Kubernetes 1.7 with Tim Hockin [audio] | Hacker News Reader

Kubernetes 1.7 with Tim Hockin [audio]

gcppodcast.com

I have nothing to add here but a positive ad-hominem: I went to high school with Tim and he's a super nice, super smart guy. When we were in HS I didn't even know he was such a cool nerd. I only discovered this when I was getting deep into Linux (late 90s/early 2000s), and found out he was the author of an important kernel patch that I needed. Go Tim!

Tim is one of the people in the Kubernetes community that makes it an enjoyable place to work.

Building an open source community is hard and building an open source community for a platform that has a ton of orthogonal interests is even harder. But, Tim, along with many of the other leaders, do a solid job of ensuring that the project does its best to listen to all of the various users and stakeholders and then ultimately takes an opinion and heads in a direction that tries to navigate immediate needs without egregious long-term compromise. It is hard work and no one can expect a 100% success rate, but Tim has done a great job and has been pretty close.

In any case, thanks for your dedication to the project Tim.

Ooo, I want to layer on the thockin love! When I was fresh out of college in 2006 Tim and his team (then the BIOS team at Google) were the friendliest, geniusyiest, most patient group a new grad could hope for. Thanks for the mentorship Tim! -Shawn

+1. My interactions with Tim have been nothing but a pleasure. He cares about the small and large guy. Go Tim!

What have people been experiencing with K8s 1.7? For me it's been nothing but RBAC issues everywhere (Granted, I'm upgrading from 1.5 so it's kinda my own damn fault).

We took the RBAC "hit" in 1.6. This mostly involved grokking the Role/RoleBinding and ClusterRole/ClusterRoleBinding details first. After that it was primarily a matter of updating a slew of Helm charts. Ones that we maintain for ourselves, and several community charts that had yet to be updated.

I think I understand cluster roles and bindings, my biggest thing is that I was using a bunch of off-the-shelf helm charts (for spinnaker, k8s dashboard, and deis workflow especially) and all three stopped working with RBAC. Those have been an...adventure to fix.

If you decide to run with the RBAC authorizer, tools like kubeadm run the control plane components with credentials that have the required permissions out of the box. If you're using your own deployment/setup, you'll want to consult https://kubernetes.io/docs/admin/authorization/rbac/#core-co... to either give standard user/group names to your components, or grant the appropriate roles to custom user/group names.

Once your control plane is running, granting API access to other apps that need it is typically a matter of creating a service account, setting that service account in the pod spec, and granting the service account a role with sufficient access. See https://kubernetes.io/docs/admin/authorization/rbac/#service...

Finally, if you're upgrading an existing cluster, and want to turn on RBAC authorization, there are tips at https://kubernetes.io/docs/admin/authorization/rbac/#upgradi... for easing the transition.

I'm coming from traditional VM's and want to play around with Kubernetes. What are the best guides/articles to get started with Kubernetes?

I've heard to start with https://github.com/kubernetes/minikube locally, but looking for a solid article to get familiar with all the concepts and best practices.

Minikube is a good place to start and the kubernetes.io guide is pretty good: https://kubernetes.io/docs/tutorials/stateless-application/h...

If you like video, try out this new (free) EdX course: https://www.edx.org/course/introduction-kubernetes-linuxfoun...

(Disclosure: I run CNCF and we developed that course.)

I completely forgot about this podcast. Thanks for posting this here.

Reply on news.ycombinator.com