Jordan Liggitt's guest appearances

Jordan Liggitt

Kubernetes Podcast from Google

OwlTail

Adam and Craig end the year by talking to Jordan Liggitt, the member of the Kubernetes Product Security Team who fixed the recent critical security vulnerability in the Kubernetes API server. We also take a look at the news from KubeCon. This is our last episode for 2018. Thank you for your support this year, and we’ll be back on the 8th of January! Do you have something cool to share? Some questions? Let us know:  web: kubernetespodcast.com mail: kubernetespodcast@google.com twitter: @kubernetespod  News of the week  etcd donated to the CNCF   Chubby paper Raft paper  Blog post on the relationship between Kubernetes and etcd by Gyuho Lee and Joe Betz   Istio:   Geekwire: Has Istio become the new cloud-native darling?  Google launches Istio on GKE  VMware NSX Service Mesh  Aspen Mesh open beta In other service mesh news:  A10 Secure Service Mesh   Knative:   Knative: bringing serverless to Kubernetes everywhere  SAP: Extensibility on cloud-native stack  Red Hat to deliver hybrid serverless workloads to the enterprise  Pivotal launches Function Service  GitLab and TriggerMesh announce GitLab Serverless    Oracle Cloud Native Framework Microsoft:  Osiris  Azure Monitor for Containers is GA  Phippy Goes To The Zoo Phippy, Captain Kube and friends now in the CNCF    Digital Ocean Kubernetes now open to everyone Linode Kubernetes CLI  Terraform scripts   VMware closes its acquisition of Heptio  For $550M  Dell will go public again   Quickfire Kubernetes security news   NeuVector announced containerd and CRI-O runtime support in their container firewall  Aqua’s Container Security Platform is now certified to cover the Kubernetes CIS benchmarks  Lacework announced their configuration scanning platform covers Kubernetes Sysdig released Sysdig Secure 2.2, which adds Kubernetes audit events, and the ability to block deployments using Kubernetes admission controllers  Twistlock released 18.11, which “introduces security visualization for Kubernetes, and compliance and security configuration checks for Istio, including new alerting integrations with PagerDuty, and cloud services   Grafana Loki  Thanos: Prometheus at scale    Maestro – A declarative, no-code approach to Kubernetes Day 2 Operators rbacsync PlanetScale announces funding  TechCrunch article    Links from the interview  Jordan’s suggested KubeCon talks to watch:  Kelsey Hightower’s keynote, “Kubernetes and the path to serverless” Julia Evans’ keynote, “High Reliability Infrastructure Migrations”   OpenShift before Kubernetes in 2014  Kubernetes Product Security Team CVE-2018-1002105: proxy request handling in kube-apiserver can leave vulnerable TCP connections  Listing in the National Vulnerability Database Originally filed as a bug against Rancher  Rancher blog post   How to report a vulnerability Proof of concept (third party) How it was fixed  Distributor’s list Client certificate vulnerability in Kubernetes in 2016    Answering questions on Stack Overflow Jordan Liggitt on Twitter, GitHub, Slack or Stack Overflow 

<a href="https://kubernetespodcast.com/about" rel="nofollow" target="_blank">Adam and Craig</a> end the year by talking to <a href="https://twitter.com/liggitt" rel="nofollow" target="_blank">Jordan Liggitt</a>, the member of the Kubernetes Product Security Team who fixed the recent critical security vulnerability in the Kubernetes API server. We also take a look at the news from KubeCon. This is our last episode for 2018. Thank you for your support this year, and we’ll be back on the 8th of January! Do you have something cool to share? Some questions? Let us know: <ul> <li>web: <a href="https://kubernetespodcast.com" rel="nofollow" target="_blank">kubernetespodcast.com</a></li> <li>mail: <a href="mailto:kubernetespodcast@google.com">kubernetespodcast@google.com</a></li> <li>twitter: <a href="https://twitter.com/kubernetespod" rel="nofollow" target="_blank">@kubernetespod</a></li> </ul> News of the week <ul> <li><a href="https://www.cncf.io/blog/2018/12/11/cncf-to-host-etcd/" rel="nofollow" target="_blank">etcd donated to the CNCF</a> <ul> <li><a href="http://static.googleusercontent.com/media/research.google.com/en//archive/chubby-osdi06.pdf" rel="nofollow" target="_blank"> Chubby paper</a></li> <li><a href="https://raft.github.io/raft.pdf" rel="nofollow" target="_blank">Raft paper</a></li> <li><a href="https://kubernetes.io/blog/2018/12/11/etcd-current-status-and-future-roadmap/" rel="nofollow" target="_blank"> Blog post on the relationship between Kubernetes and etcd</a> by Gyuho Lee and Joe Betz</li> </ul> </li> <li>Istio: <ul> <li><a href="https://www.geekwire.com/2018/kubecon-week-istio-become-new-cloud-native-darling/" rel="nofollow" target="_blank"> Geekwire: Has Istio become the new cloud-native darling?</a></li> <li><a href="https://blogs.oracle.com/cloudnative/announcing-oracle-cloud-native-framework-at-kubecon-north-america-2018" rel="nofollow" target="_blank"> Google launches Istio on GKE</a></li> <li><a href="https://blogs.vmware.com/networkvirtualization/2018/12/nsx-service-mesh.html/" rel="nofollow" target="_blank"> VMware NSX Service Mesh</a></li> <li><a href="https://aspenmesh.io/2018/12/aspen-mesh-open-beta-makes-istio-enterprise-ready/" rel="nofollow" target="_blank"> Aspen Mesh open beta</a></li> <li>In other service mesh news: <a href="https://www.a10networks.com/press-releases/networks-introduces-multi-cloud-secure-service-mesh-solution-applications-deployed-kubernetes" rel="nofollow" target="_blank"> A10 Secure Service Mesh</a></li> </ul> </li> <li>Knative: <ul> <li><a href="https://cloud.google.com/blog/products/containers-kubernetes/knative-bringing-serverless-to-kubernetes-everywhere" rel="nofollow" target="_blank"> Knative: bringing serverless to Kubernetes everywhere</a></li> <li><a href="https://blogs.sap.com/2018/12/10/kubernetes-sap-cloud-platform-extension-factory-extensibility-on-a-cloud-native-open-source-stack/" rel="nofollow" target="_blank"> SAP: Extensibility on cloud-native stack</a></li> <li><a href="https://www.redhat.com/en/blog/red-hat-collaborates-google-and-others-knative-deliver-hybrid-serverless-workloads-enterprise" rel="nofollow" target="_blank"> Red Hat to deliver hybrid serverless workloads to the enterprise</a></li> <li><a href="https://content.pivotal.io/blog/the-first-open-multi-cloud-serverless-platform-for-the-enterprise-is-here-try-out-pivotal-function-service-today" rel="nofollow" target="_blank"> Pivotal launches Function Service</a></li> <li><a href="https://about.gitlab.com/press/releases/2018-12-11-gitlab-and-triggermesh-announce-gitlab-serverless.html" rel="nofollow" target="_blank"> GitLab and TriggerMesh announce GitLab Serverless</a></li> </ul> </li> <li><a href="https://blogs.oracle.com/cloudnative/announcing-oracle-cloud-native-framework-at-kubecon-north-america-2018" rel="nofollow" target="_blank"> Oracle Cloud Native Framework</a></li> <li>Microsoft: <ul> <li><a href="https://github.com/deislabs/osiris" rel="nofollow" target="_blank">Osiris</a></li> <li><a href="https://azure.microsoft.com/en-us/blog/azure-monitor-for-containers-now-generally-available/" rel="nofollow" target="_blank"> Azure Monitor for Containers is GA</a></li> <li><a href="https://azure.microsoft.com/mediahandler/files/resourcefiles/phippy-goes-to-the-zoo/Phippy%20Goes%20To%20The%20Zoo_MSFTonline.pdf" rel="nofollow" target="_blank"> Phippy Goes To The Zoo</a></li> <li><a href="https://www.cncf.io/blog/2018/12/11/phippy-comes-to-cncf/" rel="nofollow" target="_blank">Phippy, Captain Kube and friends now in the CNCF</a></li> </ul> </li> <li><a href="https://blog.digitalocean.com/digitalocean-releases-k8s-as-a-service/" rel="nofollow" target="_blank"> Digital Ocean Kubernetes now open to everyone</a></li> <li><a href="https://developers.linode.com/kubernetes/" rel="nofollow" target="_blank">Linode Kubernetes CLI</a> <ul> <li><a href="https://github.com/linode/terraform-linode-k8s" rel="nofollow" target="_blank">Terraform scripts</a></li> </ul> </li> <li><a href="https://blogs.vmware.com/cloudnative/2018/12/11/heptio-close/" rel="nofollow" target="_blank">VMware closes its acquisition of Heptio</a> <ul> <li>For <a href="https://seekingalpha.com/filing/4264907#eolPage29" rel="nofollow" target="_blank">$550M</a></li> <li><a href="https://www.anandtech.com/show/13710/dell-to-be-public-company-again" rel="nofollow" target="_blank"> Dell will go public again</a></li> </ul> </li> <li>Quickfire Kubernetes security news <ul> <li><a href="https://neuvector.com/container-security/kubecon-containerd-crio/" rel="nofollow" target="_blank"> NeuVector announced containerd and CRI-O runtime support in their container firewall</a></li> <li><a href="https://www.aquasec.com/news/aqua-awarded-cis-security-certification/" rel="nofollow" target="_blank"> Aqua’s Container Security Platform is now certified to cover the Kubernetes CIS benchmarks</a></li> <li><a href="https://www.lacework.com/lacework-announces-kubernetes-support-in-end-to-end-cloud-security-platform/" rel="nofollow" target="_blank"> Lacework announced their configuration scanning platform covers Kubernetes</a></li> <li><a href="https://sysdig.com/blog/sysdig-secure-2-2/" rel="nofollow" target="_blank">Sysdig released Sysdig Secure 2.2, which adds Kubernetes audit events, and the ability to block deployments using Kubernetes admission controllers</a></li> <li><a href="https://www.twistlock.com/2018/12/10/twistlock-18-11-release-notes/" rel="nofollow" target="_blank"> Twistlock released 18.11, which “introduces security visualization for Kubernetes, and compliance and security configuration checks for Istio, including new alerting integrations with PagerDuty, and cloud services</a></li> </ul> </li> <li><a href="https://github.com/grafana/loki" rel="nofollow" target="_blank">Grafana Loki</a> <ul> <li><a href="https://improbable.io/games/blog/thanos-prometheus-at-scale" rel="nofollow" target="_blank">Thanos: Prometheus at scale</a></li> </ul> </li> <li><a href="https://mesosphere.com/blog/announcing-maestro-a-declarative-no-code-approach-to-kubernetes-day-2-operators/" rel="nofollow" target="_blank"> Maestro – A declarative, no-code approach to Kubernetes Day 2 Operators</a></li> <li><a href="https://github.com/cruise-automation/rbacsync" rel="nofollow" target="_blank">rbacsync</a></li> <li><a href="https://planetscale.com/news/sharding-for-everyone" rel="nofollow" target="_blank">PlanetScale announces funding</a> <ul> <li><a href="https://techcrunch.com/2018/12/13/planetscale/" rel="nofollow" target="_blank">TechCrunch article</a></li> </ul> </li> </ul> Links from the interview <ul> <li>Jordan’s suggested KubeCon talks to watch: <ul> <li><a href="https://www.youtube.com/watch?v=oNa3xK2GFKY" rel="nofollow" target="_blank">Kelsey Hightower’s keynote, “Kubernetes and the path to serverless”</a></li> <li><a href="https://www.youtube.com/watch?v=obB2IvCv-K0" rel="nofollow" target="_blank">Julia Evans’ keynote, “High Reliability Infrastructure Migrations”</a></li> </ul> </li> <li><a href="https://blog.openshift.com/announcing-openshift-enterprise-20/" rel="nofollow" target="_blank">OpenShift before Kubernetes</a> in 2014</li> <li><a href="https://github.com/kubernetes/sig-release/blob/master/security-release-process-documentation/security-release-process.md#product-security-team-pst" rel="nofollow" target="_blank"> Kubernetes Product Security Team</a></li> <li><a href="https://github.com/kubernetes/kubernetes/issues/71411" rel="nofollow" target="_blank">CVE-2018-1002105: proxy request handling in kube-apiserver can leave vulnerable TCP connections</a> <ul> <li><a href="https://nvd.nist.gov/vuln/detail/CVE-2018-1002105" rel="nofollow" target="_blank">Listing in the National Vulnerability Database</a></li> <li><a href="https://github.com/rancher/rancher/issues/14931" rel="nofollow" target="_blank">Originally filed as a bug against Rancher</a> <ul> <li><a href="https://rancher.com/blog/2018/2018-12-04-k8s-cve/" rel="nofollow" target="_blank">Rancher blog post</a></li> </ul> </li> <li><a href="https://kubernetes.io/docs/reference/issues-security/security/" rel="nofollow" target="_blank">How to report a vulnerability</a></li> <li><a href="https://github.com/evict/poc_CVE-2018-1002105" rel="nofollow" target="_blank">Proof of concept (third party)</a></li> <li><a href="https://github.com/kubernetes/kubernetes/pull/71412/files" rel="nofollow" target="_blank">How it was fixed</a></li> <li><a href="https://github.com/kubernetes/sig-release/blob/master/security-release-process-documentation/security-release-process.md#private-distributors-list" rel="nofollow" target="_blank"> Distributor’s list</a></li> <li><a href="https://github.com/kubernetes/kubernetes/issues/34517" rel="nofollow" target="_blank">Client certificate vulnerability in Kubernetes in 2016</a></li> </ul> </li> <li><a href="https://stackoverflow.com/users/54696/jordan-liggitt?tab=answers&amp;sort=newest" rel="nofollow" target="_blank"> Answering questions on Stack Overflow</a></li> <li>Jordan Liggitt on <a href="https://twitter.com/liggitt" rel="nofollow" target="_blank">Twitter</a>, <a href="https://github.com/liggitt" rel="nofollow" target="_blank">GitHub</a>, <a href="http://slack.kubernetes.io/" rel="nofollow" target="_blank">Slack</a> or <a href="https://stackoverflow.com/users/54696/jordan-liggitt" rel="nofollow" target="_blank">Stack Overflow</a></li> </ul>