Sponsored Keynote: From Complexity to Clarity: Engineering an Invisible Kubernetes - J. Butler (ASL)

This talk covers the role of Kubernetes as a vital backbone for modern distributed systems, emphasizing its capabilities in workload orchestration and cloud infrastructure management. The speaker discusses the importance of extensibility and how Kubernetes has fostered an ecosystem of open-source solutions that help enterprises manage operational challenges. They highlight specific projects such as Carpenter, which offers real-time provisioning of resources based on workload demand, and Kube, designed to simplify the management of Kubernetes resources through automation. Additionally, the speaker introduces a collaboration focused on enhancing authorization models within Kubernetes and presents the Gateway API as a unified solution for managing ingress configurations. The speaker advocates for more community involvement in these projects to develop the foundational scaffolding for future abstractions within the Kubernetes ecosystem.

Welcome everyone. Thank you so much for having me. I'm going to talk a little bit about primitives. So Kubernetes is the backbone of some of the world's most in demanding distributed systems. Beyond workload orchestration, we're managing application life cycle, we're provisioning cloud infrastructure, and we're enforcing organizational governance across fleets of clusters. It's extensibility and customization have led to entire ecosystem of open solutions to solve nearly every

operational challenge. In the enterprise, we've fully leaned in to Kubernetes being a platform for building platforms. In the EKS team at AWS, we've seen this firsthand. Nearly all of our scaled customers operate a Kubernetes based platform in order to abstract the cloud complexity and enable developers to deliver and maintain at safe velocity. Very few have reinvented the wheel here. Most of these platforms are built on open

standards from the CNCF ecosystem, but everyone solving the same problems operationally. The effort comes in tying all these pieces together, keeping it running, scaled, and conformant. System primitives don't simplify the layers below. They abstract them making them easier to consume leveraging their power more easily. Kubernetes is not invisible and maybe that's not the goal, but we can push the complexity down into the system so we can

use Kubernetes more effectively to build the scale platforms. These enterprise systems have common set of needs. We need compute, nodes, and entire clusters to scale in and out of our system freely. We need databases and caches and all the other things in the cloud to be integrated well and deeply. And we need to keep everything on the rails with safe and compliant governance. We've been working in

these foundational areas across three community projects that we'd like to bring to your attention today. These projects all started by thinking about the cluster features that we wish we had for customers and a desire to leverage Kubernetes more effectively to mitigate that operational burden at scale. Carpenter is a sub project of SIG auto scaling. It's the node lifecycle manager for Kubernetes providing just-in-time infrastructure based on node

workload demand. Instead of pre-configuring node groups and scaling them up and down, Carpenter provisions the optimal instance in real time from the universe of what's available to it. We shift from humans predicting what we might need to the system provisioning what it does need. You program your performance and disruption constraints and your workloads drive the creation of the data plane in real time on demand. Scaling our

cloud platforms on Kubernetes means managing hundreds of types of resources. Everything from a microservice endpoint to a production database becomes a resource in the cluster. Platform teams often create dozens of custom operators to glue these things together so that developer teams can consume things like dev cluster or an app stack. This is the Kubernetes way to use operational controllers to customize your Kubernetes experience, but operating dozens

of controllers to glue other resources together can start to feel like tech debt. Kube lets you refinance. It abstracts the operator pattern automatically creating CRDs on your behalf and adapting them to manage the resources that you create with it. No additional operators or webhooks, just a simple schema and a list of resources, and developers get simple building blocks. We let Kubernetes do the heavy lifting of managing

all those resources under the covers. Kube is a particular community highlight for me personally. We'd started a project at AWS and we knew that Google Cloud and Azure were working on similar things. Rather than splitting our attention across different pursuits, we came together and launched Kube. A little more than a year later, it's a sub project of SIG cloud provider. We're closing in on 1.0 and a

new core maintainer has joined from SAP. Thanks, Jacob. This project really shows the power of the CNCF and the shared trust that we've all established in this community. When building out platforms, we need to do some gymnastics to enable adaptive permission models. RBAC tells Kubernetes who can do what, but it can't yet tell us who can do what with this object. For that, we need two systems,

an RBAC role to grant permissions, and then an admission policy to optionally say actually no based on object attributes. Lucas at Upbound and Micah at AWS are primarily working together to bring conditional authorization into Kubernetes. This lets an authorize authorizer say yes if attaching conditions to an approval based on object attributes. The KEP is authorizer agnostic. Cedar is the first authorizer to take advantage of it. That

two two system workaround collapses into a single human readable policy that handles both authorization and admission in one place. These projects are part of a broader momentum that we see in the community providing more powerful primitives and compact workflows. Gateway API consolidates ingress, multiple custom resources, and provider configs into one expressive portable API. DRA extends the scheduler's vocabulary to GPUs and FPGAs and accelerators so they become

native resources rather than bolt-ons. The community is doing the meaningful work needed to launch us to the next set of abstractions. This is how Kubernetes becomes invisible or at least some of the many efforts going on to make it feel more invisible. More primitives that let us keep abstracting more of the complexities below and letting Kubernetes do the heavy lifting for us. Check out these projects, get

involved, and help us keep building the scaffolding for the next set of abstractions together. Thank you and have a great KubeCon.