DevOps Q&A: AI Coding, Kubernetes Security, Kafka SaaS vs On-Prem Transcript, AI Summary & Key Points

00:00 Heat. [music] [music] Heat. [music] Heat. Heat. [music] Heat. Heat. [music] [music] [music] Heat. Heat. [music] [music] [music] Heat. Heat. Heat. [music] [music] Heat. Heat. Heat. [music] Heat. Heat. [music] [music] Heat. Heat. Heat. [music] [music] [music] >> [music] [music] >> Heat. Heat. [music] Heat. Heat. [music] [music] [music] Heat. [music] Heat.

03:17 [music] >> [music] >> Hey, [music] hey, hey. [music] [music] Heat. Heat. [music] [music] >> [music] [music] >> Heat. Heat. [music] Heat. Heat. [music] [music] [music] >> [music] >> Hey, we are back. >> Hello. Hello. >> Uh, ask us anything. I'm not prepared for this one in terms of equipment. So, if my audio is horrible, let me know. I don't know what I can do.

05:20 Probably nothing. Okay. Uh anyways, uh I'm here, Scott is here. We answer your questions and that's the only thing we do today. Uh let's go to the first one. Actually, donation 15 in currency. I don't know. But thank you so much. >> Shackles. That's Israeli shackle. >> The Israeli shackle. >> Yes. >> Okay. Israeli shackle. But it's written in Spanish.

05:48 Thank you for the program. I look I look forward to it every week. Thank you. Thank you. Thank you. Um okay. Uh next one. Honest compassion. I feel agents are making my programming much more effective but less fun. I used to enjoy the challenge of so solving complex challenges and writing neat code. AI stole it from me. I disagree with the part of that that sentence.

06:10 And so uh more effective? Yes. Less fun? Yes. depending on a person just to be clear. Uh so yeah if you have fun coding this is less could be less fun. Now the part I don't agree uh is uh used to enjoy challenge of solving complex challenges. I feel that AI allows us to do that more not less because and this is my theory correct me Scott if you disagree 95% and I'm throwing random number of code is not complex challenges >> right a very small percentage of the code are complex challenges and if I let AI do the majority

06:54 of the work that are not complex challenges that will free more of my time to work on those challenges right >> yeah So I I have a key like thing on this that I agree with you in general, Victor. I have a thing though like I still review the code that comes out of AI agents, you know, and all of that. But what exactly what I will say is I refuse to have I have zero code bases that are completely LLM generated.

07:28 every single codebase I make sure to at least do some of it with my own hands so that I stay proficient in writing so that I can guide it in the ways that I want. The things that I find interesting to do I still write myself like I I don't believe that we need to be the most efficient possible meaning that we should be using LLM to write 99.99999% of our code.

07:55 No, if you use AI to help you write 80% of your code, 90% of your code, 50% of your code, you're already so much more efficient and awesome. Spend the time doing what's interesting. Don't spend it writing while loops and for loops and if statements and different, you know, whatever permission checks in your front end and back end like write the interesting logic.

08:16 Right. Um >> I I feel that actually we are in agreement because the way I interpret what you just said is kind of basically you have now more time to write interesting stuff because you don't have to write uninteresting stuff. >> Exactly. And what what I'll do for like the interesting things I'll actually go back and fa forth in ask mode in cursor like a lot of times I'll go in back and forth and like just like you know go back and forth and ask like what do you think about this approach?

08:47 like would you go down this approach or this approach and like just use it as like a sounding board. Never have it create a plan for me. Never have it write the code for me. Use it as a sounding board. Come up with what I think based off of that is going to be the right way and then go and build it myself, the thing that I care about. Um >> yeah. >> Yeah.

09:09 At the end of the day, it's really about finding kind of like and that will depend from person to person and project to project. And by the way, Scott, uh earlier we spoke before this show how actually I let it rip all the way. That's for some projects, not all or something. Exactly. Just to be clear. >> Exactly. >> This is internal communication. But the point is that kind of whether it's 10% or 90% or 100% or 1%, you can delegate part of the work that you don't want to do or you don't think you should do to >>

09:45 Exactly. And by the way, there are things that LLM do better than 99.9% of developers in the world, which are a lot of those mundane things. The complex things, if you're a good developer, you will probably do a better job than the LLM if you're actually a very skilled developer um in a lot of cases. So great, do it. You'll come out with a better product.

10:11 We have this issue in a project and I don't know the project inside out every single line find the problem kind of that they're fantastic at that >> youact the solution >> it might present you with three of three or potential causes of the problem you might need to select I'm not saying fully kind of like >> right >> done >> but digesting data oh my god >> yeah it's amazing >> if I give you a new project you never saw before that you will find it as fast as LLM.

10:40 There is no way. >> No, no way. [snorts] >> Exactly. >> Okay, next one. Uh, hello Victor and Scott. This is my first time here. Uh, and I want to thank you for the opportunity. Oh, thank you. Thank you. Thank you. Uh, >> wonderful. >> Next one. If you should choose a Kubernetes flavor for production only to run a single big app only CD only one team and there's more on prem.

11:07 uh >> this is this is your domain Scott the only thing I will say before you give your answer >> unless it's uh unless it's for you learning stuff don't do kubernetes for a single app big up don't >> again depends on what you define by big app and >> if it's big app like kind of we have 100 replicas of this app yeah please do >> or you have 30 microservices as part of that app >> okay then in my head that's not a single app but okay [snorts] >> why if it's an application is this a lowerase A or uppercase A right

11:40 exactly without getting into right um so yeah I mean if Kubernetes is overkill then don't use Kubernetes but if we're talking about a use case where Kubernetes is the right solution here it comes down to a few different uh criteria that I'll give you of ways to think about this if you're running on VMware for example then use VKS because you get that out of the box with VMware, right?

12:10 So that solves your issue there. If you're running on Nanix, you have their solution uh which is whatever they bought D2IQ, I think it's called NKP now, use that, right? So if whatever if you're using a hypervisor, enterprise hypervisor and it comes with a Kubernetes distribution, use that just like if you're an AWS, use EKS, right? I think that's number one, especially for a small use case like this.

12:37 If you're talking about not a situation like that, you're running on bare metal or you're running on KVM or whatever it is that doesn't have. Um, that's where for something this small, I would probably say go with Talos. Um, if that suffices for you, I think the Talos is a good solution until it isn't. Um, but Talos overall is great. It's also relatively uh probably the most secure out of the box.

13:08 Um, and pretty easy to set up. So, I would go with Talos in a small situation like this unless again you have something from your infra provider at which point just use that. >> Okay, next one. Hi, Kafka. 100 million events per day plus couch base run on prem in cluster or buy sus for either of those and I will put a note to this question because um it wasn't stated let's say that money is not an issue because if money is an issue then the answer is very different right uh >> what would you choose and I will also say

13:48 that 100 mill events is not nothing but it's not massive >> uh >> correct >> kind And in general, I would I tend to choose SAS if the price is right. And this is not something that um and I'm not special in a way, right? If you say, hey, events in link uh LinkedIn kind of you're building your own system. You're probably not even using Kafka or you're building your own stuff, right?

14:20 [snorts] >> Yeah. I so in general I would say right I mean my general question on where to place something comes down to let's say you're talking Kafka here where are your producers and consumers if they're on prem >> oh yeah then >> run it on prem if they're in the cloud run it in the cloud um right like I always think about keep things as close as you can uh to the actual things that are communicating with it right um is a number one thing.

14:54 Um again the question of self I don't want to that's where I think on-prem versus you know cloud comes in. Now the question between cloud runin cluster versus SAS in the cloud comes down to a money right SAS is always going to be more expensive at one level but TCO can actually be lower in SAS if you don't have the expertise if you're a company that have a thousand Kafka clusters I promise you you have some Kafka experts in the company at which point maybe manage Kafka isn't worth it for you because you have the

15:37 expertise in house to actually go and manage Kafka. If you don't have that expertise, um you may be way better off just going with managed Kafka. >> If you have thousand CL Kafka clusters, uh you already made the considerable in uh onrem you already made a considerable investment which should be taken into the account, right? which is very different from uh starting today.

16:04 >> Exact. But I'm saying even forget a thousand or whatever, right? But if the idea is if you have the expertise in house, that's one thing. If you don't have the expertise in house, SAS is always going to be easier from that level. And while it's more expensive, the TCO sometimes the total cost of ownership can actually be lower going with SAS >> in certain cases.

16:26 >> Exactly. Uh, do you guys go with self-hosted rag pipeline solutions? Uh, I don't use them much anymore to be honest. Uh, so I'm I'm not sure. >> I I I barely use Rag. Um, and that's not that I don't believe there are use cases for Rag. Uh, just the areas that I'm dealing with are less in that area. But I I would prefer to use an MC. Let's say you're talking about documentation and let's say it's documentation in your company's Confluence.

16:57 I would rather use the Atlassian MCP to query and pull data from Confluence live than rely on some chunking strategy that was done in some pipeline that went and did you know whatever did embeddings of my data from Confluence into a database where now I also have to deal with one of the biggest issues in Rag is actually permissions, right? which chunks do I have permissions to that's based off of what I had to permissions to in Confluence and all that which is so much more difficult to do in there than it is to just

17:35 use an MCP and pull the data from a doc's site >> and the biggest I will disagree the biggest problem is not permissions the biggest problem is to distinguish u BS from from the data that actually really matter that's that's the biggest >> but that hold no but that's an issue whether you're going to rag or going to confluence and pulling data from the confluence API.

17:59 I'm saying the issue with rag itself, right? Not an issue that exists with data, >> right? Uh quality of data is an issue in both places. >> I mean, in a way, if you go to MCP to confluence, you're still doing rack. >> No. >> Right. >> Why? >> Yeah. Just uh you're not setting it up. >> Okay. You're not doing embeddings or anything, right? I mean, yeah, you're not doing it yourself, but the Confluence is kind of machinery is is the same essentially.

18:32 >> Yes. You're just pulling directly from the API which already has all the permissions >> for you. There is no rack. There is MCP for conference folks. There is ra behind it, right? >> Probably not that they have a magic formula that uh you don't you don't in a way. >> Yeah. >> Okay. What is your current advice right now for anyone wanting to be applied in dev sec ops platform engineering roles?

18:55 What should be doing right now to get hired? This certification becoming irrelevant. I will assume that this question means without free or practical experience just by the way it's formed. And then I would say that certification is relevant for two reasons. First, it's a good way to learn if if you do it right. If you if you don't go for the paper, but for the sake of learning, it's a good thing.

19:24 And uh if I have two people that have no experience and one has said certification, that person has an edge. It's not an edge that lasts long. It that's an edge that dies after you get the job. >> Correct. >> But for the first one, Yeah. >> Yeah. No, I don't think certification is irrelevant. Um, if you do it the right way. If you're doing certifications just to pass the test, just to put it on your CV, I'm against certifications, right?

19:56 >> Oh, yeah. Yeah. I mean, no, if if it's just for the sake of putting it in your CV and you're going to remove it after you land that first job, kind of like power to you kind of like, >> then fine. But >> uh, okay. And there is a followup and what can one do with this? uh and uh what can one do with this certification cad terapform etc etc do to get hired sorry for many questions uh not much you I mean it's really kind of >> apply apply apply apply apply >> but it's kind of basically uh there are two questions there

20:33 do you now know more about any of those things than you knew before certifications that kind experience and knowledge is the key. Uh and if you don't have practical knowledge in a real company, a real project kind of like that's the that's the third best. I would say second best would be if you can actually work in open source. Um >> yeah, exactly. Get the certifications and work on something relevant in you know open source projects.

21:03 Again, open source projects go to like Kubernetes like cluster API just as an example, right? um they are always looking for more people on the review team to go and you know go and help with reviews, go and help with uh you know triaging things in CI right to find uh flaky CI bugs all of that. Go spend your time whatever and you'll get experience that way with CI systems.

21:28 You'll get experience with Kubernetes. You'll get experience with local development. You'll get experience in the Kubernetes ecosystem. you'll meet people in these places that can maybe help you, right? Like again, you'll grow your network that way. That's the best way. It's go to the open source projects that are looking for people to help them. >> Um, you know, if if you if you don't have practical experience by working in a company, real projects, and you start getting involved in Kubernetes, you're working at the

21:57 right scale. Just to be clear, kind of like that's that's actually that's production. That's a real work. Exactly >> right. Not necessarily directly production but tests are actually testing Kubernetes project itself is more challenging than than many real projects in real companies. >> Yes, for sure. >> Okay. Explaining the fun part. I feel that the three days hard bug solving is is no longer justified justified.

22:29 used to take pleasure by this craziness. Yeah, I mean you know >> I agree it it's true. I mean it's true for some people uh you know we all take pleasures from different things. Um that's what >> you know >> but the reality is or or will be that yeah uh you take but the reality is that that's simply reality right that yeah you take pleasure I can take pleasure in debugging this thing for for three weeks but if I'm doing it for real business uh that does not fly right and expectations are different or will be soon.

23:17 >> Yeah, >> it's unfortunate, let's say, for our mental health. Um, what are the two or more best projects you recommend for DevOps covering all things you need for any kind of DevOps jobs? Uh, Linux kernel. [laughter] >> No. >> Can that be one? >> No. >> No. [laughter] >> What? Like >> kernel? No. Sorry. Sorry. Colonel. No. No. No. You're right. That's that's freaky.

23:45 That's >> I would say Kubernetes is one. >> Kubernetes is there and cloud >> from eligibility. I it depends whether the question is kind of like >> uh for your own advancements of your knowledge the cloud probably wouldn't be in that top two list but for eligibility kind of CV then yeah Kubernetes cloud. >> Yeah. [snorts] Okay, more. What does Kubernetes S agent uh what about Kubernetes SR agent for solving and troubleshooting Kubernetes error errors in production?

24:21 Do you uh there's probably more what's your thoughts on uh yeah production are uh I recommend to fix error modify or edit something by agent in your production Kubernetes environment. >> Never never the agent never touches your Kubernetes cluster. reads from it and it pushes to get the changes that get synced on by flux CD if you're smart or if you're less uh intelligent Argo CD.

24:50 Not that I have an opinion uh on that. Okay, but those are now details kind of let's say somehow agent might or might not lend it to production through whichever means githubs right it eventually lends to production right uh the way I see it is that uh the without doubt the strongest thing AI can do is analysis on potentially large amount of data that that's where it's probably the most helpful it can be right so that without doubt uh it recommends uh it makes sense if it's going to be to analyze it to say okay now

25:30 recommend the solution and then you take a look and say yes or no >> correct that's why >> and and if you say yes you can let agent do whatever needs to be done push to git or whatever that's fine >> which is why what I like to do is actually have the sur agent for example go plan, right? Understand what it is. If it reaches a certain level of confidence, create the PR with in the PR description, putting what brought it to that decision, the fact that it was triggered from the AI agent, what the context was, and all of

26:08 that. And then you don't need to do the back and forth in the agent. You're anyways in GitHub for reviewing PRs, all of that. have it create the PR there and then you can have the reason I like it doing everything through Git is that you already have probably pre-commit hooks and commit checks and all of that in PRs and you may even have automerging of certain PRs set up in GitHub and things like that based off of different criteria if tests pass things like that all of that is possible the second that it's being done

26:39 through Git um which is why I think Git is the right place for us to do that guarding from what AI does the actual apply um especially in the Kubernetes space >> also uh cloud code and I'm using it as example Scott you will tell me others um is got really really good with auto mode in terms that if you let it run in auto mode it will do the analysis let's say that's that's the scenario it will propose the solution it will not push it to git without your explicit um uh sorry it will push it to git as a PR as a branch

27:23 create a PR and it >> it will not merge it >> merge it without your explicit uh confirmation >> which is basically okay I did the work it's up to you to actually tell me whether this work is correct >> further on you can go and create some rules and say okay you know what I give you explicit permission to do it in advance if it's touching the namespace web because I could not care less about it, right?

27:51 You can then start playing with that and go with a slightly higher autonomy as long as you're careful. But it's it got pretty pretty good at stopping when actually it should stop. I'm not saying perfect, >> just to be clear. >> And probably the same with with others, right? >> Yeah. Um what is your drug of choice for setting up so that different customers get their own virtual semi virtual Kubernetes cluster let's say customers >> right no not >> I only know of one real solution in this and it's vcluster which is the

28:29 deacto standard for virtual clusters >> you stole it I was I'm kidding uh yeah vluster that's it I don't know whether there are some other items but kind of they almost seem like a >> but not really like what what >> v >> it's vcluster >> v cluster >> uh that was easy posgress operators are ready to uh are ready for 10 terabytes and 100k plus users database uh >> yes operator >> so so if your kubernetes cluster and your CSI and all of that are able to handle again what you're talking about There is a matter of IOPS and

29:13 a matter of the storage itself that's being attached. There is no difference between the Postgress binary running in cloudnative Postgress database versus Postgress running in a docker compose versus whatever it's around the operations elements of it. Now if the CSI driver you have in Kubernetes that is connected is capable of giving you the data plus the IOPS that you need plus the throughput all of that great so go ahead and use it wonderful there is no question on the scalability at this level again as long as you

29:48 can get a node that has the right size and the storage you're good >> I feel that the question is uh nonoperators are ready but are operators ready and if that's the question uh then the question is very wrong. It's what you said kind of operators are just uh operational level on top of it. Nothing to do with capacity. Nothing. >> Mhm. >> Okay. More what about the network overhead over CS CSI?

30:20 >> I'm guessing this is related to that first one. Again, it depends which CSI you're using. If you're going to use local storage CSI, uh no issues. If you're using the EBS CSI, that is no different than using an EBS volume on an EC2 instance if you're at AWS. Uh if you're running on vSphere, for example, um the vSphere CSI is no different than the VMDK that gets attached that way is the same thing as the VMDK that's attached to your VM.

30:49 Anyways, uh most solutions the CSI is going to be the same basic network configuration as you would anyways have on the same machine connecting if you're talking about using local storage, right? Uh which is how you would run it on a bare metal server, let's say, uh without centralized storage or all that. I'm not getting into NAS or SAN and whatever all of that connecting to a bare metal server.

31:14 If that's the situation, then use something like port works, which gives me local storage in Kubernetes in a resilient way that is good for Kubernetes and not just mounting a host path, which you can also do if you don't want resiliency. Um, so you know, I feel that those questions were much [snorts] more interesting in the past when in the past the discussion could go the way.

31:44 Yeah. because this driver for this thing is not implemented in Kubernetes just yet. So you simply cannot use you cannot use EBS right uh that was happening in the past right >> uh now now if any everything that you can imagine is in Kubernetes plus things that are not >> plus things you can't imagine they're also in Kubernetes >> exactly [laughter] now the danger there is that you can be running database in kubern Kubernetes cluster that that that that has other things which is a normal thing in a cluster and uh for

32:26 the sake of needs of those other things you might have penalty right you might have esto enabled that does this and that right for everything in the cluster and then you put the database and say oh performance is worse right but that's that's logistic problem not [snorts] a capability problem. >> Yeah. >> Uh okay. Uh where are you living in in the past on >> on prem on prem?

32:58 >> We're living in the past on prem because not EBS and all of that in the cloud. The I do okay I have to say working on prem is not living in the past. Okay. Onrem is a valid thing today. Just like cloud is a valid thing today. There are clouds that I won't mention by name so to not anger people. There are clouds that are living in the past. There are on-prem environments that are living in the future.

33:26 Okay, there is the it is not a question of on-prem versus running in a hosted environment. It is a question of how it is a cloud operating model and if you implement a cloud operating model on prem then you're good. Yes and no. So you're absolutely right in theory in practice I would bet that statistically there are more on prems living in the past than clouds.

34:01 uh statistically >> right >> correct but onrem does not mean the past the fact that those companies are if they if they move to the cloud and I can tell you a lot of them that like I've dealt with that whatever that have done you know the lift and shift to the cloud type things they're living in the past on AWS right I can tell you huge companies that are living in the past on AWS >> oh yeah oh yeah >> right >> they're just there's they're they're >> so on prem Onrem versus cloud is not the question of in the past or

34:33 not. There may be more onrem just because again those are typically on-prem customers are also older companies larger enterprises that changing things takes a longer time as well uh and is more challenging to make those major changes. A company that was built in the last 10 years um is going to be way more agile than a company that was built 50 years ago with data centers and a lot of legacy co code.

35:00 Um >> yeah the the typical problem with onrem the way I see it is that it it very often companies running onrem are not ready to let go. So kind of we invested in this thing. We are not switching to Kubernetes. Sometimes it doesn't make sense to switch to Kubernetes just to be clear but kind of because you know uh those servers need to pay themselves off off for 30 more years kind of things like that.

35:34 Uh that happens a lot kind of in in cloud you have advantage that uh you have access to to everything you should you you might need if your company happens to be oh if it worked for 30 years why wouldn't it work today [laughter] the type of situation >> right and that's where by the way I will say on this what like VMware are doing with VCF what nanix are doing with uh their nanix cloud platform and whatever.

36:06 Um, there's a reason that I recommend going with these types of vendors and not going with, you know, a bunch of just like, you know, do-it-yourself. Um, because if you went and bought VCF, right, VMware Cloud Foundation from VMware right now, >> you are going to get their new things every few months and they're going to bring you new features, right?

36:26 If you go with Nutanix, you're going to get new features. If you come and do a build-it-yourself peace meal of I'm going to build KVM as my hypervisor and I'm going to do this and this and this and then I'm going to bring this. You may be able to you can probably build something that is way more perfect for your use case doing that but you're going to be building a cloud.

36:46 Is that your goal to build a cloud or is your goal to enable a cloud experience on prem? If your goal is to enable a cloud experience on prem because regulatory whatever reasons you want to be on prem buy the cloud >> and you know uh the for your use case I agree but very often it's it's it's used wrongly it's kind of like oh we are special you're not special you're not special you're just think you're special and then you did this thing >> and you think that this thing makes you special >> and the industry moved

37:22 somewhere else already kind of the fact that you did uh something very similar to meos 20 years ago does not make you special it just makes you outdated right kind of uh there are very few Netflixes of the world to use an example >> exactly here read the next comment that he sent and you'll uh understand exactly fair enough >> exactly [laughter] okay >> you know the problem is there are two problems very often in companies.

37:54 First is that their workflows and politics and administrations are just so bad that prevent things from happening and second that it's for many companies it is very hard to attract the talent who knows what they're doing. >> Yes. >> Right. You have talent who know you every almost every company has a talent who know what they're doing but not in this century necessarily.

38:21 right? Kind of like you be you you have 30 exper years of experience in that company in DB2. You're really really good at DB2 >> but you're you don't know what you're doing in this century, right? >> And forget that. One of the biggest challenges that like I see today is like infrastructure is not going anywhere, right? Uh virtualization is not going anywhere.

38:46 All of these technologies are here to stay. They're in huge companies. All of that. The issue is it's not [clears throat] cool anymore, right? What used to be virtualization back in the day was like the cool thing, right? There were the oh, you're dealing with bare metal and that no, I'm dealing with, you know, softwaredefined data center. I'm, you know, building virtual machines and like the VI admins were like the cool people in the in the room.

39:10 And now it's DevOps isn't even cool anymore. It's now platform engineering and AI engineering, right? and harness engineering and all these things that whatever it's very hard to find really good talent in these areas because everyone is just following buzzes. So like all of these like really successful BI advoc are moving to DevOps and platform engineering and AI and all of this it becomes really challenging uh to maintain on-prem environments unfortunately in terms of getting the right you know skills um from the

39:42 team because it's a major challenge I think that you know the industry doesn't know yet how to deal with. >> Yep. Okay. Have you experimented with so-called second brain? A set of agents that you can feed ideas plans etc and it will sort store all that info. Would you use md files SQL DB or real DB? I don't know what is real DB to store relational. Okay.

40:14 Okay. Uh >> uh [snorts] as a second brain I use it all the time. The moment I have idea before it going to the moment I have idea I start talking about that idea with agent right whether it's wrong 5% of the time times or 100% that's that's separate conversation right kind of but I brainstorm with the agents all the time um and I let and I always record things and I use MD files for for for all all such things kind of like >> and I use and I use GitHub issues I have a repo that is just called random ideas and I just

40:55 talk to an agent. I have it go and shove that up as an issue into that repo and then if I need if I decide that something is going to actually happen all I do is I move that issue because you can move issues in GitHub from one repo to another. I move it to the other repo and start there. Um >> same thing except that I I I I use issues my issues are relatively short and kind of I I put everything in MD file and kind of issue more like for organization >> pointer or to that file >> then point to that file.

41:27 Yeah. >> Uh but the end result is the same. I just like files same thing at the end of the day right and then >> so that you can't read them because you're in a terminal and not an IDE where it would actually visualize normally markdown. Okay. Yeah. Great. [laughter] Not that I have opinions about >> terminals versus IDs. >> I don't know. Uh, exclamation mark code something.

41:54 No, open it for me. Works works marvelous. No worries about [laughter] that. >> It opens in VS Code for you. >> Uh, I don't know what I have right now. Probably VS Code. Yes. Yes. Yes. Kind of. I honestly don't know because I use it literally just to read files. Uh, no other feature kind of. It's better than notepad type of situation. >> Yeah. >> Um [snorts] >> uh last time I installed VS Code actually uh on a new machine the only plugin I installed is uh two plugins markdown and the one that highlights Fix Me and

42:26 To-Do uh entries. Those are my only two plugins right now. >> I will say by the way I will say just on that there is a better markdown plugin than the default one. Look for markdown for humans. Um, which is actually great because it gives you like a Microsoft Word like you can actually like edit in the preview. So like in the preview you can select, hey, make this into header three, make this into header two, create a table here, all of this stuff and it actually goes and like you have the two-way editing between the

42:55 actual markdown, add the visualization and like you can just add tables and it will actually format the markdown to look normal like a table. It will actually add the spaces so that the markdown table looks normal in markdown as well which is always a pain to write. Um but markdown for humans is amazing I will say. >> Oh check it out. Uh okay two more.

43:18 One uh Kubernetes security hardening plus cone mistakes day one and two manage remediated clusters best practices. Are you brave enough for prod and haha meos Diego was a struggle love the content. Um so first one Kubernetes security hardening plus common mistakes. Uh you want to give a shot? >> Sure. Kubernetes security hardening common mistakes. Number one is thinking that everything can run on complete lockdown clusters.

43:56 Uh people try and go way overboard in terms of security is a common mistake and think nothing could have basically drop every permission every capability drop all abilities of doing everything. That's one issue. On the other hand is not setting what user containers run as allow them to run as root and think oh the person that built the container probably did it right.

44:19 No, set the user run as user in your Kubernetes manifest so that things run correctly and that it's declarative and not just hoping that the person that wrote the Docker file wrote it correctly. Um, so I would say that's a major issue number two. Major issue number three is that people think that the only place that I need to check is at the ingress to the cluster.

44:41 So people will set up Kyivero, OPA, validating admission policies, whatever coming in to the cluster and don't remember that you actually need runtime protection um as well. Uh you need something always checking what's going on in the cluster, preferably ebpf based um in most cases. Um but you want runtime protection in your cluster as well. And you also want checks before it hits your API server using for example Kyerno CLI using the OPA CLI whatever and actually validating things before it's even applied to the

45:17 cluster because we want to shift that as far left as possible. Um have the admission but also have that continuous runtime verification. Um and the final [clears throat] one that I'll mention people thinking that I scan my image when I build it and that's good enough. Um, no, you need to scan your image all the time. Um, and even >> unless you're releasing frequently, >> unless you're releasing, if you're releasing daily or something like that weekly, it's fine.

45:44 >> Exactly. But one of the other issues that I see is that people think, oh, I scan my image, so I don't need to do, you know, like runtime checks or things like that. The answer is you're completely wrong because I can show you very easily. You can create a container image that on startup runs a bash script that downloads malware into the container after 30 seconds.

46:02 So like and then runs it. Um and welcome to the reality of >> scanning also gives you whether there are known vulnerabilities at the moment you scanned. >> Correct. >> Not known vulnerabilities at the moment you're running it any moment after after that. It's kind of um it's it's kind of false uh safety net kind of like you scan and there are no vulnerabilities.

46:33 No, no, no. There are no vulnerabilities we know of >> exactly >> right now. That's that's the point, right? Not that there isn't vulnerability. Yeah, we just don't know about it. >> Yeah, >> we might find >> again. And there's there's a lot of other mistakes, but I think those are I would say the, you know, key ones. >> One more. I must be the only person with write permissions to the cluster.

46:55 Everybody else gets read permissions and needs to push to git first thing. >> Yeah, there's all that's why is that a common mistake? Because you should not have write permissions to the cluster either. It should only be going through git for everyone. >> No, no, I I am special. >> No, you are. >> You deserve the right special. [laughter] >> You're not special.

47:19 >> Uh, okay. Got plate. Uh >> hold on. And I will just say on that that the H in Kubernetes does stand for happiness. Uh there is no happiness in the Kubernetes world. Security is not fun. [laughter] >> Um Orca, Falcon, Sync, uh Sink. I bet Snake. Uh do you have a preference? >> Uh out of those snake. >> Snake probably. Yeah, >> out of those >> same thing.

47:54 >> Uh, Sbomb or Kbomb? What's Kbomb? >> Kbomb is Kubernetes bomb. So, it basically goes and creates a bomb of your entire cluster. So, the configurations in your cluster, what's running plus can actually run uh scans on every container image and then go and basically create an entire espam of your Kubernetes cluster. Um, it's a very cool project. I like the idea of Kbomb.

48:19 Um, yes, I believe that ESBOMs, there is zero reason on planet Earth today that every container should not have an ESBOM, that every container should not be signed. Um, and that every container should not have an attestation to it. It is so easy to get all of those three things today. Even if you don't plan to use it today, kind of like it's free, you know, things that are free.

48:46 I mean free, relatively free. >> Exactly. >> Should not be avoided. It's similar kind of like zero reason not to use TLS. Give me a reason not to use it today. Unless you're onrem lockdown something something then you need a bit of work on node gardening for CRI escapes. no different than in the cloud to prevent against CRI escapes. Um it's the exact same thing.

49:19 It's the same Linux distribution running in both places. Uh use runtime protection. Use if you want to cause yourself a lot of pain, uh go with something like G Visor or Kata containers if you really hate yourself and want to suffer. Um otherwise continue using something like containerd and use a runtime protection tool that protects you and use policies to block things.

49:48 I have had fun with since March in K3s cluster. Keep up the great work Victor. Thank you. Thank you. Thank you. Uh if you have any issues or anything missing or whatever just you know you know what to do opening is okay we are 15 minutes before the deadline. I need to drop at the top of the hour precisely. Any other questions? No. Uh Scott can tell you why IDs are better than uh twe.

50:21 Uh I prefer IDs over tweies simply because it makes it much easier to review what is actually changing in the code, what it is actually doing. reviewing things is so much easier in an IDE because ids are meant for reading things to are not terminals are not. Um I happen to like the elements that it also has where like ids have built-in browsers uh within the ID itself uh for like opening up local dev servers alongside the code alongside the agent.

50:56 I like having it in that single window. Um, one of the challenges that I have is that when you start working on multiple projects in parallel and multiple agents, um, even tools like what you built, Victor, which are really awesome for managing multiple terminal agents, if you're building things that have to do with front end as well, it's a huge nightmare because okay, which port was this agent running on that which browser window is that is the front end for which agent running in and how right and how are all these

51:26 things connected is a major nightmare when you have the IDE or forget IDE. It can be an IDE or a tool like T3 code for example or the codeex app um or even like the cloud desktop app with the code section there. Not code work and all that but like the actual cloud code in there where you actually have a UI application that can open up within it sub windows of a web browser of a whatever.

51:54 I happen to do a lot of work that deals with front end as well. Um, so it's really critical for me to have something like that because otherwise you just get lost all over the place between Windows and no way to really group them together. Um, and that's why I prefer IDEs all the time. I also, as mentioned earlier, I like writing some of the code. So, I like that back and forth and I like having it in the same place and not needing to um switch between them.

52:26 Now, that doesn't mean you shouldn't use cloud code. Use cloud code as a plug-in in cursor, VS Code, Intelligj, whatever, right? That you don't need to use the IDE's native one. Intelligj have theirs, right? Uh you have cursor has theirs, VS Code have copilot. You don't need to use those. You can use claude in any of those cla code. I just don't believe in using it as a tuy.

52:52 Rather, I prefer it in an ID. >> Yeah, actually I to be honest, I combine both. Uh I I I I believe that it depends uh greatly on the level of autonomy you will decide to apply in certain scenario. And then comes the question kind of like whether you and in those cases I think that twisties are better for bigger autonomy uh and ids are better for less autonomy.

53:25 Uh and then the question becomes kind of you probably don't want to combine both uh at the same time and then kind of like which one works for you better. Like I I I keep VS code open. I I use two exclusively for agents. Right. >> Right. But I keep VS Code open, right? It's kind of opposite of what you do. Probably you use probably sometimes VS Code even though TUI would be a better fit for that specific thing kind of like you just need to do things, right?

53:52 But it's already there in your in your ID. So kind of like why not? And in my case is the other way around kind of like okay I have VS Code on a site. >> Right. Exactly. And again I don't think there's necessarily a right answer in this area. I think it's what you prefer um is what you should use. And the nice thing is Copilot and uh Cursor both have two E and CLIs that you can use and cursor has a plugin for an I and Claude has a plugin in the IDE that you can use, right?

54:29 So you you're not actually locked into TUI versus guey no matter which major agent you're using. >> Uh except unless something drastically change except Copilot. I still cannot stand it for the love of God. I can stand it. Um I have a fazillion probably questions but I let the show roll. Thanks for all uh where you guard griefing regulated on prem cemetery.

55:03 [snorts] Um what else? Hello scope. Let uh let's remove backstage at play tikka. I don't know what is play tikka dude. >> Play tikka. One of the biggest gaming companies in the world. Uh no we will not be removing backstage. Long all hell backstage. Long live backstage. I am a huge fan of backstage and backstage is going through awesome changes now.

55:26 Uh and uh good to see you sir. >> One change that needs to happen in backstage is that it needs to hurt my eyes less. Please please please. >> It's gotten much better. You haven't looked at it in so long. >> I haven't seen it in like half a year or something like that. Okay. >> Yeah. You haven't seen the new buoy stuff that's actually getting a lot better with basketball.

55:47 >> I have the same complaint to back in Jenkins back. >> You still have the same complaint to Jenkins because Jenkins UI is still from the 1940s. [laughter] Okay. I'm sorry. There were attempts actually uh they made uh Jenkeis look really good but then kind of uh that ended up being two out of infinite number of jankies pages. [laughter] >> And everything else looks still horrifying.

56:20 >> Actually actually looks worse when they improved UX because you go to the homepage and say, "Oh, this looks cool. I like this." and then you click a link and then you shut [laughter] that kind of at least consistently bad UX is better if you ask me that kind of listen at least though like [clears throat] >> at least when you were like dealing with Jenkins though it's like I expect a bad UX for like such a gnarly tool like Backstage is so great it like they didn't match up like the UX versus like the actual product

56:53 like the capabilities were far way in Jenkins. The horrible UX went along with the horrible product at the same level. >> No, at at the time it was the one of the best products that >> wonderful. It was also a legitimate UI back in the 1960s when that was the level of UX that you had. I'm saying go to the 1990s to the 2000s when we're actually dealing with like legitimate UIs where you have good frameworks, we have good UIs, and Jenkins is already way outdated.

57:23 Um [laughter] like they were both just shot down together. Um but >> listen main frame still exist. So will Jenkins >> you know lesson learned here is that uh probably maybe does not apply today anymore but kind of when you start a new project that has UI and you are not a UI person find somebody who is >> or find an AI that is find [laughter] a skill that is >> that's until now kind of now exactly let it design 50 different variations and and don't pick any of them ask your friends to pick one of them >> exactly

58:03 [laughter] Because if you could have picked the right one, you would have done it without AI. >> Correct. [laughter] [clears throat] >> Uh, no more questions and we are almost out of time. So, I'm going to call it a quit here and see you all next week. >> Cheers everyone. >> Cheers.