MAYA KACZOROWSKI: Hi.
I'm Maya Kaczorowski.
I'm here at KubeCon in Copenhagen.
And I'm here with Craig Peters from JFrog.
How are you?
CRAIG PETERS: I'm doing great.
How about yourself?
MAYA KACZOROWSKI: Great.
So tell me a little bit about what JFrog does.
CRAIG PETERS: Sure.
So JFrog is a repository manager and platform
for enabling software developers to collaborate effectively
across distributed teams with all the different package
types they use, all the different tools, and do
it in a way that's safe and allows software to be delivered
faster to any endpoint.
MAYA KACZOROWSKI: What do you mean by a way that's safe?
How does that work with containers?
CRAIG PETERS: Oh, well that's a really great question.
I'm so glad you asked.
[LAUGHTER]
It's as though we staged or practiced this.
MAYA KACZOROWSKI: And yet we didn't.
CRAIG PETERS: Absolutely not.
So what I mean by safe is that when you deploy an application
into any environment-- so let's take Kubernetes as an example--
why would we be talking about that here?
But if you're deploying to Kubernetes,
you might have packaged your application in Helm.
So you might have Helm charts that you're using
to deploy the application.
Those depends on Docker images, right?
Those Docker images, you know where they are.
They're in some sort of secure registry.
How do you know what's in those containers?
So what JFrog artifactory provides,
we call it the Kubernetes registry.
MAYA KACZOROWSKI: Oh, I see.
CRAIG PETERS: The Kubernetes registry
of artifactory allows you to have, in one place,
the source of truth for all of the data,
all of the package types, all of the dependencies
that have been built into the container image,
and then packaged into a Helm chart
and used to deploy the application.
You can use any other packaging type.
It doesn't depend on Helm.
But essentially, we act as a Docker registry
that understands all the dependencies
so you know where things are.
And then as a repository manager, what that means
is that you can create different repos for different teams
at different stages of a development lifecycle.
MAYA KACZOROWSKI: So if I have a different one for my app
testing you know--
CRAIG PETERS: Exactly.
MAYA KACZOROWSKI: Got it.
CRAIG PETERS: Exactly.
MAYA KACZOROWSKI: OK.
CRAIG PETERS: Dev, QA, production.
So production can only read from production repositories.
And then you don't want to duplicate all those things.
We essentially have a promotion model.
So based on-- you might want to make it--
MAYA KACZOROWSKI: You move it from one registry
to another or something like that?
CRAIG PETERS: Exactly.
Automatically.
And you want to make so only service accounts can do that.
MAYA KACZOROWSKI: Got it.
CRAIG PETERS: And then you want to make
that completely independent of the underlying storage
and use any off mechanism.
That's what we do.
MAYA KACZOROWSKI: And do you want
to talk me through what's happening right here?
CRAIG PETERS: Absolutely.
So the story here is that you're deploying an application that's
packaged as Docker Images inside a Helm chart to Kubernetes.
Well, what's in it?
It's Docker Images.
If you look at an image, it actually is usually layers--
we use layering and all of that--
that consists of your application,
whatever code you've written--
maybe it's Maven.
You might have written Java and used a build tool,
or it might be npm.
And you've got that bit.
You've got the packages you've depended upon,
which are external packages, and you
might have operating systems.
So the idea, from left to right, is
that using a common registry framework, you can manage--
MAYA KACZOROWSKI: All of the dependencies.
CRAIG PETERS: Exactly-- all the way to the lowest level.
And that's actually really important for companies
where the software production pipeline is their production.
And you can't be blocked if you have
an issue getting to the public npm, for example, right?
And that stops people, in reality.
And so what we do is, we create what's
called a virtual repository that sits
on top of your local repo and the remoted repos
that you have a local cache of.
MAYA KACZOROWSKI: Got it.
CRAIG PETERS: And that allows organizations
to have really good control over what packages
go into their applications.
MAYA KACZOROWSKI: And so tell me about Grafeas and how-- or,
sorry-- tell me how JFrog works with Grafeas.
So Grafeas is Google's open source metadata image server.
And you were one of the launch partners
for that back in October.
How does that work together?
CRAIG PETERS: Absolutely.
So one of the things you have to do in this kind of a scenario
is, you have to have a really deep understanding
of the metadata about all of the different package types.
Grafeas is an open API for exchanging metadata
about those assets between many different systems.
A lot of different tools in the ecosystem
will generate different kinds of information about those.
So the first things we started with, obviously,
are vulnerabilities.
Everybody wants security and safety.
MAYA KACZOROWSKI: Yes.
Security!
CRAIG PETERS: Yeah.
So one of our products is called Xray.
And Xray is a part of this package.
And what it does is, it has a deep understanding
of the layered packaging.
It unpacks them all, understands the components
that go into a package, matches them against vulnerabilities.
But we also do licenses and other things like that.
The point of Grafeas is that it makes
it very easy and lightweight to exchange information between us
and other Grafeas data providers.
So say Google has a huge database
of different kinds of data, like maybe performance
or compatibility data.
You need a way to aggregate that in your CI pipeline
so that you can make automated decisions about whether or not
your software is ready to move from staging into production.
And so you don't want to have to go and query
all of the different systems.
Xray provides a way, using Grafeas to aggregate
all of that data into--
MAYA KACZOROWSKI: A single place.
CRAIG PETERS: --one call.
MAYA KACZOROWSKI: Makes sense.
Great.
Well, thank you so much for chatting with us
on the floor at KubeCon.
CRAIG PETERS: I'm really glad to.
MAYA KACZOROWSKI: Having a good time here?
CRAIG PETERS: Oh, it's been great.
We've had lots of great conversations.
And we're really glad to be here and participating
in this community.
MAYA KACZOROWSKI: Thank you so much.
Hopefully we'll see you in Seattle.
CRAIG PETERS: Absolutely.
[INAUDIBLE]
MAYA KACZOROWSKI: And thank you all for joining and watching us
here at KubeCon.
CRAIG PETERS: Thank you, guys.