Hello, Cloud Gurus.
I'm Nigel Poulton the author of the Kubernetes book and welcome to Kubernetes
This Month.
As always we'll run through the major Kubernetes news from the month,
and we'll dive deeper into a couple of those items.
Plus we'll round things out when the chance for you to test your Kubernetes
knowledge, with a brand you Guru of the Month question.
First up this month and straight into hosted Kubernetes AKS has a couple of
cool new updates.
So on AKS Kubernetes 1.17 is now GA,
and Containerd is in tech preview.
We'll talk more about those in the deeper dive section,
sticking with hosted Kubernetes though AWS has released a new CIS
benchmark for their hosted EKS service.
Now moving into the distribution space,
Red Hat announced OpenShift 4.5 with better support for
vSphere and GCP,
as well as the vertical pod Autoscaler in tech preview and volume cloning with
CSI driver GA. OpenShift marches on!
And somewhat related,
actually the upstream origin community edition OKD got a
version 4 release.
Now sticking with distros Ranchers k3d got a v3 release.
So k3d is V3. Now, if you don't know,
k3d is K3s in Docker,
and it's great for Kubernetes development environments.
Now as well if you've been following the project, yes,
they entirely skipped version 2, so it is just that much of an upgrade.
Plus it got a new logo. Now, while we're talking about Rancher, SuSE,
the open-source enterprise Linux company is buying them.
So Rancher is being acquired by SuSE and knowing what I know about the
leadership team at Rancher, I'm pretty confident this one will play out well.
Switching our attention to the service mesh space.
If you're unsure about the direction that Google is taking Istio,
and quite a few people are.
Then Hashicorp's Consul is a solid alternative.
Speaking of which Managed Consul or Hashicorp Consul Service went
GA on Azure. As well,
Microsoft announced the Open Service Mesh with a clear direction to donate
it to the CNCF.
Solo released version 1.4 of the Gloo API gateway.
This version's offering enhanced support for Kubernetes Ingress,
Istio 1.6 and a lot more. And I think wrapping the news for this month,
the CNCF have pre-announced a new certified Kubernetes Security Specialist
certification expected to land around the November timeframe.
And that wraps the news for this month.
Okay. For this month's deeper dives,
we'll look closer at a couple of the highlights of the recent AKS release in
particular,
Containerd and one aspect of the EKS CIS benchmark.
So the latest news from AKS is that Kubernetes 1.17 is GA on the
platform. Anyway,
this means that 1.14 is being retired.
And of course there are versions of 1.18 available to you if you like to kick
the tires. But seriously progress obviously waits for no one. I mean,
it seems to me,
at least like it was only yesterday when 1.14 was released and here we have,
AKS retiring it. Anyway,
I wanted to mention Containerd on the nodes.
So most Kubernetes clusters use Docker for low-level container stuff like
starting and stopping containers. Only Docker's a bit bulky,
like it does way more than Kubernetes needs. But the thing is,
Docker is really modular. In fact,
they modularized the entire code base quite a few years ago.
Part of that work involved,
splitting out those low-level container functions that Kubernetes once,
into something called Containerd. So in a way,
Containerd is a lightweight version of Docker that only does this stuff that
Kubernetes needs. Well,
it's been gaining in popularity and other cloud platforms like GKE have let you
opt for containerd over Docker on your nodes for a little while now. Well,
AKS is coming to the party with containerd nodes,
now in tech preview with the current view,
being that it will be the default when the platform supports Kubernetes 1.19.
So keep your eye on containerd,
it's definitely coming and I recommend you start your testing now,
because there are a few things to consider before flipping the switch.
For example,
you won't be able to use the Docker CLI or the Docker API on your nodes to
inspect containers and the likes and there's differences with the logging as
well. So get your testing hat on.
So Amazon releasing the CIS benchmark for EKS shines the light on the shared
responsibility model of a hosted Kubernetes solution.
And I have this conversation a lot, right?
So while hosted Kubernetes can be a really simple on-ramp for Kubernetes.
It is vital that you understand that you're effectively outsourcing the brains
of your cluster, the entire control plane to your cloud provider.
So you damn well better trust them and understand the trade-offs. Well,
the shared responsibility model is very much reflected in the benchmark.
It basically focuses tests and recommendations on the bits that you have
responsibility for. So that's basically the nodes and the apps.
Meaning you don't get spammed with a bunch of false positives and potentially
misleading feedback regarding the hosted bits that Amazon is taking care of.
So if you're an EKS customer or considering becoming one,
definitely check out the benchmark. Oh,
and make sure of course that you understand that you're sharing your
infrastructure responsibility with your cloud provider.
And if you're not on EKS, well,
of course there's always the regular CIS Kubernetes benchmark for unmanaged
clusters.
Okay. Guru of the Month.
Last month,
I asked what best describes how a service mesh provides enhanced network
services? And the answer I was looking for with C,
it injects a sidecar into Pods and sits in between the app
containers and the network where it is nicely placed to do things like
encryption and a bunch more. Well as usual, we had lots of cracking answers,
but we can only have one winner. And this month that one is Suresh Krishnan.
Suresh is a software developer from Bangalore in India. And Suresh,
congratulations, you'll be getting a goodie bag in the post from us. Well,
thanks as usual for everyone else who've gotten involved.
This week's question is in the forum link below,
and I'll see you again next month. Same cube time,
same cube place.