By default, Kubernetes Secrets are not encrypted; values are merely base64 encoded.And this is fine — at least, this is what Mac argues in this episode of KubeFM.Mac says it all comes down to thinking strategically about security and where the Secrets could be leaked.In this episode, you will learn:How to define a threat model to inform your security posture and mitigations.How Kubernetes Secrets offer sufficient guarantees for most common threat models.If you should use Hashicorp Vault or Kubernetes Secrets (and when not to use auto-unsealing).Mac also covers tips and advice on becoming a security expert.Find all the links and info for this episode here: https://kube.fm/kubernetes-secrets-macLinksPlain Kubernetes secrets are fineFluxCDkube-prometheus-stackPrometheus OperatorAlert ManagerPrometheusGrafanaGatekeeperHelm chartsGatekeeper policy for privilege podsGatekeeper policy for Ingresses with wildcard hostnamesArgo CDKubernetes secretsetcdBase64Threat modelFormal methods to threat modelingBitnami Sealed SecretsHashicrop VaultVault Shamir secret sharingVault auto-unsealingHSM backed VaultVault HA configuration"keep it secret, keep it safe." — GandalfSWOT analysisChaos Engineering by Kelly Shortridge

What does it take to build a Kubernetes cluster on bare metal?In this episode of KubeFM, you will learn how to plan and execute a successful setup for a bare-metal Kubernetes cluster.You will follow Mathias' journey as he rebuilt his cluster several times and learn how to:Identify dependencies and priorities between components to avoid incidents in the future.Leverage FluxCD to have a predictable and documented setup.Secure the nodes from external traffic with firewalls and Cilium cluster-wide network policies.Use Talos to have a self-contained Kubernetes operating system.Mathias also shared tips and advice for other engineers embarking on the same process.Find all the links and info for this episode here: https://kube.fm/bare-metal-kubernetes-mathiasLinks8-part series: Kubernetes on bare-metalArgo CDFlux CDcert-managerexternal-dnsHabbo HotelAutoItK3SK0STalosHetznerCal NewportHarborFlatcar LinuxKubeVirtkube-ovnCiliumFlannelCilium cluster-wide network policiesCiliumCon in AmsterdamCilium: policy audit moder/kubernetesDatavirke

Should every project start with Kubernetes?And if not, when is the right time to switch without incurring (unbearable) technical debt?In this episode of KubeFM, you will learn how the team at Loovatech designed an app from scratch and decided to use Docker Compose to host their infrastructure cheaply and effectively in a single virtual machine.As the project grew, the team had to make the difficult choice to rearchitect their infrastructure and plan for scalability and fault tolerance.Follow their journey and learn:How to migrate from a single Docker Compose file with 24 containers to Kubernetes.How to verify that your apps are stateless and what changes are necessary to deploy them into Kubernetes.How to manage expectations and explain the value of a complex migration to your boss or (non-tech-savvy) customers.Vasily and Ronald also shared how they integrated ArgoCD and their existing CI/CD to leverage push and pull-based GitOps and their plans to incorporate multi-tenancy and custom metrics.Find all the links and info for this episode here: https://kube.fm/docker-compose-migration-vasily-ronaldLinksLoovatechDocker ComposeArgoCDPrometheusGrafanaKEDAAnsibleTerraformKubernetes documentationApplication migration from Docker Compose to Kubernetes. How, why, and what problems we’ve encounteredUsing Docker ComposePicvarioDocker SwarmUploading and copying objects using multipart upload in AWS S3CeleryFFMPGAmazon Elastic File SystemKubeSprayAWS EKSAzure AKSAWS EKS changelogHelm chartsTeamCityArgoCD user guide: HelmGitOps: Push-based vs. Pull-based DeploymentsFlux CDHow to autoscale apps on Kubernetes with custom metricsCloudFormationTerraGrantCapCutIan Coldwater

How do you upgrade a Kubernetes cluster to the latest release without breaking anything?And what if you had to upgrade hundreds of clusters simultaneously?In this episode, Pierre explains the process, tooling and testing strategy in upgrading clusters at scale.You will learn:How the team at Qovery keeps updated with the latest (vanilla) Kubernetes changes and managed services changelogs.How to upgrade Helm charts gradually and safely. Pierre has some tips for Custom Resource Definitions (CRDs).How to test API deprecations with end-to-end testing.How to automate the process of upgrading clusters.You will also learn from Pierre's experience in managing stateful applications in Kubernetes with 4500 nodes on bare metal.Find all the links and info for this episode here: https://kube.fm/upgrading-100s-clusters-pierreLinksThe cost of upgrading hundreds of Kubernetes clustersK9sExternal DNScert-manageringress-nginxPrometheusMetric serverPrometheus adapterQoveryKubeSprayKubernetes the hard wayPod Distruption BudgetStatefulSetVertical Pod AutoscalerCluster AutoscalerHorizontal Pod AutoscalerKubernetes changelogKubentPopeyekdavePlutoLokihelm-freezeTesting Helm chartshelm install --atomichelm install --waitKubeCon EU 2024

Are logs enough to troubleshoot your deployment and infrastructure?Perhaps, but there's a better way to observe, monitor and debug your stack: embracing observability.In this episode, Adriana explains how she learned to love Open Telemetry and:How you can combine Traces, Metrics and logs to really understand the root cause of your production issues.What the Open Telemetry Collector is, and how it can simplify the ingestion of traces, logs and metrics without tying you into a particular vendor?How to convince colleagues and the business to adopt new technologies.In this episode, Bart also invited a special guest, Hannah (Adriana's daughter), to ensure that Adriana tells the truth and nothing but the truth.Hannah shared some great tips on public speaking and… baking!Find all the links and info for this episode here: https://kube.fm/adriana-hannah-unpacking-o11yLinksArgo CDGitOpsOpenTelemetry operatorOpenTelemetryCNCF landscapeServiceNow Cloud ObservabilityRed Hat OpenshiftGeeking Out podcastOn Call Me Maybe podcastCharity MajorsAdriana's Medium blogELK stackSLA vs SLO vs SLIOpen Telemetry signals: traces, metrics, logsOpen Telemetry instrumentationOpenTelemetry Q&A Feat. Hazel WeaklyKubeCon North America 2023Open Telemtry End User Working GroupOpenTelemetry Community End User SurveysOpenTelemetry collectorPrometheus receiverPrometheus metricsLiz Fong-JonesTed YoungToronto CNCF meetupObservability Day 2023All Things Open 2023

Follow Gazal's journey as he shares the lessons learned in adopting, rolling out and scaling EKS clusters at Target Australia over seven years.You will learn:What is Bottlerocket OS.How Bottlerocket helps with securing your workloads.Karpenter as an alternative to the Cluster Autoscaler.How Karpenter can efficiently schedule and de-provision workloads.Gazal hinted at a 40% reduction in compute capacity when combining Bottlerocket OS and Karpenter (and 30% lower response times).Find all the links and info for this episode here: https://kube.fm/gazal-eks-bottlerocket-karpenterLinksBolstering Security & Automating Management of Target Australia’s EKS clustersKarpenterMetrics ServerCluster AutoscalerOpenTelemetryOSGiApache MesosJenkins XTektonProwKubernetes SlackkOpsTerraform AWS EKSIAM Roles for Service AccountsAWS EBS CSI driverAWS CNIAmazon VPC CNI now supports Kubernetes Network PoliciesServer-side applyAWS Controllers for Kubernetes (ACK)AWS Load Balancer ControllerBottlerocket OSAmazon Linux 2CIS benchmarksDeprovisioning in KarpenterAWS Node Termination HandlerScheduling in KarpenterKarpenter Provisioner CRD

How do you scale your pods on queue length?In this episode, you will learn:How KEDA simplifies autoscaling in Kubernetes thanks to its vast collection of metrics collectors (i.e. scalers).Jorge's journey in tech: how he levelled up from passing wires as an electrician to learning Go and becoming a KEDA maintainer.Two must-try KEDA scalers: the HTTP add-on to scale to zero and the Carbon-aware scaler for reducing your carbon footprint.You will also dive into what it takes to maintain a successful graduated CNCF project.And lastly, what three Cloud Native tools would Jorge take to a desert island?Spoiler alert: KEDA wasn't his first choice.Find all the links and info for this episode here: https://kube.fm/keda-jorge-turradoLinksKEDAPlease consider changing the name of PetSet before General AvailabilityAzure FunctionsPrometheus Adapter for Kubernetes Metrics APIsKEDA archtitectureKEDA ScaledObjectsKEDA ScaledJobsHorizontal Pod AutoscalingCarbon-Aware KEDA operatorKEDA HTTP add-onKEDA HTTP add-on architectureHTTP add-on: Standardize traffic metrics across traffic sourcesOpenTelemetryKEDA OpenTelemetry scalerKEDA graduation announcementKEDA roadmapAdd support for formula based evaluation of metrics valuesKEDA on Kubernetes SlackKubernetes SlackCNCF SlackCloud Native meetup in BilbaoArgo CDArgo Rollout

TL;DR: Learn the most exciting changes that made it to Kubernetes 1.28 from Grace — the Kubernetes release lead.Kubernetes 1.28 brought us a few notable changes:Sidecar containers are officially recognised as a container (not just a container pattern).Pods from StatefulSet no longer get stuck into Terminating if a node is lost unexpectedly.Validating Admission Policy graduates to Beta.This podcast addresses the new features and dives into what it takes to release a new Kubernetes version.Grace Nguyen (Kubernetes 1.28 release lead) reveals her tips and tricks to stay on top of a release with 1440 contributors from 911 companies.Find all the links and info for this episode here: https://kube.fm/planternetes-grace-nguyenLinksKuberentes 1.28 Release teamKubeCon scholarshipsSIG-releaseRelease Team ShadowsContributor Summit North America 2023SIG-contributor-experienceSIG-docsIntroducing native sidecar containersInit ContainersNon-Graceful Node Shutdown Moves to GAValidating Admission PolicyIntroducing Kubernetes Community-Owned Package RepositoriesCSI migration for GCE PDCluster API Security Self-AssessmentSIG-securityEnhancements Tracking BoardFeature blog Tracking BoardBug Triage Tracking BoardCI Signal Project Board & Issue Tracking