Sponsored Keynote: From Complexity to Clarity: Engineering an Invisible Kubernetes - Jesse Butler

This talk focuses on the advancements in Kubernetes as a platform for managing distributed systems. The speaker highlights the importance of Kubernetes in orchestrating workloads, managing application lifecycles, and enforcing governance. They discuss three community projects aimed at alleviating operational burdens: Carpenter, which manages node lifecycles by providing just-in-time infrastructure, Kru, which abstracts operator patterns to streamline resource management, and a project aimed at implementing conditional auto-authorization for enhanced permission models. These projects illustrate the collaborative efforts within the community to leverage Kubernetes effectively and drive innovation in cloud platform scaling.

And uh welcome everyone. Uh thank you so much for having me. Um I'm going to talk a little bit about primitives. Uh so Kubernetes is the backbone of some of the world's most in-demanding distributed systems. Uh beyond workload orchestration, we're managing application life cycle, we're provisioning cloud infrastructure, and we're uh enforcing organizational governance across fleets of clusters. Its extensibility and customization have led to entire ecosystem of

open solutions to solve nearly every operational challenge. In the enterprise, we've fully leaned in to Kubernetes being a platform for building platforms. In the EKS team at AWS, we've seen this firsthand. >> [snorts] >> Uh nearly all of our scaled customers operate a Kubernetes-based platform in order to abstract the cloud complexity and enable developers to deliver and maintain at safe velocity. Very few have reinvented the wheel

here. Most of these platforms are built on open standards from the CNCF ecosystem, but everyone's solving the same problems operationally. The effort comes in tying all these pieces together, keeping it running, scaled, and conformant. System primitives don't simplify or the layers below. They abstract them, making them easier to consume, leveraging their power more easily. Kubernetes is not invisible, and maybe that's not the goal, but we can

push the complexity down into the system so we can use Kubernetes more effectively to build these scaled platforms. These enterprise systems have common set of needs. We need compute, nodes, and entire clusters to scale in and out of our system freely. We need databases and caches and all the other things in the cloud to be integrated well and deeply, and we need to keep everything on the

rails with safe and compliant governance. >> We've been working in these foundational areas across three community projects that we'd like to bring to your attention today. These projects all started by thinking about the cluster features that we wish we had for customers and a desire to leverage Kubernetes more effectively to mitigate that operational burden at scale. [clears throat] Carpenter is a subproject of SIG autoscaling. It's the

node life cycle manager for Kubernetes, providing just-in-time infrastructure based on node uh workload demand. Instead of pre-configuring node groups and scaling them up and down, Carpenter provisions the optimal instance in real time from the universe of what's available to it. We shift from humans predicting what we might need to the system provisioning what it does need. You program your performance and disruption constraints, and your workloads drive

the creation of the data plane in real time, on demand. Scaling our cloud platforms on Kubernetes means managing hundreds of types of resources. Everything from a microservice endpoint to a production database becomes a resource in the cluster. Platform teams often create dozens of custom operators to glue these things together so that developer teams can consume things like dev cluster or an app stack. This is the Kubernetes

way to use operational controllers to customize your Kubernetes experience, but operating dozens of controllers to glue other resources together can start to feel like tech debt. Kru lets you refinance. It abstracts the operator pattern, automatically creating CRDs on your behalf and adapting them to manage the resources that you create with it. No additional operators or webhooks, just a simple schema and a list of resources, and developers

get simple building blocks. Um we let Kubernetes do the heavy lifting of managing all those resources under the covers. Kru is a particular community highlight for me personally. We'd started a project at AWS, and we knew that Google Cloud and Azure were working on similar things. Rather than splitting our attention across different pursuits, we came together and launched Kru. A little more than a year later, it's

a subproject of SIG cloud provider, we're closing in on 1.0, and a new core maintainer has joined from SAP. Thanks, Jacob. Um this project really shows the power of the CNCF and the shared trust that we've all established in this community. When building out platforms, we need to do some gymnastics to enable adaptive permission models. RBAC tells Kubernetes who can do what, but it can't yet tell

us who can do what with this object. For that, we need two systems, an RBAC role to grant permissions, and then an admission policy to optionally say, "Actually, no." based on object attributes. Lucas at Upbound and Micah at AWS are primarily working together to bring conditional auto authorization into Kubernetes. This lets an authorize authorizer say, "Yes, if." attaching conditions to an approval based on object attributes. The

Kep is authorizer agnostic. Cedar is the first authorizer to take advantage of it. That two two-system workaround collapses into a single human-readable policy that handles both authorization and admission in one place.