Network Policy usage is inverted.

It's easier to list the services that you want to connect to, but Network Policy forces you to list all clients that can connect to your pod.

How would you even know that another team plans to connect your apps?

But if Network Policy is not the right tool, then what should you use?

In this KubeFM podcast, you will explore:

- How Network Policies are not as bad as you might think, but they are low-level APIs that are not always practical to use directly.
- Intent-based Access Control (IBAC) as a higher-level abstraction to describe your network segmentation requirements.
- How you can use IBAC to generate Network Policies, Istio Authorization Policies, AWS IAM & Roles, and more.

Watch it here: https://kube.fm/network-policies-ori

Listen on:

- Apple Podcast https://kube.fm/apple
- Spotify https://kube.fm/spotify
- Amazon Music https://kube.fm/amazon
- Overcast https://kube.fm/overcast
- Pocket casts https://kube.fm/pocket-casts
- Deezer https://kube.fm/deezer

You can keep updated with the latest Kubernetes news, events, job opportunities and podcasts on Mastodon!

We've been on Mastodon for a while now, but since December 2023, we decided to migrate all our accounts to a private Mastodon instance: Learnk8s.news

Here's the list of all accounts and their handles:

- Learnk8s (Kubernetes news) https://learnk8s.news/@learnk8s
- Kubernetes Architect (K8s architecting and developing apps) https://learnk8s.news/@k8sarchitect
- Kubesploit (K8s Security) https://learnk8s.news/@kubesploit
- K3sDaily (K3s news) https://learnk8s.news/@k3sdaily
- Kube Careers (K8s Jobs) https://learnk8s.news/@KubeCareers
- Kube Events (K8s events) https://learnk8s.news/@k8sevents
- KubeFM (K8s podcast) https://learnk8s.news/@k8sfm

Of course, you can also find us on X/Twitter, LinkedIn, Facebook and Telegram. You can find all the links here: https://learnk8s.io/news-events-jobs

What if Kubernetes was so easy to install and manage to be foolproof?

In this KubeFM, Mat argues that GKE is the only Kubernetes managed service that offers a beginner-friendly and thought-through experience in running a Kubernetes cluster.

Follow Mat's journey to AKS, GKE and EJS and learn:

- How GKE autopilot can help you optimize costs and reduce underutilized node resources.
- How the GKE container-optimized OS prevents and eliminates an entire set of security misconfigurations in node management.
- How GCP's application of machine learning on the IAM permissions can help you gradually refine security permissions as applications are deployed.

Watch it here: https://kube.fm/foolproof-gke-mat

Listen on:

- Apple Podcast https://kube.fm/apple
- Spotify https://kube.fm/spotify
- Amazon Music https://kube.fm/amazon
- Overcast https://kube.fm/overcast
- Pocket casts https://kube.fm/pocket-casts
- Deezer https://kube.fm/deezer

The best way to learn something is to break it or to build it yourself.

And that's precisely what Luca did to understand how Linux containers (and Docker) work: he built his own, Barco.

In this episode of KubeFM, you will learn:

- Why Linux containers "don't exist" but are the product of several Linux features you can put together and configure properly to get what we know as containers.
- How Kernel features such as cgroups and namespaces isolate a process.
- How you can use seccomp and capabilities to secure the container.
- How to make the right syscall from C to build your own container engine.

Watch it here: https://kube.fm/barco-luca

How do Linux containers work?

And how do you build a tool like Docker?

Luca decided to find out and built his own container engine from scratch: Barco.

In this episode of KubeFM, you will learn:

- Why Linux containers "don't exist" but are the product of several Linux features you can put together and configure properly to get what we know as containers.
- How Kernel features such as cgroups and namespaces isolate a process.
- How you can use seccomp and capabilities to secure the container.
- How to make the right syscall from C to build your own container engine.

Watch it here: https://kube.fm/barco-luca

Get ready for a 3-part, free educational program on building Kubernetes platforms with Learnk8s and Loft labs!

Each session comes with a webinar, code samples and a step-by-step article:

- Unit 1: Architecting Kubernetes clusters: single shared cluster or to each their own.
- Unit 2: Kubernetes namespaces offer no isolation, and how you can work around it
- Unit 3: Building a self-serve Kubernetes platform from scratch

You can register here (it's free): https://www.vcluster.com/building-a-multi-tenant-kubernetes-platform/

On average, Kubernetes nodes running on ARM instances are 20% cheaper than their AMD counterpart.

Optimising your cloud bill is tempting, but how do you seamlessly migrate existing workloads to a different architecture?

And how do you do it at scale, with more than 1500 engineers and 30 clusters in 4 regions?

In this episode of KubeFM, Thibault and Miguel explain how Adevinta built an internal platform on Kubernetes for mixed AMD and ARM workloads.

You will learn:

- The challenges they faced with validating containers for mixed architecture with a mutating webhook and the open source solution they came up with: noe.
- Building an internal platform requires careful planning and designing simple interfaces that are backwards compatible.
- How to not DDoS your container registries.

Watch it here: https://kube.fm/arm-nodes-thibault-miguel

In this KubeFM episode, you will learn how to reduce your cloud bill by using mixed pools with AMD and ARM nodes in an EKS cluster.

Watch it here: https://kube.fm/arm-nodes-thibault-miguel

Pod Topology Spread Constraints is a convenient feature to control how pods are spread across your cluster among failure domains such as regions, zones, nodes, etc.

You can also choose the pod distribution (skew), what happens when the constraint is unfulfillable (schedule anyway vs don't) and the interaction with pod affinity and taints.

It's a great and straightforward feature, so what could possibly go wrong?

In this episode of KubeFM, you will follow Martin and his team's journey in discovering and fixing a production incident (on a Friday afternoon) due to a misconfiguration.

You will also learn:

- What are Pod Topology Spread Constraints, and how to use them?
- How unfulfillable scheduling requirements could lead to un-schedulable pods.
- How to detect and alert on unscheduled pods.
- How to manage your team during an incident to keep them calm and focused.

Watch (or listen to) it here: https://kube.fm/pod-topology-martin

What are Pod Topology Spread Constraints, and why are they useful to ensure high availability for your apps?

In this episode of KubeFM, you will follow Martin and his team's journey in discovering and fixing a production incident (on a Friday afternoon) due to a pod topology spread constraint misconfiguration.

You will also learn:

- What are Pod Topology Spread Constraints, and how to use them?
- How unfulfillable scheduling requirements could lead to un-schedulable pods.
- How to detect and alert on unscheduled pods.

Watch (or listen to) it here: https://kube.fm/pod-topology-martin

How hard could it be to debug a network issue where pod connections time out?

It could take weeks if you are (un)fortunate like Alex.

But Alex and his team didn't despair and found strength in adversity while learning several Kubernetes networking and kubespray lessons.

In this KubeFM episode, you'll follow their journey and learn:

- How a simple connection refused led to debugging the kernel syscalls.
- How MetalLB works and uses Dynamic Admission webhooks.
- How Calico works and assigns a range of IP addresses to pods (and what you should watch out for).
- How to use tcpdump and strace to debug network traffic.

Watch (or listen to) it here: https://kube.fm/troubleshooting-kernel-alex

Is sharing a cluster with multiple tenants worth it?

Should you share or have a single dedicated cluster per team?

In this KubeFM episode, Artem revisits his journey into Kubernetes multi-tenancy and discusses how the landscapes (and opinions) on multi-tenancy have changed over the years.

Here's what you will learn:

- The trade-offs of multi-tenancy and the tooling necessary to make it happen (e.g. vCluster, Argo CD, Kamaji, etc.).
- The challenges of providing isolated monitoring and logging for tenants.
- How to design and architect a platform on Kubernetes to optimise your developer's experience.

Watch (or listen to) it here: https://kube.fm/multitenancy-artem

When planning your infrastructure, one of the fundamental questions is: how many Kubernetes clusters should you have?

One big cluster or multiple smaller clusters?

Should the team share resources, or to each their own?

This Thursday, Dan investigates the pros and cons of different approaches and compares cost efficiency, ease of management resilience and security for different setups.

In this session, you will learn:

- How Kubernetes design is intended for sharing resources and the consequence for isolation and security.
- How can you isolate your workloads with different security trade-offs depending on how trustworthy your tenants are?
- How to estimate costs and efforts in building a single shared cluster vs multiple clusters.

📆 Thu, 29th Feb
⏰ 8am PT | 5pm CET

👉 https://www.vcluster.com/event/workshop-series-1/

Structured Authentication Config is the most significant Kubernetes authentication system update in the last six years.

In this KubeFM episode, Maksim explains how this is going to affect you:

1. You can use multiple authentication providers simultaneously (e.g., Okta, Keycloak, GitLab) — no need for Dex.
2. You can change the configuration dynamically without restarting the API server.
3. You can use any JWT-compliant token for authentication.
4. You can use CEL (Common Expression Language) to determine whether the token's claims match the user's attributes in Kubernetes (username, group).

Watch (or listen to) it here: https://kube.fm/structured-authentication-maksim

Can you run databases on Kubernetes and survive to tell the story?

Or should you refrain from running stateful workloads as much as possible?

In this KubeFM episode, Steven argues that you should run databases on Kubernetes.

He also goes further and demonstrates how to build your custom operator to manage your database.

Listen to the episode and learn how:

- You can use Kubebuilder and the Operator Framework to build your operator.
- Custom Resources lets you create higher abstractions to manage your infrastructure as code.
- Steven's operator manages hundreds of databases at scale at QuestDB.

Watch (or listen to) it here: https://kube.fm/operators-steven

Kubernetes namespaces are the basic building block for identity and isolation but don't provide any of those features out of the box.

In this session, you will explore in a great level of detail:

- How namespaces are (not) used during scheduling.
- How namespaces are (not) used in the cluster network and the implementation of Network Policies.
- How namespaces provide the starting point for RBAC.

The insights will help you understand the trade-offs in designing a multi-tenant platform on Kubernetes.

📆 Thu, 7th Mar
⏰ 8am PT | 5pm CET

👉 https://www.vcluster.com/event/workshop-series-2/

Kubernetes: 50 namespaces vs 50 control planes vs 50 clusters.

For the last episode of "Building Kubernetes platforms", we decided to run an experiment: how much does multi-tenancy cost?

We created three scenarios:

- 50 tenants using the Hierarchical Namespace Controller.
- 50 tenants using vCluster.
- 50 dedicated clusters managed via Karmada.

Which one was the most expensive?

Spoiler: the dedicated clusters are very expensive.

But is it worth the investment?

Chris will cover it live on Thursday!

📆 Thu, 14th Mar
⏰ 8am PT | 5pm CET

👉 https://www.vcluster.com/event/workshop-series-3/

Service meshes and the community's opinion of them have changed drastically over the years.

From being perceived as unnecessary, complicated and bloated, they matured into security and observability powerhouses (while still retaining much of their complexity).

In this KubeFM episode, William deep dives into the world of service meshes and explains a few of the technical choices and trade-offs of service meshes in simple terms.

You will learn:

- What is a service mesh and its design (i.e. control plane and data plane).
- How Ambient mesh departs from the traditional sidecar model and how it affects reliability and security.
- Why there's more than just eBPF in sidecarless service meshes and the limitation of this technology.
- The direct costs (compute) and human factors involved in operating a service mesh.

Watch (or listen to) it here: https://kube.fm/service-mesh-william

Ensuring the repeatability of your infrastructure is a crucial aspect of managing Kubernetes clusters.

This allows you to swiftly tear down and set up a new one, a practice that is quite handy.

However, there are exceptional circumstances when your cluster becomes more than a disposable tool.

Dan shared, "A Kubernetes cluster will be treated as disposable until you deploy ingress, and then it becomes a pet."

In this episode, you will delve into the concept of 'disposable' and 'pet' Kubernetes clusters and learn:

- How you can use GitOps to create a repeatable infrastructure that syncs.
- How resources such as the Ingress and external-dns require careful maintenance and monitoring to make your cluster special.
- How Crossplane and vCluster help you define repeatable environments that are disposable.
- All the flavours for Argo: Workflows, Autopilot, CD, etc., and "Project" a newer abstraction to manage apps across environments.

Watch (or listen to) it here: https://kube.fm/ingress-gitops-dan

Kubernetes Community Days Romania starts in less than 2 weeks!

A one-day technical event loaded with exciting Kubernetes talks and networking opportunities.

📆 Thu, 25th Apr
⏰ 8am EET
📍 Bucharest, RO

👉 https://kube.events/t/b08aa779-8760-45e7-a493-4dc023871777

Creating and deleting Pods is one of the most common tasks in Kubernetes.

In this article, you will learn how to prevent broken connections when a Pod starts up or shuts down (and how to shut down long-running tasks gracefully).

Read the full article: https://learnk8s.io/graceful-shutdown