This article is the third installment in a series focused on setting up a personal cloud using Kubernetes. It provides detailed guidance on configuring Kubernetes clusters and deploying applications, offering a hands-on approach for developers and IT professionals. Readers will gain practical insights into efficient resource management and scaling strategies for their cloud environments.

Approaching the most interesting phase, this article delves into running Kubernetes within Kubernetes. Technologies such as Kamaji and Cluster API are highlighted, along with their integration with KubeVirt. Previous discussions have covered preparing Kubernetes on bare metal and how to turn Kubernetes into virtual machines management system. This article concludes the series by explaining how, using all of the above, you can build a full-fledged managed Kubernetes and run virtual Kubernetes clusters with just a click. First up, let ' s dive into the Cluster API. Cluster API Cluster API is an extension for Kubernetes that allows the management of Kubernetes clusters as custom resources within another Kubernetes cluster. The main goal of the Cluster API is to provide a unified interface for describing the basic entities of a Kubernetes cluster and managing their lifecycle. This enables the automation of processes for creating, updating, and deleting clusters, simplifying scaling, and infrastructure management. Within the context of Cluster API, there are two terms: management cluster and tenant clusters. Management cluster is a Kubernetes cluster used to deploy and manage other clusters. This cluster contains all the necessary Cluster API components and is responsible for describing, creating, and updating tenant clusters. It is often used just for this purpose. Tenant clusters are the user clusters or clusters deployed using the Cluster API. They are created by describing the relevant resources in the management cluster. They are then used for deploying applications and services by end-users. It ' s important to understand that physically, tenant clusters do not necessarily have to run on the same infrastructure with the management cluster; more often, they are running elsewhere. A diagram showing interaction of management Kubernetes cluster and tenant Kubernetes clusters using Cluster API For its operation, Cluster API utilizes the concept of providers which are separate controllers responsible for specific components of the cluster being created. Within Cluster API, there are several types of providers. The major ones are: Infrastructure Provider, which is responsible for providing the computing infrastructure, such as virtual machines or physical servers. Control Plane Provider, which provides the Kubernetes control plane, namely the components kube-apiserver, kube-scheduler, and kube-controller-manager. Bootstrap Provider, which is used for generating cloud-init configuration for the virtual machines and servers being created. To get started, you will need to install the Cluster API itself and one provider of each type. You can find a complete list of supported providers in the project ' s documentation. For installation, you can use the clusterctl utility, or Cluster API Operator as the more declarative method. Choosing providers Infrastructure provider To run Kubernetes clusters using KubeVirt, the KubeVirt Infrastructure Provider must be installed. It enables the deployment of virtual machines for worker nodes in the same management cluster, where the Cluster API operates. Control plane provider The Kamaji project offers a ready solution for running the Kubernetes control plane for tenant clusters as containers within the management cluster. This approach has several significant advantages: Cost-effectiveness: Running the control plane in containers avoids the use of separate control plane nodes for each cluster, thereby significantly reducing infrastructure costs. Stability: Simplifying architecture by eliminating complex multi-layered deployment schemes. Instead of sequentially launching a virtual machine and then installing etcd and Kubernetes components inside it, there ' s a simple control plane that is deployed and run as a regular application inside Kubernetes and managed by an operator. Security: The cluster ' s control plane is hidden from the end user, reducing the possibility of its components being compromised, and also eliminates user access to the cluster ' s certificate store. This approach to organizing a control plane invisible to the user is often used by cloud providers. Bootstrap provider Kubeadm as the Bootstrap Provider - as the standard method for preparing clusters in Cluster API. This provider is developed as part of the Cluster API itself. It requires only a prepared system image with kubelet and kubeadm installed and allows generating configs in the cloud-init and ignition formats. It ' s worth noting that Talos Linux also supports provisioning via the Cluster API and has providers for this. Although previous articles discussed using Talos Linux to set up a management cluster on bare-metal nodes, to provision tenant clusters the Kamaji+Kubeadm approach has more advantages. It facilitates the deployment of Kubernetes control planes in containers, thus removing the need for separate virtual machines for control plane instances. This simplifies the management and reduces costs. How it works The primary object in Cluster API is the Cluster resource, which acts as the parent for all the others. Typically, this resource references two others: a resource describing the control plane and a resource describing the infrastructure, each managed by a separate provider. Unlike the Cluster, these two resources are not standardized, and their kind depends on the specific provider you are using: A diagram showing the relationship of a Cluster resource and the resources it links to in Cluster API Within Cluster API, there is also a resource named MachineDeployment, which describes a group of nodes, whether they are physical servers or virtual machines. This resource functions similarly to standard Kubernetes resources such as Deployment, ReplicaSet, and Pod, providing a mechanism for the declarative description of a group of nodes and automatic scaling. In other words, the MachineDeployment resource allows you to declaratively describe nodes for your cluster, automating their creation, deletion, and updating according to specified parameters and the requested number of replicas. A diagram showing the relationship of a MachineDeployment resource and its children in Cluster API To create machines, MachineDeployment refers to a template for generating the machine itself and a template for generating its cloud-init config: A diagram showing the relationship of a MachineDeployment resource and the resources it links to in Cluster API To deploy a new Kubernetes cluster using Cluster API, you will need to prepare the following set of resources: A general Cluster resource A KamajiControlPlane resource, responsible for the control plane operated by Kamaji A KubevirtCluster resource, describing the cluster configuration in KubeVirt A KubevirtMachineTemplate resource, responsible for the virtual machine template A KubeadmConfigTemplate resource, responsible for generating tokens and cloud-init At least one MachineDeployment to create some workers Polishing the cluster In most cases, this is sufficient, but depending on the providers used, you may need other resources as well. You can find examples of the resources created for each type of provider in the Kamaji project documentation. At this stage, you already have a ready tenant Kubernetes cluster, but so far, it contains nothing but API workers and a few core plugins that are standardly included in the installation of any Kubernetes cluster: kube-proxy and CoreDNS. For full integration, you will need to install several more components: To install additional components, you can use a separate Cluster API Add-on Provider for Helm, or the same FluxCD discussed in previous articles. When creating resources in FluxCD, it ' s possible to specify the target cluster by referring to the kubeconfig generated by Cluster API. Then, the installation will be performed directly into it. Thus, FluxCD becomes a universal tool for managing resources both in the management cluster and in the user tenant clusters. A diagram showing the interaction scheme of fluxcd, which can install components in both management and tenant Kubernetes clusters What components are being discussed here? Generally, the set includes the following: CNI Plugin To ensure communication between pods in a tenant Kubernetes cluster, it ' s necessary to deploy a CNI plugin. This plugin creates a virtual network that allows pods to interact with each other and is traditionally deployed as a Daemonset on the cluster ' s worker nodes. You can choose and install any CNI plugin that you find suitable. A diagram showing a CNI plugin installed inside the tenant Kubernetes cluster on a scheme of nested Kubernetes clusters Cloud Controller Manager The main task of the Cloud Controller Manager (CCM) is to integrate Kubernetes with the cloud infrastructure provider ' s environment (in your case, it is the management Kubernetes cluster in which all worksers of tenant Kubernetes are provisioned). Here are some tasks it performs: When a service of type LoadBalancer is created, the CCM initiates the process of creating a cloud load balancer, which directs traffic to your Kubernetes cluster. If a node is removed from the cloud infrastructure, the CCM ensures its removal from your cluster as well, maintaining the cluster ' s current state. When using the CCM, nodes are added to the cluster with a special taint, node. Cloudprovider. Kubernetes. Io/uninitialized, which allows for the processing of additional business logic if necessary. After successful initialization, this taint is removed from the node. Depending on the cloud provider, the CCM can operate both inside and outside the tenant cluster. The KubeVirt Cloud Provider is designed to be installed in the external parent management cluster. Thus, creating services of type LoadBalancer in the tenant cluster initiates the creation of LoadBalancer services in the parent cluster, which direct traffic into the tenant cluster. A diagram showing a Cloud Controller Manager installed outside of a tenant Kubernetes cluster on a scheme of nested Kubernetes clusters and the mapping of services it manages from the parent to the child Kubernetes cluster CSI Driver The Container Storage Interface (CSI) is divided into two main parts for interacting with storage in Kubernetes: csi-controller: This component is responsible for interacting with the cloud provider ' s API to create, delete, attach, detach, and resize volumes. Csi-node: This component runs on each node and facilitates the mounting of volumes to pods as requested by kubelet. In the context of using the KubeVirt CSI Driver, a unique opportunity arises. Since virtual machines in KubeVirt runs within the management Kubernetes cluster, where a full-fledged Kubernetes API is available, this opens the path for running the csi-controller outside of the user ' s tenant cluster. This approach is popular in the KubeVirt community and offers several key advantages: Security: This method hides the internal cloud API from the end-user, providing access to resources exclusively through the Kubernetes interface. Thus, it reduces the risk of direct access to the management cluster from user clusters. Simplicity and Convenience: Users don ' t need to manage additional controllers in their clusters, simplifying the architecture and reducing the management burden. However, the CSI-node must necessarily run inside the tenant cluster, as it directly interacts with kubelet on each node. This component is responsible for the mounting and unmounting of volumes into pods, requiring close integration with processes occurring directly on the cluster nodes. The KubeVirt CSI Driver acts as a proxy for ordering volumes. When a PVC is created inside the tenant cluster, a PVC is created in the management cluster, and then the created PV is connected to the virtual machine. A diagram showing a CSI plugin components installed on both inside and outside of a tenant Kubernetes cluster on a scheme of nested Kubernetes clusters and the mapping of persistent volumes it manages from the parent to the child Kubernetes cluster Cluster Autoscaler The Cluster Autoscaler is a versatile component that can work with various cloud APIs, and its integration with Cluster-API is just one of the available functions. For proper configuration, it requires access to two clusters: the tenant cluster, to track pods and determine the need for adding new nodes, and the managing Kubernetes cluster (management kubernetes cluster), where it interacts with the MachineDeployment resource and adjusts the number of replicas. Although Cluster Autoscaler usually runs inside the tenant Kubernetes cluster, in this situation, it is suggested to install it outside for the same reasons described before. This approach is simpler to maintain and more secure as it prevents users of tenant clusters from accessing the management API of the management cluster. A diagram showing a Cluster Autoscaler installed outside of a tenant Kubernetes cluster on a scheme of nested Kubernetes clusters Konnectivity There ' s another additional component I ' d like to mention - Konnectivity. You will likely need it later on to get webhooks and the API aggregation layer working in your tenant Kubernetes cluster. This topic is covered in detail in one of my previous article. Unlike the components presented above, Kamaji allows you to easily enable Konnectivity and manage it as one of the core components of your tenant cluster, alongside kube-proxy and CoreDNS. Conclusion Now you have a fully functional Kubernetes cluster with the capability for dynamic scaling, automatic provisioning of volumes, and load balancers. Going forward, you might consider metrics and logs collection from your tenant clusters, but that goes beyond the scope of this article. Of course, all the components necessary for deploying a Kubernetes cluster can be packaged into a single Helm chart and deployed as a unified application. This is precisely how we organize the deployment of managed Kubernetes clusters with the click of a button on our open PaaS platform, Cozystack, where you can try all the technologies described in the article for free.

DIY: Create Your Own Cloud with Kubernetes (Part 3)

"Drive AI & Cloud Innovations: Dive In Now!"

This week's CloudOps Weekly newsletter brings a wealth of insights and opportunities in the ever-evolving realm of DevOps and cloud technology. A key highlight is the article on empowering developers to drive AI innovation, emphasizing strategic alignment and resource allocation to unlock AI's potential. We also feature five exciting DevOps job openings across various industries, reflecting the growing demand for skilled professionals. Dive into the world of AI development with our behind-the-scenes look at GenAI's role in software solutions, revealing the challenges and processes developers face. Microsoft's ongoing efforts to innovate datacenter infrastructure and security are also spotlighted, showcasing advancements in energy efficiency and scalability. Additionally, Apica's new feature for centralizing telemetry data management promises to streamline DevOps environments. For those keen on cloud solutions, the third part of our Kubernetes series offers practical steps to set up your personal cloud. Budget-conscious readers will find value in our guide on cost-effective shift-left testing for microservices. ECMAScript's latest enhancements, including a new approval stage, bring exciting news for JavaScript developers, while the launch of VECTR Enterprise Edition by Security Risk Advisors promises to boost cybersecurity measures significantly. Stay informed and positioned at the forefront of industry advancements by subscribing to our newsletter.

CloudOps Weekly: Empower developers to boost AI innovation, explore top DevOps jobs, and learn about Microsoft’s advancements in datacenter security. Discover new features in telemetry management, cost-effective microservices testing, and stay updated on JavaScript’s ECMAScript enhancements and cybersecurity tools.

Issue %%issue_number%%

This article provides a comprehensive guide on setting up a Git local repository accessible over a local area network (LAN). It covers essential steps to facilitate collaboration through LAN access, detailing the configuration process for efficient team usage. The piece is ideal for DevOps professionals looking to enhance their team’s workflow with LAN-based version control systems.

A Git repository simplifies the sharing of code to a team. Many teams opt to go the GitHub route but The post Git: Set Up a Local Repository Accessible by LAN appeared first on The New Stack.

Git: Set Up a Local Repository Accessible by LAN

"Stay Ahead: CloudOps Trends & AI DevSecOps"

This week's issue of CloudOps Weekly covers essential topics in DevOps and cloud technology. Discover strategies to accelerate AI adoption for developers with actionable steps to integrate AI successfully and enhance project outcomes. Explore the launch of the Social Web Foundation aimed at promoting interoperability and inclusivity within the Fediverse, showcasing efforts from W3C to foster a more user-friendly social internet. Analyze the pros and cons of using Kubernetes for database management, focusing on scalability and automation versus implementation complexities. The integration of DevOps into edge computing is discussed, highlighting the need for quicker, reliable frameworks to improve user application performance. Learn about AI's potential in automating DevSecOps governance and enhancing security. A guide on setting up a Git repository over LAN can enhance team collaboration, while another article explores aligning life-long ambitions with DevOps culture for continuous improvement. Additionally, integrating threat modeling into DevOps security is shown to transform traditional pentesting. Finally, the AWS Weekly Roundup shares updates on G6e instances, Karpenter improvements, the significance of Amazon's Prime Day metrics, and AWS Certifications updates.

This week in CloudOps: AI adoption for developers, Social Web Foundation's launch to boost Fediverse, and Kubernetes pros/cons for databases. DevOps at the edge and AI's role in DevSecOps governance also featured. Check AWS updates on G6e instances and more!

Explore critical considerations when selecting a Cloud Native Application Protection Platform, emphasizing security integration, scalability, and compliance. Gain insights into evaluating product functionalities and vendor compatibility for streamlined DevSecOps processes. Ensure robust cloud-native environments by prioritizing features that align with organizational needs and future-proofing strategies.

Harsh truth: 90% of businesses take the wrong route to choose a cloud native application protection platform (CNAPP) vendor. Most The post Cloud Native App Protection Platforms: 6 Tips Before Buying appeared first on The New Stack.

Cloud Native App Protection Platforms: 6 Tips Before Buying

"Unlock CloudOps Insights: AI, Security & More!"

This week's edition of CloudOps Weekly delves into several crucial topics within the DevOps and cloud technology sphere. It opens with an in-depth article on graph embeddings, offering insights into their role in AI applications and how they can be used to uncover complex data relationships. In a spotlight on cybersecurity, the newsletter emphasizes the importance of gender diversity and the unique perspectives women bring to enhance security innovations. For developers, an article highlights Buildkite's expanded continuous delivery platform, designed to optimize large-scale software deployments. Additionally, this edition explores strategies for securing Docker Business and microservices in multicloud environments, ensuring robust security and compliance. The newsletter also features findings on the widespread adoption of generative AI among software engineers, indicating a significant shift in development practices. Lastly, INE's recognition as a leader by G2 for 2024 is celebrated, and the collaboration between the Internet Architecture Board and ISO for future networking tech is discussed.

CloudOps Weekly explores graph embeddings in AI, gender diversity in cybersecurity, and Buildkite's platform expansion. Dive into strategies for Docker Business security and multicloud protection. Generative AI adoption among developers takes center stage. INE excels as G2's 2024 leader, and future internet advancements are underway with IAB and ISO.

Opsmill's InfraHub automates the infrastructure as code process by utilizing GitOps practices to enhance efficiency and consistency. The solution simplifies infrastructure management with automated pipelines that align with best practices, promoting agility and scalability. This development solidifies the importance of integrating Infrastructure as Code solutions in modern DevOps environments.

Managing network infrastructure around the globe is a pain,  said Damien Garros, OpsMill CEO and co-founder, in an interview with The post OpsMill Infrahub Automates Infrastructure as Code with GitOps appeared first on The New Stack.

OpsMill Infrahub Automates Infrastructure as Code with GitOps

Unlock AI's Power: From Safety to Secure Clouds!

In the latest issue of CloudOps Weekly, we delve into the critical role of AI in modern DevOps and cloud technology. Key highlights include comprehensive strategies to mitigate safety risks in AI-powered applications through secure development and continuous monitoring. Discover Russ Cox's pioneering work in integrating AI-powered help agents into open-source projects, designed to enhance developer support and documentation. Atlassian introduces an AI product boosting developers' productivity via intelligent agents, aimed at automating routine tasks and expediting project management. We also explore the significance of securing decentralized cloud environments with confidential virtual machines, ensuring superior data protection and compliance. Another feature covers OpsMill InfraHub's automation of infrastructure as code with GitOps practices, emphasizing efficiency and scalability in infrastructure management. Understand how SpyCloud's identity analytics boosts cybercrime investigations by enhancing insider threat detection and supply chain risk assessments. The newsletter also offers insights into effective engineering management from a former NVIDIA CTO, stressing innovation and adaptability. For teams integrating AI, we highlight tools like AI coding assistants for improved productivity and techniques to tackle catastrophic forgetting in AI models, crucial for enhancing model reliability.

CloudOps Weekly: Discover AI's impact on DevOps with Russ Cox's AI help agents for open-source projects, and Atlassian's new AI product for developers. Learn about securing decentralized clouds with confidential VMs, and check out OpsMill InfraHub's GitOps automation. Insights into engineering management and AI coding assistants included.

This article discusses the results from Docker's 2024 Stack Overflow survey, highlighting key insights and trends in containerization technologies. It elaborates on the increased adoption rates and user satisfaction with Docker's solutions, as well as the challenges faced by developers. The article serves as an appreciation to the community's participation and feedback, which are pivotal in shaping future developments.

Thank you to the community for recognizing Docker as the most-used and most-desired developer tool for the second consecutive year, and for elevating Docker to be the most-admired.

Thank You to the Stack Overflow Community for Ranking Docker the Most Used, Desired, and Admired Developer Tool

"Explore the Future of AI and CloudOps Today!"

In this edition of CloudOps Weekly, we're excited to introduce several groundbreaking advancements in cloud technology and DevOps. First, delve into Mediasoup, an open-source tool designed to revolutionize streaming media workflows in cloud environments, enhancing user experience and application efficiency. Additionally, explore the release of the world's fastest AI chip—a game-changer for developers seeking to accelerate AI computations and enhance application processes. The newsletter also discusses the importance of integrating security in AI development through Docker's 'Secure by Design' principle, which ensures robust and secure applications. Meanwhile, Google's new AI-powered compliance tool, 'Checks', streamlines app security by automating compliance checks. Stay informed about the latest research on non-human identities security risks by Entro Security Labs and learn about Microsoft's AI-optimized Azure VMs, the ND H200 v5 Series. Our deep dive into these recent advancements will keep you at the forefront of the industry, arming you with the insights needed to adopt and implement cutting-edge technologies effectively.

This week, discover Mediasoup for streaming, the fastest AI chip, Docker's 'Secure by Design', Google's compliance tool 'Checks', and Microsoft's new Azure VMs for AI. Stay ahead with these cloud innovations.

Explore the emerging trend of remote local development, known as 'remocal', which enhances efficiency in Kubernetes workflows. This approach combines the benefits of local and remote environments, optimizing the development process for cloud-native applications. The article provides insights into how 'remocal' development simplifies Kubernetes management for developers.

The rise of Kubernetes and microservices, while hugely beneficial for operations teams, added another layer of complexity to the development The post Remocal Development: The Future of Efficient Kubernetes Workflows appeared first on The New Stack.

Remocal Development: The Future of Efficient Kubernetes Workflows

"Master CloudOps: From Kubernetes to Terraform!"

This week's edition of CloudOps Weekly brings you key developments in DevOps and cloud technology. Discover how DefectDojo's new feature enhances DevSecOps data normalization, improving integration and security in ASPM platforms. Learn about 'remocal' development in Kubernetes workflows, combining local and remote environment benefits for efficiency in cloud-native applications. Delve into Python's inner workings, understanding its runtime environment for better development skills. Scale your infrastructure with Terraform's best practices, improving efficiency and reducing costs. Gain practical insights into implementing software design patterns in real projects for skill enhancement. Enhance your React app's observability with OpenTelemetry, optimizing performance monitoring. Explore a critique of OSI's Open Source AI definition, offering insights into AI's unique attributes. Stay updated with AWS's latest announcements, including Amazon EC2 X8g instances and Amazon Q Generative SQL for Amazon Redshift. Finally, see how Charles Schwab leverages PostgreSQL and VMware Tanzu for improved cloud services, reflecting a commitment to modern technology.

This week's CloudOps Weekly covers DefectDojo's new DevSecOps data feature, 'remocal' development for Kubernetes, Python's inner workings, Terraform scaling practices, and AWS updates. Charles Schwab's PostgreSQL adoption enhances cloud services.

The article provides an overview of 27Global’s SaaS practice, highlighting the company’s approach to delivering scalable and robust software as a service solutions. It emphasizes 27Global’s commitment to leveraging cutting-edge technologies and best practices in the DevOps domain. The piece further explores the strategic insights and methodologies the company employs to enhance software deployment efficiencies and achieve optimal client satisfaction.

27Global is a software, data, and cloud engineering and IT consulting company. We bring a full-team approach to every client engagement  a consulting team with the business acumen to understand our client s vision, plus a world-class technical team with the expertise to build our clients solution.

27Global SaaS Practice Overview

Unlock Cloud Secrets & AI Insights This Week!

This week in CloudOps Weekly, we delve into crucial topics shaping the DevOps and cloud technology landscape. Learn how to prevent secret exposure in collaboration platforms by adopting secure practices to manage sensitive information, significantly reducing the risk of data breaches. Get the latest on the SIG Cloud Provider's 2024 updates, offering insights into advancements aiding cloud-native application development. Understand the debate around 'NoOps' and the necessity of human oversight in AI-driven DevOps operations to maintain security and reliability. Furthermore, explore the incredible transition potential of Zorin OS for those migrating from Windows, with its user-friendly interface and customization options. Discover how integrating knowledge graphs with retrieval-augmented generation can enhance the performance of large language models. Lastly, dive into the overview of 27Global’s SaaS practice focused on scalable, robust solutions and examine Broadcom's potential acquisition of VMware, reshaping cloud services competition.

Stay ahead in the DevOps realm! Learn about preventing secret leaks in platforms, SIG Cloud Provider's 2024 strategies, and the impact of Broadcom's VMware plans. Plus, explore the AI 'NoOps' debate and Zorin OS for Windows migrants #CloudOpsWeekly

Exploring the integration of AI and machine learning in software development, this article analyzes the benefits of improving efficiency, accuracy, and innovation, while also highlighting potential challenges and ethical considerations. It discusses how these technologies can transform the development process through automation and smarter analytics, yet emphasizes the need for addressing issues such as bias and data privacy. The balance between harnessing AI/ML capabilities and maintaining robust software engineering principles is key for successful implementation.

Not long ago, artificial intelligence (AI) and machine learning (ML) were merely experimental fields. Today, they serve as mission-critical tools The post Innovating Software Development With AI and ML: Pros and Cons appeared first on The New Stack.

Innovating Software Development With AI and ML: Pros and Cons

CloudOps Insights: AI, Security & DevOps Innovation

In this week's edition of CloudOps Weekly, we delve into various facets of the evolving tech landscape. Discover how DuckDB is making waves in query processing with its exceptional efficiency and adaptability, making it a standout for modern data analysis. For those working in Linux environments, our guide on Linux Access Control Lists offers valuable insights into enhancing security through granular permission controls. Delve into the dynamics of DevOps with our piece on continuous feedback, illustrating how it bridges performance gaps by fostering collaboration and rapid iteration. We also explore ChatGPT's strategic transition from Next.js to Remix for potentially improved user experiences and developer tools. Additionally, learn about automating web application security testing to combat cyber threats, and how CortexClick uses generative AI to revolutionize software documentation processes. Finally, understand the evolving relationships among SQL, NoSQL, and vector databases, and get insights on the nuances of rate limiting for optimizing APIs and business processes. As AI and ML continue to integrate into software development, we analyze their benefits, challenges, and the ethical considerations they bring.

This week in CloudOps Weekly: Explore DuckDB's impact on query processing, Linux ACL insights for enhanced security, and ChatGPT's switch to Remix. Dive into DevOps feedback strategies, automated security testing, and AI-driven documentation with CortexClick. Understand the synergy between SQL, NoSQL, and vectors, plus rate limiting's transformative effect on APIs, alongside AI/ML pros and cons in software development.

Explore the key highlights of Kubernetes 1.31 focusing on the advancements in kubeadm v1beta4. The update enhances usability and introduces improvements aimed at simplifying the setup and management of Kubernetes clusters. Learn about the updated features and how they streamline the container orchestration process.

As part of the Kubernetes v1. 31 release, kubeadm is adopting a new (v1beta4) version of its configuration file format. Configuration in the previous v1beta3 format is now formally deprecated, which means it ' s supported but you should migrate to v1beta4 and stop using the deprecated format. Support for v1beta3 configuration will be removed after a minimum of 3 Kubernetes minor releases. In this article, I ' ll walk you through key changes; I ' ll explain about the kubeadm v1beta4 configuration format, and how to migrate from v1beta3 to v1beta4. You can read the reference for the v1beta4 configuration format: kubeadm Configuration (v1beta4). A list of changes since v1beta3 This version improves on the v1beta3 format by fixing some minor issues and adding a few new fields. To put it simply, Two new configuration elements: ResetConfiguration and UpgradeConfiguration For InitConfiguration and JoinConfiguration, dryRun mode and nodeRegistration. ImagePullSerial are supported For ClusterConfiguration, there are new fields including certificateValidityPeriod, caCertificateValidityPeriod, encryptionAlgorithm, dns. Disabled and proxy. Disabled. Support extraEnvs for all control plan components extraArgs changed from a map to structured extra arguments for duplicates Add a timeouts structure for init, join, upgrade and reset. For details, you can see the official document below: Support custom environment variables in control plane components under ClusterConfiguration. Use apiServer. ExtraEnvs, controllerManager. ExtraEnvs, scheduler. ExtraEnvs, etcd. Local. ExtraEnvs. The ResetConfiguration API type is now supported in v1beta4. Users are able to reset a node by passing a --config file to kubeadm reset. DryRun mode is now configurable in InitConfiguration and JoinConfiguration. Replace the existing string/string extra argument maps with structured extra arguments that support duplicates. The change applies to ClusterConfiguration - apiServer. ExtraArgs, controllerManager. ExtraArgs, scheduler. ExtraArgs, etcd. Local. ExtraArgs. Also to nodeRegistrationOptions. KubeletExtraArgs. Added ClusterConfiguration. EncryptionAlgorithm that can be used to set the asymmetric encryption algorithm used for this cluster ' s keys and certificates. Can be one of &quot; RSA-2048&quot; (default), &quot; RSA-3072&quot; , &quot; RSA-4096&quot; or &quot; ECDSA-P256&quot; . Added ClusterConfiguration. Dns. Disabled and ClusterConfiguration. Proxy. Disabled that can be used to disable the CoreDNS and kube-proxy addons during cluster initialization. Skipping the related addons phases, during cluster creation will set the same fields to true. Added the nodeRegistration. ImagePullSerial field in InitConfiguration and JoinConfiguration, which can be used to control if kubeadm pulls images serially or in parallel. The UpgradeConfiguration kubeadm API is now supported in v1beta4 when passing --config to kubeadm upgrade subcommands. For upgrade subcommands, the usage of component configuration for kubelet and kube-proxy, as well as InitConfiguration and ClusterConfiguration, is now deprecated and will be ignored when passing --config. Added a timeouts structure to InitConfiguration, JoinConfiguration, ResetConfiguration and UpgradeConfiguration that can be used to configure various timeouts. The ClusterConfiguration. TimeoutForControlPlane field is replaced by timeouts. ControlPlaneComponentHealthCheck. The JoinConfiguration. Discovery. Timeout is replaced by timeouts. Discovery. Added a certificateValidityPeriod and caCertificateValidityPeriod fields to ClusterConfiguration. These fields can be used to control the validity period of certificates generated by kubeadm during sub-commands such as init, join, upgrade and certs. Default values continue to be 1 year for non-CA certificates and 10 years for CA certificates. Also note that only non-CA certificates are renewable by kubeadm certs renew. These changes simplify the configuration of tools that use kubeadm and improve the extensibility of kubeadm itself. How to migrate v1beta3 configuration to v1beta4? If your configuration is not using the latest version, it is recommended that you migrate using the kubeadm config migrate command. This command reads an existing configuration file that uses the old format, and writes a new file that uses the current format. Example Using kubeadm v1. 31, run kubeadm config migrate --old-config old-v1beta3. Yaml --new-config new-v1beta4. Yaml How do I get involved? Huge thanks to all the contributors who helped with the design, implementation, and review of this feature: Lubomir I. Ivanov (neolit123) Dave Chen(chendave) Paco Xu (pacoxu) Sata Qiu(sataqiu) Baofa Fan(carlory) Calvin Chen(calvin0327) Ruquan Zhao(ruquanzhao) For those interested in getting involved in future discussions on kubeadm configuration, you can reach out kubeadm or SIG-cluster-lifecycle by several means: v1beta4 related items are tracked in kubeadm issue #2890. Slack: #kubeadm or #sig-cluster-lifecycle Mailing list

Kubernetes v1.31: kubeadm v1beta4

"Unlock Cloud's Future: AI, DevOps & More!"

This week's issue of CloudOps Weekly dives into several revolutionary advancements across the DevOps and cloud technology landscape. Discover how LaunchDarkly's feature flagging and experimentation capabilities are mitigating software release risks, optimizing deployment processes, and preventing potential disruptions for DevOps teams. We also summarize the key discussions from P99 CONF, where experts explored the integration of Rust in Linux and the impact of SLOs on performance innovations.

Explore the findings from HashiCorp's 2024 Cloud Strategy Survey, revealing trends and challenges in cloud maturity and adoption. This survey provides invaluable insights into the strategic priorities of organizations as they navigate digital transformations using cloud technologies. Additionally, learn about the potential of synthetic data in AI and travel industries, addressing privacy concerns and enhancing AI models for transformative solutions.

Backslash Security's strategic upgrades with simulation and generative AI tools mark a pivotal shift in strengthening DevSecOps platforms to counter cyber complexities. In parallel, Broadcom introduces VMware Tanzu Platform 10, aimed at improving scalability in cloud-native development, announced at Explore 2024. Moreover, gain insights into DocuSign's AI-powered platform advancing agreement management, and Kubernetes 1.31's kubeadm v1beta4 update that simplifies Kubernetes cluster management.

Finally, understand how platform engineering is empowering a 10,000-strong development workforce by providing tailored infrastructures and freeing developers to focus on coding, effectively scaling operations and meeting complex cloud-native environment demands.

This week in CloudOps: LaunchDarkly mitigates software risks with feature flagging. Rust debuts at P99 CONF for Linux integration. HashiCorp Survey reveals elusive cloud maturity trends. Synthetic data reshaping AI & travel. Backslash Security enhances DevSecOps with AI tools. VMware Tanzu 10 debuts at Explore 2024, boosting cloud-native development.

This article explores the optimization of garbage collection in HashiCorp Nomad, particularly emphasizing the performance enhancements discovered during the Nomad bench tests. The authors delve into the intricacies of resource management and the impact of garbage collection on job scheduling efficiency. This technical examination offers valuable insights for professionals utilizing container-orchestration systems to streamline their operations.

During the work on Nomad’s 1. 8 LTS release, the team spent some time creating a benchmarking infrastructure for Nomad, running performance tests and trying to find places where we could improve Nomad’s efficiency. This short article describes a process for finding a problem within Nomad’s garbage collection mechanism and an optimization that we made. What’s Nomad’s garbage collection and how does it work? Much like Go, the programming language in which it’s written, the Nomad workload orchestrator supports garbage collection. It can be triggered manually with the CLI or an API call, but some users may not know how Nomad servers handle garbage collection implicitly. This article will go into detail about that implicit side of Nomad garbage collection. Nomad garbage collection is not the same as garbage collection in a programming language, but the motivation behind its design is similar: it’s there to free up memory allocated for objects that are no longer being referenced or needed by the scheduler. Nomad garbage collection applies to evaluations, nodes, jobs, deployments, and plugins (consult the Nomad scheduling overview article to understand these concepts better), and can be configured by users. When one of the Nomad servers becomes a leader, it starts periodic garbage collection “tickers” that clean objects marked for garbage collection from memory. Some of these objects, like evaluations, are marked for GC automatically, and some, like jobs, can get marked for GC by RPC calls initiated by users. An interesting example is job deregistration. Whenever users issue a job stop command or API call, Nomad stops the job but doesn’t remove information about it from memory. You can still see information about a stopped job, such as its deployments or allocations, e. G. $ nomad job status example ID = example Name = example Submit Date = 2024-05-17T13: 49: 28+02: 00 Type = service Priority = 50 Datacenters = * Namespace = default Node Pool = default Status = dead (stopped) Periodic = false Parameterized = false Summary Task Group Queued Starting Running Failed Complete Lost Unknown echo 0 0 0 0 1 0 0 Latest Deployment ID = 82460a04 Status = successful Description = Deployment completed successfully Deployed Task Group Desired Placed Healthy Unhealthy Progress Deadline echo 1 1 1 0 2024-05-17T13: 59: 11+02: 00 Allocations ID Node ID Task Group Version Desired Status Created Modified daa3693d 459490f1 echo 0 stop complete 30s ago 3s ago This default behavior can be overridden using a -purge flag, which will force GC on a given job and objects that depend on it, but by default jobs won’t be GCd until job gc interval time passes. Nomad’s basic unit of work is an evaluation. Every evaluation is essentially a “work order” for the Nomad scheduler; something that needs to be done. A new job creates an evaluation (or multiple evaluations), and so does a job update, or stopping a job. The “tickers” mentioned earlier also create evaluations, which end up in the “core” internal scheduler. Since Nomad is a distributed system that coordinates its actions using Raft, most of the new evaluations are created by RPC calls that can then be replicated using Raft transactions. Discovery While running an experiment that measured how many job dispatch requests Nomad could handle per second, we noticed periodic spiking in the number of “ nomad. Nomad. Eval. Ack ” data points being emitted, among other evaluation-related metrics. Each invocation of this metric in particular indicates an evaluation has been successfully processed and reached a completed state. Why then was Nomad creating evaluations in large numbers at a periodic interval, which was well outside the bounds of evaluations created due to job dispatch requests? Job garbage collection As previously discussed, Nomad runs an internal garbage collection process to remove old and obsolete state objects. This process can be manually triggered via the “ /v1/system/gc ” API and was a process we were using within the experiment to control memory growth. Without this, the Nomad servers running within the experiment would fail due to out of memory (OOM) errors, because the load test was creating approximately 2, 400 job objects each minute, and each job would move to a completed state after ~3s. Job batch deregister RPC When Nomad determines a job can be garbage collected, it performs an RPC call to the “ Job. BatchDeregister ” endpoint. As the naming implies, Nomad can provide an array of jobs to deregister that are deleted in a single Raft transaction, providing write efficiency. Inside the RPC handler, we can see a section of code that loops through the job array and creates an evaluation per job. Evaluations need to be created when a user submits a job deregistration, as we need to calculate what allocations need to be stopped, however, the batch deregister endpoint is not exposed via the HTTP API. Optimization We double and triple checked that garbage collection was the only process to use the batch deregister RPC, then we added some additional tests and removed the loop and code that creates evaluations from the handler via #20510. This change means Nomad no longer creates an evaluation when garbage collecting a job, reducing both Raft and eval broker load. Running the same experiment from when the evaluation spikes were first noticed with the modified code, we no longer see spikes in “ nomad. Nomad. Eval. Ack ”. Across the two experiments, it was also found that Nomad subsystems such as Raft and the eval broker were comparatively put under less load with the new changes. This means we are now able to achieve higher throughput and greater stability along with minor improvements in CPU and memory consumption. Final notes We hope this article shed some light on Nomad internals and in particular how its garbage collection works. If you’re interested in more Nomad deep dives, have a look at a recent article on Nomad’s eval broker, and of course feel free to try Nomad for yourself. You can download it from the project’s website, and we have lots of documentation to get started.

Nomad’s internal garbage collection and optimization discovery during the Nomad Bench project

"DevOps Insights: Nomad, AI Models & More!"

This week’s CloudOps Weekly newsletter delves into the latest trends and tools in DevOps and cloud technology. A highlight is the exploration of HashiCorp Nomad's garbage collection and performance enhancements discovered during the Nomad Bench project. The newsletter also covers the release of AI21 Labs' Jamba 1.5 model on Amazon Bedrock, showcasing its integration with AWS for enhanced natural language processing capabilities. Security remains a strong focus with insights into the collaboration between application security and DevOps teams to tackle increasing challenges. In Kubernetes management, SUSE Rancher Prime offers streamlined administrative tools for enterprises, while AWS's new Parallel Computing Service promises to scale HPC workloads efficiently. Additionally, HashiCorp Vault's improved PKI functionalities, the significance of spans for mobile engineers, and the transformative impact of Spring AI on Java for generative AI applications are thoroughly examined. Finally, five notable DevOps job opportunities are highlighted, helping professionals navigate career advancements in this dynamic field.

Discover key enhancements in HashiCorp Nomad's garbage collection, Jamba 1.5's AWS integration, and the latest in DevOps security and Kubernetes management. Plus, explore Spring AI's impact on Java development and exciting DevOps job openings.

I'm curating this article for a newsletter, give me a 3 sentence summary of this article so I can copy and paste it in my newsletter.  Make the tone professional and concise.

Stay informed about the latest advancements in DevOps and cloud technology by subscribing to our weekly newsletter. 
Each edition provides curated insights and trends designed to keep you updated and positioned at the forefront of the industry.
Don't miss the opportunity to enhance your knowledge and stay ahead of the curve.