>> Live from Barcelona, Spain it's theCUBE.
Covering KubeCon + CloudNativeCon Europe 2019.
Brought to you by Red Hat,
the Cloud Native Computing Foundation
and ecosystem partners.
>> Welcome back to theCUBE here in Barcelona, Spain
at the Fira, it's KubeCon + CloudNativeCon 2019.
I'm Stu Miniman and my co-hosts for two days
of live wall-to-wall coverage is Corey Quinn.
Joining us back, we have two CUBE alums,
Liz Rice, right to my right here
who is a Technology Evangelist with Aqua security.
Liz, thank you so much welcome back.
>> Pleasure to be here.
>> And Jeff Brewer, Vice President and Chief Architect,
Small Business & Self-Employed Group, of Intuit.
A CUBE alum since a few hours ago
this morning. >> Yes, yes, thank you.
>> Jeff, welcome back. >> Thank you.
>> So, we've got you back with a different hat.
Everybody in our industry can definitely recognize
we wear lots of different hats
we have lots of jobs thrown at us.
Both of you are in the Technical Oversight Committee
and Liz is not only a member but also
the Chairperson, President. (people laughing)
>> President is definitely a promotion.
But, yeah, I'm Chair of the committee.
>> Maybe, as it's known, the TOC.
Liz, before we get there, your shirt says +1 binding.
You have to explain for us and did not get
a preview before the interview,
so we'll see where this goes.
>> It's one of the perks of being on the TOC.
When we have something that comes to a vote
we want to get input from the community
so we ask anyone in the community to vote.
But unless you're a member of the TOC
your vote is non-binding.
As a member of the committee, we have binding votes.
And the traditional thing you write on
the voting email is +1 binding.
So, it's a nice surprise to get a t-shirt
when I joined the TOC. >> Very nice.
Can you just give us, our audience,
that might not be familiar with the TOC, give us some
of the key things about it.
>> It's the Technical Oversight Committee for the CNCF.
We are, really, the technical curation
of the projects that come in to the CNCF.
Which projects will get support and at what level
because we have the sandbox experimentation stage
then incubation and then finally graduation
for the really established and kind of, de-risked projects.
So, we're really evaluating the projects
and kind of making a decision collaboratively
on which ones we want the CNCF to support.
>> All right.
So Jeff, we had a great conversation with you
about Intuit's cloud journey.
Tell us how you got involved in the TOC.
We always love the end users, not just using
but participating in and helping
to give some governance over what the community is doing.
>> Yeah, so, about a year and a half ago we made
a decision to acquire a small company called Applatix.
Who was, actually, already in the end user community.
And also contributors as well.
Through that acquisition, I was part of that acquisition,
I led that acquisition from the Intuit side
and really got excited about
the Kubernetes and the KubeCon story overall.
Through the Kubernetes experts, I met them at a KubeCon
and they introduced me to a whole lot more
of the community.
Just through some overall partnerships
with AWS and also spending a lot of time with end-users
that's how I really got to know the community a little bit.
And then, was voted onto the CNCF
as an end user representative in January.
>> Wonderful.
As far as you're concerned, as you go through this,
do you find it challenging at times
to separate your roles professionally
from working for a large company, to whom
many things matter incredibly.
Again, as mentioned earlier, I am one of your customers.
I care very much about technical excellence,
coming out of Intuit, versus your involvement
with the larger project.
>> Yeah, so like most people in technology companies
I'm extremely busy and I would love to spend,
I would love to clone myself and spend more (laughing)
more time. >> Everybody wants
to submit a client project to the TOC
we will prioritize that one. >> Exactly, exactly.
>> The way I really balance it is
that I make an explicit time carve out
for those two activities.
And most importantly, I attend the meetings.
The TOC meetings that we have,
those are extremely important.
We get a lot of project reviews in those meetings.
Liz chairs those meetings.
That's where I always make sure that
my schedule is cleared for that.
>> Taking it, I guess, one step further.
Do you find it challenging at all to separate out,
in fact, when you're making decisions
and making votes, for example, that are presumably binding,
+1 binding as we've learned now, is the terminology.
Do you find that you are often pulled
between trying to advocate for your company
and advocating for the community
or are they invariably aligned in your mind?
>> I mean, my job's the easiest because
I come from an end user.
So what I use and what I consume
is likely what the community at large.
There might be some niches and stuff like that.
But I usually don't have that conflict.
I don't know, as more of a vendor, you might have
more of a conflict. >> It's something
that I have be conscious of.
I just try to mentally separate.
I have a role with a company that pays my salary
but when I'm doing open-source things
if I feel conflicted about.
This hasn't really come up yet, but if I do feel
that there's some kind of conflict of interest
I will always recuse myself.
Actually, in my previous role, as the Co-Chair
for the Program Committee for the KubeCon
and CloudNativeCon Conference, on a couple of occasions
we had competitors submit, and I would always
just step back from those.
Because it's the right thing to do.
>> All right.
So Liz, there's quite a few projects now,
under the umbrella of CNCF.
If I've go it right, it was like, 38 different ones.
When Brian went on the stage this morning,
16 in the sandbox, 16 incubating and six have graduated now.
How do you manage that?
You know, there's some in the community
they're like, oh my gosh, reminds us of like, big tent,
from some initiatives.
Some other things here, how much is too much?
How do you balance that and what's the input of the TOC?
>> Yeah, so one of the things that we're doing
with the TOC is we've just established
a thing called the SIGs, the special interest groups.
Very much following the same model of Kubernetes SIGs.
But the idea here is that we can,
kind of formalize getting experts in the community
to help us with particular kind of areas.
So, we've already got a storage and security SIG set up.
We expect there will be probably four to six more coming
on board during the year.
And that helps us with things like
the project reviews and the due diligence to just
be able to say, we would really appreciate some help.
Those groups are also really enthusiastic about
kind of sharing knowledge in the form
of things like white papers.
I think it will be really important
for end-users to be able to navigate
their way around these projects.
Quite often there is more than one solution
for a particular thing.
And being able to, in a non-vendor way,
in a neutral way, express why project X
is good in one circumstance and project Y would
be better in a different environment.
There's work to be done there and I'm hoping
to see that come out. >> This is one of my passions
as the end user representative, is that trail map
or that road map.
That's one of the reasons why we really
have invested at Intuit,
in the Kubernetes technology
and the Cloud Native technology.
We didn't just roll them out as is.
We actually curate them and create, really,
a paved road for our developers to navigate that space.
>> Yeah, and as we heard from your story
it's not always, well, if there's some overlap
you use SDO and Hellman. >> Yeah.
>> That there's a fit for both of those
in your environment, right. >> Yeah.
>> From a, I guess, an end user perspective
is there a waiting difference between someone like Intuit
and someone like Twitter for pets,
where there's a slight revenue scale,
a slight revenue difference, like scale difference,
like everything difference. >> Yes.
>> Certainly, there is.
I think that, but that's one of the beautiful things
about the Cloud Native technologies.
You can consume what you need and what you want, right.
It's not one size fits all.
A lot of people talk about, oh, there's a paradox
of choice, there's so many projects, right.
Actually, that's a benefit.
Really, all you need is that road map to navigate
your way through that, rather than
just adopting a paved road that
might not work for everybody.
>> It almost feels, to some extent,
almost like the AWS Service Catalog.
Whenever you wind up looking at all the things they offer.
It feels like going out to eat at the Cheesecake Factory.
Where there is 80 pages of menu to flip through
with some advertisements, great.
And reminding yourself, at time, that they are not Pokemon,
you do not need to catch them all.
It's, sometimes, a necessary step, as you start
to contextualize this. >> That's one of
the great things about having over 80 members
in the end user is.
You can find a buddy, you can find a company like you.
Talk to them, get connected with them
and figure out what they're doing and learn from them.
The community is broad enough to be able to do that.
>> All right, so Liz, let's talk about security.
>> Okay. (people laughing)
>> You said there's a SIG that started up.
Where are we, how are things going
and you can you share about where
we're going in the near future?
>> The SIG came together from a group of people
who really wanted to make it easier
for end-users to roll out their Cloud Native stacks
in a secure fashion.
We don't always, as a community, speak the same language
about security, we don't always have
the most secure settings by default.
They really came together around this common interest
of just making it easier for people to secure.
I think a big part of that will be looking at
how the different projects, are they applying best practices
from a security perspective?
Is there more they should do to document
how to operate their particular project more securely?
I think that whole initiative and that group
of people who've come together for SIG security,
I'm so impressed and so pleased that
they have come together with that enthusiasm
to help on that front.
>> Any commentary on what you're seeing in this space?
>> Yeah, so as an almost, a fintech company,
with a lot of fintech and, you know,
we're not quite a bank, but we have a lot
of the same security and compliance things.
That SIG is so, so important to us.
And having a roadmap.
I found a education is really, really a big part of it
of the security experts, right.
Because this is somewhat newer technology.
Even though it's been in use at Google for a long time
the regulator's, the compliance people,
don't totally understand it, right.
So you have to have a way to explain
to them what's going on.
So things like, open policy agent,
something that we've adopted, helps us explain
what's going on in our system.
Once they get it, they're like, this is awesome
and our end users can now, really, our end users,
meaning the people that use QuickBooks and TurboTax
can really trust that we have those guardrails in place.
>> At Aqua, it's a huge concern from a lot of our customers.
Many of whom, coming from that kind of finance industry.
That they're coming to us and saying, well,
how can I be PCI compliant or GDPR.
How do I manage these requirements
with my container based stack, with my Cloud Native stack.
That's why there is this huge ecosystem
quite a lot of effort around security, compliance, policy.
>> It feels very much like it's two problems rolled into one.
First, how do you make sure that data
is secure in these things?
Secondly, how do you effectively and responsibly communicate
that to a regulator, who expects to be taken
on a tour of a data center when they show up on site?
(people laughing)
I checked, they won't let you.
>> There are definitely two sets of security people
in my experience.
There are a set of people who care about
how will I get attacked.
How will breaches happen.
And there are other people who go,
I have a checklist and I need to check the boxes
in the checklist, tell me how.
Sometimes those two things overlap, but not always.
>> All right, Liz, lot of updates, as always.
Jeff, I really appreciate your commentary there.
Well, there's the paradox of choice but
we have a lot of customers out there
and therefore we do. (people chuckling)
Any highlights you want to share with our audience?
>> I think one thing that happens every year
is we see more.
Well, we saw Kubernetes graduate, I think,
early last year, end of the previous year.
Now we've got six projects into graduation.
From my perspective, that says something
about how mature this whole set of projects,
this whole platform is becoming.
Because graduation is a pretty high bar.
Not least in terms of the number of end users
that have to be using it in production.
This is solid technology.
>> Yeah, any highlights from you?
>> I think, like we might have touched on
a little bit this morning.
But I think that usually
the technologies that where you're facing the big problems
is pretty obvious which one to use, right.
Like serverless, you're going to go look
at something like Knative or whatnot.
Functions as a service.
There's some open fast projects, whatnot, like that.
SDO services mesh is another one
where it's getting mature and it's getting
to the point where you can have
these ubiquitous service meshes throughout it.
So, those are the areas that we're
most looking at right now.
>> Great, all right.
Well, Liz and Jeff, thank you so much for joining us.
Thanks for all the work you do on
the Oversight Committee and appreciate you sharing
the updates with our community.
>> Thank you for having us. >> Thank you.
>> For Cory Quinn, I'm Stu Miniman.
We'll be back more, with theCUBE
here at KubeCon + CloudNativeCon 2019.
Thanks for watching.
(upbeat music)