It is built on top of Cilium and eBPF to enable deep visibility into the communication and behavior of services as well as the networking infrastructure in a completely transparent manner.
- 13. Hubble ● Hubble has its own web ui ● Hubble also has a command line tool ○ it is possible to filter for dropped packages ● Hubble is able to export metrices (e.g. prometheus)
- 15. My experiences so far ● Network policies are very powerful ● Communication encryption was very easy to set up ● Seems to be working very stable ● Hubble is extremely good at showing the network flow of the cluster Insecurities: ● Still sometimes very complex ● Updating cilium can be cumbersome ○ When updating kubernetes itself we faced some stability issues in integration ● Didn’t try every feature yet. Still much to learn
- 16. Thank you very much, do you have any questions? Have a nice evening ! :-)
- 17. And a few links if you like… information: https://blog.container-solutions.com/wtf-is-cilium https://cilium.io/ https://b-nova.com/home/content/ebpf-based-networking-with-cilium https://www.youtube.com/watch?v=H5RqSAX-eo4&t=584s Network Policy: Editor: https://networkpolicy.io/ - Visualising network policies. https://docs.cilium.io/