Kubernetes Office Hours for 20 February

[castrojo]

Hello everyone,

Just a reminder that our user office hours are this Wednesday, with one session for EMEA at 2pm UTC (6am PDT) and one for the Americas at 9pm UTC (1pm PDT).

Office hours are a livestream that we do on the Kubernetes YouTube channel. Our panel of experts will take questions from the audience and answer them in real time. If we read your question on the air you’ll automatically be entered in a raffle to win a Kubernetes tshirt!

If you’ve got good Kubernetes experience and want to share it with the community then you are also encouraged to sit on our panel of experts, ping me offlist and we’ll get you set up, we’re always looking for volunteers to help our users!

Feel free to use this thread to link to a question here or you can ask one here directly.

You can find all the meeting information and instructions here:

kubernetes/community/blob/master/events/office-hours.md

[castrojo]

We’re going live in about an hour from this post! If you want us to tackle a question post it here or give us a link to an existing question if you have it on here already, see you soon.

[wombat]

Question: Does anybody see a bigger use of admission-controllers to enforce company policies on devs? If so, whats typical scenarios you see?

[castrojo]

https://www.openpolicyagent.org/ was the agreed best solution for this.

[castrojo]

EU Session

Here are the URLs and recommendations that people were posting on the slack channel during the call, thanks everyone for contributing these, I’m posting them in order of when they’re mentioned:

• Check your stuff! Runc and CVE-2019-5736 - Kubernetes
• https://github.com/kyma-incubator/service-catalog/blob/6bd26102d3465220297a7539d3d9f38f88154cb7/pkg/controller/controller.go#L136-L159

OPA discussion

• https://github.com/open-policy-agent/opa
• https://www.openpolicyagent.org/docs/kubernetes-admission-control.html
• https://youtu.be/xg19CD4TRC8
• https://www.openpolicyagent.org/
• Disable service type loadbalancer

Auth and RBAC

• https://banzaicloud.com/blog/k8s-rbac/
• https://github.com/dexidp/dex - Cool, our own @JoelSpeed is a maintainer now!
• https://github.com/vouch/vouch-proxy
• https://thenewstack.io/single-sign-on-for-kubernetes-dashboard-experience/
• https://github.com/dexidp/dex/blob/master/Documentation/connectors/oidc.md
• https://github.com/vouch/vouch-proxy/blob/db84bc6cfc1aacf0d92613e1bf34669c2e4af325/handlers/handlers.go#L584-L640
• https://auth0.com/
• https://www.keycloak.org/

Networking Discussion

• Today we learned Calico has it’s own slack: https://slack.projectcalico.org/ where you can ask questions, we’re not sure what the status of BGP support for windows containers in k8s is.
• New Cilium - https://cilium.io/blog/2019/02/12/cilium-14/

… and lastly: https://kubernetes.github.io/ingress-nginx/examples/rewrite/ appears to be broken, we need to find out how to report an issue. Discussion still happening in the channel.

[jberkus]

The West Coast session is beginning NOW!

Ask your questions here.