1
00:00:00,000 --> 00:00:05,520
well this week we don't really have uh news to go over uh instead i'm gonna uh you'll you'll hear

2
00:00:05,520 --> 00:00:13,540
an interview from uh duffy at at covalent and uh he's gonna go over uh some ebpf stuff from

3
00:00:13,540 --> 00:00:22,660
explore us 2022 wait what year has this been 2022 it is 22 i'm really excited by the ebpf stuff

4
00:00:22,660 --> 00:00:28,580
uh i i started to read about it recently and it's really oh we'll have to we'll have to have

5
00:00:28,580 --> 00:00:33,360
an episode where you kind of explain what the deal with that is and maybe you can do a youtube short

6
00:00:33,360 --> 00:00:40,460
where you explain it all like ebpf in 60 seconds that that would be fun i would love to know enough

7
00:00:40,460 --> 00:00:46,140
to be able to record that video i don't yet but uh but yeah it looks fascinating so i thought what we

8
00:00:46,140 --> 00:00:51,000
would do uh right before uh i play that interview which will be coming up uh and it's an interview

9
00:00:51,000 --> 00:00:56,520
again from explore 2022 that alex williams of the new stack and i did uh with with duffy after his talk

10
00:00:57,160 --> 00:01:01,540
i kind of vaguely remember it so it'll be fun to listen to it again but you know we have we have

11
00:01:01,540 --> 00:01:06,880
the the best conference for developers and uh platform engineer types and operators and also

12
00:01:06,880 --> 00:01:11,840
managers who are getting their organization better at software coming up december 6th to 8th in san

13
00:01:11,840 --> 00:01:17,820
francisco SpringOne and uh i thought uh ben and i would share one talk we're we're looking forward

14
00:01:17,820 --> 00:01:22,960
to there uh this this episode now if you're listening to that and you want to register you can get

15
00:01:22,960 --> 00:01:30,200
200 off with the code Coté 200 and you know ben you you pointed out uh yesterday when we were talking

16
00:01:30,200 --> 00:01:34,560
about this there's actually a track missing from SpringOne what what is that track i think this

17
00:01:34,560 --> 00:01:40,800
was a good insight there is i think every conference always has this missing track whenever you see the

18
00:01:40,800 --> 00:01:49,440
agenda there's a track missing the hallway track oh it's the track right it's the place where you can

19
00:01:49,440 --> 00:01:55,800
go to solve your problems whatever problem you have there's a hallway track for you and and i think i

20
00:01:55,800 --> 00:02:00,520
think that was a uh you know obviously that's being a little clever but that's that's fine that's good

21
00:02:00,520 --> 00:02:05,500
because it is i think especially you know after three or so years it's it's uh easy to forget that

22
00:02:05,500 --> 00:02:11,600
like a huge part of the value is uh not just seeing people and hanging out with them but getting the

23
00:02:11,600 --> 00:02:16,640
chance to actually ask questions and kind of like i don't know most people who are implementing this

24
00:02:16,640 --> 00:02:22,360
kind of stuff in the old uh the old application development and and cloud native and container

25
00:02:22,360 --> 00:02:27,120
stack and all this like there's a whole bunch of idiosyncratic weird stuff uh that they have to put

26
00:02:27,120 --> 00:02:32,360
up with and really having someone to discuss it with is uh is quite handy like one of my colleagues

27
00:02:32,360 --> 00:02:37,380
was reminding me not reminding me he was telling me back in uh at our last in-person conference

28
00:02:37,380 --> 00:02:43,760
or maybe the second to last i think 2019 was the last one right ben if i remember it might have even

29
00:02:43,760 --> 00:02:50,660
been in austin of all places you mean in person yeah yeah yeah yeah yeah yeah yeah austin definitely

30
00:02:50,660 --> 00:02:54,680
yeah and and there were there was uh you know there was there was i think it was a panel discussion

31
00:02:54,680 --> 00:03:00,260
or a keynote or a talk and like someone from cerner had been talking about how they had been using uh

32
00:03:00,260 --> 00:03:07,160
um you know uh spring and and uh uh i think at the time pivotal cloud foundry stuff and then someone

33
00:03:07,160 --> 00:03:11,660
from wells fargo was up there and then afterwards you know uh people were able to talk to those

34
00:03:11,660 --> 00:03:16,120
individuals about how they were securing things and uh setting them up and if you imagine that all over

35
00:03:16,120 --> 00:03:21,040
the conference especially when it comes to the the development topics since there'll be so much spring

36
00:03:21,040 --> 00:03:25,640
stuff there you really get the chance to just uh go talk with people and have the conversation

37
00:03:25,640 --> 00:03:31,780
you're having to uh solve things out and to that end the talk i wanted to highlight uh i was looking

38
00:03:31,780 --> 00:03:38,420
through the talks again this morning is we have one from uh joseph at the u.s army and it's basically

39
00:03:38,420 --> 00:03:43,980
an overview of how they've been um he doesn't actually say it in the abstract but for us industry insiders

40
00:03:43,980 --> 00:03:50,420
i'll use i'll use the the summary word how they're doing dev sec ops stuff how they're you know securing

41
00:03:50,420 --> 00:03:55,520
the software the code that they have the process of doing it and uh hopefully all the way up to like

42
00:03:55,520 --> 00:04:01,060
the the runtime environment they're using i think i forget you know i think the u.s army uses both

43
00:04:01,060 --> 00:04:08,580
the tanzu application service and uh kubernetes based stuff uh like a lot of people but it'll that'll be a good

44
00:04:08,580 --> 00:04:14,640
talk one to see how they're securing things because i figure you know uh if if the army's not doing some

45
00:04:14,640 --> 00:04:18,740
security thing it probably doesn't need to be done so whatever it is they're doing is probably the

46
00:04:18,740 --> 00:04:23,820
maximal amount of security you would ever care about uh and and so that'll be nice but then

47
00:04:23,820 --> 00:04:28,740
afterwards uh you know i don't want to put some some work on them but you know you could ask questions

48
00:04:28,740 --> 00:04:35,500
uh during the talk or maybe try to uh blockade speakers from leaving the room until the the kind av

49
00:04:35,500 --> 00:04:40,240
people are like oh we've got the next speaker coming up could y'all move it out into the hallway

50
00:04:40,240 --> 00:04:45,920
but it'll probably it'll be you know setting up your securing all this stuff is um there's all sorts

51
00:04:45,920 --> 00:04:52,420
of great standards and ways of doing it but as uh as oran who was a many many a couple of months ago

52
00:04:52,420 --> 00:04:57,660
uh talked about when he was on here like a lot of securing this stuff is the non-code stuff around

53
00:04:57,660 --> 00:05:02,780
policy and putting together your uh your CISO oriented stuff so that would be another the kind of

54
00:05:02,780 --> 00:05:07,660
conversation you could have with them and other people who are there uh so you can see the listing

55
00:05:07,660 --> 00:05:14,080
if you go to uh spring1.io and look for uh us army or joseph and i'll put a link to it in the show

56
00:05:14,080 --> 00:05:18,920
notes at tanzutalk.com but how about you ben what's what's one talk you think you're you're looking

57
00:05:18,920 --> 00:05:26,380
forward to that maybe crosses over into this missing track absolutely so uh oh apologies if you can hear

58
00:05:26,380 --> 00:05:33,420
that that's the sound of a platform being built exactly i'm having a platform built so apologies

59
00:05:33,420 --> 00:05:39,280
if you can hear that but uh yeah i i've picked out um one of my favorite people to listen to

60
00:05:39,280 --> 00:05:47,080
brian chang who is uh taking basically um a whole bunch of people and doing a panel you talked about

61
00:05:47,080 --> 00:05:54,820
panels just a second ago and sometimes i find a panel strangely comforting somehow there's lots of

62
00:05:54,820 --> 00:06:00,120
people to see there's folks to listen to and they've all got different perspectives on a particular

63
00:06:00,120 --> 00:06:08,280
problem so um brian's running running uh the tanzu vanguard panel and it's entitled priceless insights

64
00:06:08,280 --> 00:06:15,920
so uh reading reading a little bit from the description um it's basically the super user

65
00:06:15,920 --> 00:06:21,980
community for vmware tanzu coming together to talk about various different problems from different

66
00:06:21,980 --> 00:06:27,240
perspectives and the two perspectives that i'm pretty sure you're going to you're going to hear

67
00:06:27,240 --> 00:06:34,540
about from this particular talk one is the kind of deep dive into something technical what that could

68
00:06:34,540 --> 00:06:41,040
be could it's something that will be decided probably on the day but it'll be something deeply technical

69
00:06:41,040 --> 00:06:47,340
i'm sure and then at the same time you'll also have this kind of um management aspects of that you know

70
00:06:47,340 --> 00:06:53,920
how do we optimize our organization to realize this new thing whether it's devsec ops or whether it's

71
00:06:53,920 --> 00:06:59,200
you know platforms or whatever it might be so i'm really looking forward to that one because

72
00:06:59,200 --> 00:07:04,500
there's also an audience q a so it's built into the talk you know it's not sort of a couple of minutes

73
00:07:04,500 --> 00:07:11,040
at the end it's kind of we're definitely going to dig deep into the experience of all these folks on the

74
00:07:11,040 --> 00:07:16,600
stage and we've got some really really good folks on the stage as well i'll read the list we've got

75
00:07:16,600 --> 00:07:23,080
greg mayer who works for vmware i know i know greg and he does some great stuff for example with

76
00:07:23,080 --> 00:07:29,260
accelerators on the tanzu application platform and we've got jim cole from great american insurance

77
00:07:29,260 --> 00:07:36,320
we've got jim fox also from great american insurance and we've got kelly uh shaffler uh sorry shaffer

78
00:07:36,320 --> 00:07:44,280
also uh sorry from uh one magnify she's a senior it director so we've got a good mix of technologists

79
00:07:44,280 --> 00:07:51,440
and management type folks in there so i'm pretty sure you'll get um a varied and quite interesting

80
00:07:51,440 --> 00:07:55,760
talk as a result so i'm looking forward to that one priceless insights by the vanguards

81
00:07:55,760 --> 00:08:01,280
well i have to say you you picked as as we used to say before i was born a real humdinger there

82
00:08:01,280 --> 00:08:08,480
because i uh i also had that one on my list of of talks i was looking forward to and i think uh i

83
00:08:08,480 --> 00:08:14,920
think there's at least one person on that panel if not two who were we uh we had we had as as they

84
00:08:14,920 --> 00:08:20,580
say in the business a webinar or you could just call it an online talk we i i moderated a panel with

85
00:08:20,580 --> 00:08:26,360
uh several of the vanguard about uh like the use of metrics in in their organization you know doing

86
00:08:26,360 --> 00:08:31,820
software and it was it was great to talk with them and it was a good example of like of like the things

87
00:08:31,820 --> 00:08:37,340
you can do in person at a conference is uh you know when we were doing it online but you know when we

88
00:08:37,340 --> 00:08:42,000
were discussing it ahead of time and talking with each other there was we came up with uh you know

89
00:08:42,000 --> 00:08:47,040
new ideas and new things to talk about with relation to metrics and there was even a few

90
00:08:47,040 --> 00:08:51,660
sort of like oh i never thought about it that way and questions the panelists had on each other and

91
00:08:51,660 --> 00:08:57,100
how they were tracking things and fun fact uh that's when i was uh in the u.s last and i actually

92
00:08:57,100 --> 00:09:03,960
had that conversation in the middle of texas on i-35 uh in a starbucks parking lot because i needed to

93
00:09:03,960 --> 00:09:09,020
use the internet which was uh quite thankfully i had a nice car that i could sit in and do it and

94
00:09:09,020 --> 00:09:14,520
i went inside and i had some of those sous vide egg things uh the the mediterranean one i believe

95
00:09:14,520 --> 00:09:20,700
and did the internet that you were using also have a big key that was changed to like a lavatory seat

96
00:09:20,700 --> 00:09:27,400
exactly just like just like in that movie the jerk it was a a tire rim that it was uh it was secured

97
00:09:27,400 --> 00:09:35,080
to yep that's right but yeah that would be a good panel and to ben's point right like uh there there

98
00:09:35,080 --> 00:09:39,600
should be at least a third of it i would hope if not more well you can ask whatever you want uh whether

99
00:09:39,600 --> 00:09:45,460
it's off topic or not and have that conversation going well anyhow uh to check out those two talks

100
00:09:45,460 --> 00:09:50,140
and other ones obviously i'll put a link in the show notes to those exact panels at tonsutalk.com

101
00:09:50,140 --> 00:09:55,560
but you should go check out the rest of them if you go to spring1.io and you click on i think it's

102
00:09:55,560 --> 00:10:00,980
schedule and then you click on breakout sessions you can scroll through those and uh you know there's

103
00:10:00,980 --> 00:10:06,020
other stuff there as as ben has mentioned several times there's workshops all sorts of them uh

104
00:10:06,020 --> 00:10:09,560
mostly focused on programming but there's some operational ones and i just realized there's

105
00:10:09,560 --> 00:10:15,380
also a whole .net day a whole .net conference uh going on as well for those in the .net world

106
00:10:15,380 --> 00:10:23,020
um and if you register uh you can use the code cote200 to get $200 off uh which you know just think of

107
00:10:23,020 --> 00:10:29,300
how many hot dogs that would buy uh if if you're into that whether they're real meat beef pork whatever it

108
00:10:29,300 --> 00:10:35,100
may be that's a lot of hot dogs you could you could purchase which you know us at vmware are going to

109
00:10:35,100 --> 00:10:40,580
be lacking that amount of hot dogs because you'll have give you'll be getting a discount but we would

110
00:10:40,580 --> 00:10:46,560
like you to enjoy the hot dogs instead of us now this talk of hot dogs i can't help but think of

111
00:10:46,560 --> 00:10:54,180
everything everywhere all at once the new movie oh yeah where there's a complete parallel universe

112
00:10:54,180 --> 00:11:00,360
that's where everyone's fingers are hot dogs exactly you gotta see it it's crazy that's right it's it's

113
00:11:00,360 --> 00:11:05,840
sort of like the uh the cute and endearing rick and morty instead of being uh you know very nihilistic

114
00:11:05,840 --> 00:11:13,940
and and offensive uh indeed well on that note what what you'll hear next is uh from explore 2022

115
00:11:13,940 --> 00:11:20,200
uh so you know we had a we had a stage there and we had five people from i don't know i would say

116
00:11:20,200 --> 00:11:27,200
basically the like the like cloud container kubernetes ish software development startup world

117
00:11:27,200 --> 00:11:35,540
come out and uh we have one from uh uh we duffy from isovalent did a talk about ebpf about kind of

118
00:11:35,540 --> 00:11:42,660
um doing networking stuff as i'm always joking you know layer six and a half uh you know uh networking

119
00:11:42,660 --> 00:11:48,140
kind of at the service mesh type of layer uh and kind of how ebpf does that and obviously a little

120
00:11:48,140 --> 00:11:52,820
bit about isovalent if as i recall and then afterwards he came over and talked with alex

121
00:11:52,820 --> 00:11:59,840
williams uh and i and uh it was a fun interview of which i remember precious little so when i'm

122
00:11:59,840 --> 00:12:06,400
editing it in i'll have to uh see how great it was by listening to it uh and we'll be back next week

123
00:12:06,400 --> 00:12:13,460
uh with a little bit of news and and other stuff enjoy the interview so duffy cooley yes

124
00:12:13,460 --> 00:12:21,140
you know one of those one of the things you're talking about is the security issues that

125
00:12:21,140 --> 00:12:30,640
we see in networks yep is that an identity issue at heart and is that kind of what you're getting at

126
00:12:30,640 --> 00:12:34,940
it can be yeah i mean basically you know what we're this is actually one of those things that

127
00:12:34,940 --> 00:12:39,800
we learned from kind of from that nice era exercise or from open beast which are network

128
00:12:39,800 --> 00:12:45,420
virtualization in general right was that um you know in many of the in many of the things that

129
00:12:45,420 --> 00:12:49,560
we have invented before we've kind of re-implemented the network just as it was designed before

130
00:12:49,560 --> 00:12:55,220
without really bringing any other capability to it right and so when we were thinking about

131
00:12:55,220 --> 00:12:59,000
how you know the shape of cilium and like what we were trying to develop here we realized

132
00:12:59,000 --> 00:13:05,660
that we needed to actually support things like identity it as a base primitive in connectivity

133
00:13:05,660 --> 00:13:12,400
between things right we need that just to be in there from the beginning so with cilium whenever

134
00:13:12,400 --> 00:13:18,160
you actually associate an endpoint whether that's an application in kubernetes or some other application

135
00:13:18,160 --> 00:13:22,560
running analytics server somewhere we give it a unique identity and then you can write network policy

136
00:13:22,560 --> 00:13:31,500
that is like that that basically allows you to enforce that um network access by identity rather than by ip

137
00:13:31,500 --> 00:13:39,160
or by any of that but before i go any further i'm alex williams of the new stack duffy cooley of

138
00:13:39,160 --> 00:13:48,540
isovalent and my co-host host of the vmware tanzu podcast michael Coté plus he does a lot of other

139
00:13:48,540 --> 00:13:55,660
things but michael we were talking about security but we were also talking about why do we need this

140
00:13:55,660 --> 00:14:03,200
new kind of approach that's right yeah you know so i don't really know much about networking

141
00:14:03,200 --> 00:14:07,440
so so maybe you can help me out but it seems like and you were touching on this it seems like

142
00:14:07,440 --> 00:14:14,440
what i see from my perspective of ignorance in in you know the last 10 years of networking is like

143
00:14:14,440 --> 00:14:21,840
there's this tension between like static and dynamic and like those of us who live way up the stack

144
00:14:21,840 --> 00:14:26,720
are always like wanting to change things around all the time to be ephemeral as you were saying and

145
00:14:26,720 --> 00:14:32,600
it seems like as you go lower down the network stack they don't like that right and so like we sort

146
00:14:32,600 --> 00:14:37,240
of like i don't even know i mean i mean tell me what your perspective on this is but it seems like

147
00:14:37,240 --> 00:14:41,240
there's not really even a meeting in the middle it's like us on the top of the stack are sort of like

148
00:14:41,240 --> 00:14:45,940
all right well how about we put some new layers on there right and like it seems i don't know i mean

149
00:14:45,940 --> 00:14:53,840
that that tension seems weird is the wrong word but it's kind of like an oddity of like usual

150
00:14:53,840 --> 00:14:59,020
yeah yeah it's sort of like at some point and and i only mean this in like an exploratory best way but

151
00:14:59,020 --> 00:15:04,860
like shouldn't the network people figure that out or or like what where does like where do the

152
00:15:04,860 --> 00:15:08,100
cultures like differ and like why so many layers

153
00:15:08,100 --> 00:15:13,200
i mean there's there's quite a there's quite a lot of there's quite a lot quite a lot to chew on

154
00:15:13,200 --> 00:15:18,280
there so i'm going to begin from the beginning i would say that like you know in my career i have

155
00:15:18,280 --> 00:15:24,020
actually i've worn many of those hats right i've worked as a network architect for dsl networks

156
00:15:24,020 --> 00:15:28,840
across the country and i've worked all the way up into you know basically reinventing networking and

157
00:15:28,840 --> 00:15:32,400
network virtualization and now i'm kind of working on a networking solution that really

158
00:15:32,400 --> 00:15:37,020
implements itself with the application layer i would say that for the most part what i've seen

159
00:15:37,020 --> 00:15:44,600
uh over time is that a lot of network architectures are now kind of moving toward a place where they

160
00:15:44,600 --> 00:15:50,740
are considered plumbing and you have to think about that plumbing as highly available can handle all

161
00:15:50,740 --> 00:15:55,260
the water or whatever else is passing through right you know that that is the biggest part of your

162
00:15:55,260 --> 00:16:00,540
challenge right and where you're hooking that plumbing up are servers at this point right and that's kind

163
00:16:00,540 --> 00:16:07,160
of like that has become the way that we think about that underlying network for the most part

164
00:16:07,160 --> 00:16:14,160
yeah um and now but that that doesn't really but that introduces a new set of problems right so now that we've got this plumbing

165
00:16:14,160 --> 00:16:19,160
thing worked out we're really good that we've come up with clause networks we've come up with all kinds of great ways to

166
00:16:19,160 --> 00:16:29,160
handle moving all of these bits back and forth how can we you know revisit or improve the security model of those applications that are consumers of that network

167
00:16:29,160 --> 00:16:35,780
yeah now for the most part i would say that this is where that division comes in this is what

168
00:16:35,780 --> 00:16:40,400
what i mean by that things have changed a bit right a lot of network architects are just focused on the plumbing problem

169
00:16:40,400 --> 00:16:46,400
anymore and the application and the developers and the platform security folks and those folks are now

170
00:16:46,400 --> 00:16:53,400
suddenly on the hook for solving that security problem right they've they've kind of like that by they i mean the networking

171
00:16:53,400 --> 00:17:00,020
people have pushed responsibility upward and in in some actually kind of awesome sleight of hand

172
00:17:00,020 --> 00:17:05,760
right like it because usually like you know again i have an application development background right and you're always

173
00:17:05,760 --> 00:17:09,640
it's not exactly how you put it but you're always trying to be ignorant of what's below you

174
00:17:09,640 --> 00:17:14,480
yeah right and you want and this is almost like a reversal of that flow of like hey how about you're very

175
00:17:14,480 --> 00:17:19,780
knowledgeable of like the layer right right below you exactly and now but what's interesting now with

176
00:17:19,780 --> 00:17:24,380
like different orchestration systems like kubernetes and and and others that are out there

177
00:17:24,380 --> 00:17:30,160
what we've seen is that like we're you know the platform folks and people who are writing software

178
00:17:30,160 --> 00:17:35,140
for the platform folks are are thinking about how can we make it so that people who are in the

179
00:17:35,140 --> 00:17:41,180
application business can just tell us what should be okay what should be allowed or not allowed right

180
00:17:41,180 --> 00:17:46,320
because at the end of the day you know as an application developer which services your application

181
00:17:46,320 --> 00:17:52,940
should be talking to right right and me as a networking guy i i don't care right like i just want to know

182
00:17:52,940 --> 00:17:57,840
i just want to know like what you should be doing so that i can put some reasonable card laurels around

183
00:17:57,840 --> 00:18:02,200
that so right right you you want you want the people as a network person up the stack to specify

184
00:18:02,200 --> 00:18:07,940
what they need i mean when i hear myself saying that it sounds ridiculously obvious but as opposed to

185
00:18:07,940 --> 00:18:13,840
giving you proactively being in charge of of all the intricacy of the networking stuff that happens

186
00:18:13,840 --> 00:18:19,140
as as you're saying is something as complicated as an app running in kubernetes right because there's a lot

187
00:18:19,140 --> 00:18:24,040
going on there one of the other shifts in paradigm in this particular case that has always really blew

188
00:18:24,040 --> 00:18:29,140
my mind is that you know from a traditional networking background you spend a lot of your time

189
00:18:29,140 --> 00:18:35,060
defining you spend a lot of your time like looking for primitives that you can use as identity so that

190
00:18:35,060 --> 00:18:41,480
you can write firewall policies that restrict access between things in multiple areas right yeah say i have

191
00:18:41,480 --> 00:18:45,620
databases over here and they have financial records and i have my applications over here and they have like

192
00:18:45,620 --> 00:18:49,940
access to that financial record information and i want to make sure that only those ones that are

193
00:18:49,940 --> 00:18:54,740
supposed to have access to that financial information have it sure so i need some form of identity again

194
00:18:54,740 --> 00:18:58,980
right i need to have i have some place to start and so traditionally what i've had to do was i'd say

195
00:18:59,940 --> 00:19:04,180
these applications are only going to have these ip addresses and then i can say these ip addresses have

196
00:19:04,180 --> 00:19:10,420
access to the database and woe be to anyone who figures out how to get an ip address into that subnet

197
00:19:10,420 --> 00:19:16,740
because they'll be able to get around it and do all that stuff what's changed though is that with a lot

198
00:19:16,740 --> 00:19:24,260
of these orchestration systems now what we're writing network policy is on is label sets so we label every

199
00:19:24,260 --> 00:19:29,140
endpoint you see this in right lumio you see this in kubernetes you see this in everything yeah right

200
00:19:29,140 --> 00:19:33,620
you just write you you label everything and then you say things with this label can talk to things

201
00:19:33,620 --> 00:19:40,340
with this label which as a networking guy was a huge paradigm shift right right it made this whole

202
00:19:40,340 --> 00:19:45,780
thing so much simpler than it ever had right because not only do you escape uh numbers as your primary

203
00:19:45,780 --> 00:19:51,540
currency but like you're saying you can start having groups of things that are labeled so i think it

204
00:19:51,540 --> 00:19:56,260
it gets back to identity yeah and again just the search for it and like how do we how do we make

205
00:19:56,260 --> 00:20:01,700
that identity either as atomic as it needs to be or at least in a way that we can you know enforce

206
00:20:01,700 --> 00:20:09,540
that that security there but can we back up a little bit because yeah why we why do we need all this new

207
00:20:09,540 --> 00:20:16,740
stuff oh yeah that was the question i was that was a question that michael was posing like like i was

208
00:20:16,740 --> 00:20:24,420
reading a story you have on the psyllium site about the history of networking essentially yeah and a lot

209
00:20:24,420 --> 00:20:31,700
of it gets down to the hardware versus the software story in many ways but but why what what what was

210
00:20:31,700 --> 00:20:39,940
what was happening of 10 15 years ago that put us on this path you know i i've i got to work at core

211
00:20:39,940 --> 00:20:46,420
os for about a year before it was acquired by red hat and one of my absolute favorite talks that um

212
00:20:46,420 --> 00:20:52,420
branded phillips who was our cto yeah i think he really raised the point that where things change

213
00:20:52,420 --> 00:20:58,580
in a really approachable way that really blew my mind he said every day you know another 20 000

214
00:20:58,580 --> 00:21:05,700
people are logging onto the internet for the first time yeah and worldwide at the time i think it was

215
00:21:05,700 --> 00:21:13,780
there were 20 000 individuals working in it to understand this problem ah we are significantly

216
00:21:13,780 --> 00:21:21,060
outmanned yeah like like we cannot possibly with the technology and the practices and the and the

217
00:21:21,060 --> 00:21:27,220
procedures and everything else that we had 15 years ago solve the problem of today let alone the

218
00:21:27,220 --> 00:21:33,300
problem of why why was that at capacity because there are more people consuming more services consuming

219
00:21:33,300 --> 00:21:37,380
the internet putting their photos up getting gmail getting all of these applications and what resulted

220
00:21:37,380 --> 00:21:42,020
from that on the back end as a result with more people and more people and more people so what

221
00:21:42,020 --> 00:21:47,300
resulted is basically a change in the way that we think about infrastructure now we you know

222
00:21:47,300 --> 00:21:51,460
at the time we were thinking you know what if you if you rack 20 servers and you have an application

223
00:21:51,460 --> 00:21:56,900
stack on each of those 20 servers that was enough but it was an overload issue yeah and so you

224
00:21:56,900 --> 00:22:02,820
couldn't add more servers yep because you couldn't have enough cable enough buildings yeah enough

225
00:22:02,820 --> 00:22:06,820
machines and this is where you end up with like containerization taking over right because we

226
00:22:06,820 --> 00:22:13,620
figured out a way to actually put hundreds of these applications onto a single server and we figured

227
00:22:13,620 --> 00:22:18,340
out a way to actually manage the life cycle of them so that you could change them very quickly without

228
00:22:18,340 --> 00:22:23,860
having to go through all of the time it would take to change that 20 application stack on 20 servers

229
00:22:23,860 --> 00:22:31,540
probably but now the the networking as i understand it for instance the ebpf is as much about the application the

230
00:22:31,540 --> 00:22:39,940
service maybe the load balancer uh the uh the security layer the firewall i mean you were talking about

231
00:22:39,940 --> 00:22:45,460
facebook for instance right you know how they how do they use it they uh they they leverage ebpf to

232
00:22:45,460 --> 00:22:51,220
actually handle what they call um i think it's called cantran or they it's their load balancing layer

233
00:22:51,220 --> 00:22:56,580
in front of all of the properties at facebook so if you have any service that is a part of a facebook page

234
00:22:56,580 --> 00:23:02,100
there will be a load balancer usually more than one between the the your phone and say that particular

235
00:23:02,100 --> 00:23:07,700
service and all of those load balancers are implemented in ebpf so is ebpf enough

236
00:23:09,140 --> 00:23:16,820
i think ebpf gives us quite a lot of capability to dig into this problem in a very material way right like

237
00:23:16,820 --> 00:23:23,700
and again it changes the way that our entry point is what isn't enough for sure is if we're only looking

238
00:23:23,700 --> 00:23:30,020
at packets as they enter the network or leave the network because like you know like i was saying

239
00:23:31,540 --> 00:23:35,780
if you look at like if you're looking at evaluating networking equipment today or firewalls or any of

240
00:23:35,780 --> 00:23:39,780
that stuff today right you you measure the capability of that piece of equipment

241
00:23:40,420 --> 00:23:45,940
in packets per second right this kind of speaks to that scale problem that we're talking about

242
00:23:46,500 --> 00:23:50,420
packets per second that's that's the way you measure it if it's a firewall or network switch or

243
00:23:50,420 --> 00:23:56,820
any of these things that's what you're looking at with uh ebpf we can actually make decisions about

244
00:23:56,820 --> 00:24:02,980
whether to allow or deny traffic drop packet i mean drop drop this traffic before it ever even moves up

245
00:24:02,980 --> 00:24:08,580
the stack and becomes a packet we can see that traffic and make this routing decisions about it

246
00:24:08,580 --> 00:24:15,860
before it even enters the network uh before it ever hits the wire or any of that stuff so really with

247
00:24:15,860 --> 00:24:23,700
ebpf it gives us the capability of actually moving so much closer to the source of this of this huge scale

248
00:24:23,700 --> 00:24:29,140
problems that we can really have a very significant effect in changing the way we think about the solution

249
00:24:32,660 --> 00:24:38,980
so you know in in the uh uh the kubernetes world there's this constant sort of consternation

250
00:24:38,980 --> 00:24:45,060
about like well developers should do this or they should not do this like you know get involved in

251
00:24:45,060 --> 00:24:50,260
things and i and like what's your thinking and experience in the excuse me in the networking space like

252
00:24:51,300 --> 00:24:57,460
is who does this right like like is it because obviously someone needs to come in everything

253
00:24:57,460 --> 00:25:02,420
you know what you're just describing there's decisions to make there and like even day-by-day

254
00:25:02,420 --> 00:25:10,420
interaction like is there is there now like container network admin like like what what kind of roles are

255
00:25:10,420 --> 00:25:16,180
filling that need because i assume that like if i really know how to like convert a screen into pdfs like

256
00:25:16,180 --> 00:25:22,180
i'm an application developer i'm probably not doing that unless i'm desperate but like like what is

257
00:25:22,180 --> 00:25:27,140
that role and and do people do it like you know i think it's i think it's uh i think it's developing

258
00:25:27,140 --> 00:25:31,460
like for for quite a while i would say it was the platform it was the platform team in general that

259
00:25:31,460 --> 00:25:36,660
was the network right now it's kind of moving into more like a sec a sec devops kind of role and

260
00:25:36,660 --> 00:25:42,020
and that sort of thing where you have the people who are responsible for enforcing kind of the security

261
00:25:42,020 --> 00:25:49,140
posture of the company working alongside development teams to help them understand what changes need

262
00:25:49,140 --> 00:25:53,780
what changes are needed and how to implement those things right and in some companies this is actually

263
00:25:53,780 --> 00:25:59,140
like a production engineering world right but it actually does move more toward like if you are going

264
00:25:59,140 --> 00:26:05,460
to be a consumer of this platform uh we still need to be able to protect and enforce a reasonable security

265
00:26:05,460 --> 00:26:10,900
posture for the company yeah so we need to basically ensure that you get those resources so that you can

266
00:26:10,900 --> 00:26:17,300
be a good consumer of that platform that you can accomplish your goals and still not like blow up the

267
00:26:17,300 --> 00:26:22,820
security posture of yeah right and so that's where i i feel like culturally it's changing right like

268
00:26:22,820 --> 00:26:27,700
traditionally it's it's been like platform uh it's been the platform team whoever gave you that account to

269
00:26:27,700 --> 00:26:33,620
that to that um to that system but now i feel like it's kind of moving more toward people solving this

270
00:26:33,620 --> 00:26:39,780
in a production a production management or production systems role where you have embedded people in

271
00:26:39,780 --> 00:26:45,780
different teams responsible for the outcome or the the usage of that platform right and they're

272
00:26:45,780 --> 00:26:51,060
responsible to ensure that they're communicating up like what right right and so i guess i mean i don't

273
00:26:51,060 --> 00:26:57,220
know i'm just making this up in my head but there's kind of like three three functions when it comes to

274
00:26:57,220 --> 00:27:02,180
like like networking as you're discussing in the kubernetes world and other things there's there's

275
00:27:02,180 --> 00:27:09,300
the function of just like uh your application being able to operate right like you know because basically

276
00:27:10,900 --> 00:27:14,740
i don't know with exceptions that are good or bad like if you're running an application in kubernetes

277
00:27:14,740 --> 00:27:19,380
it's a distributed application so you need a network just to like live and you don't want to think

278
00:27:19,380 --> 00:27:24,020
about it at all right right right where am i going to get this ip address no right and i i thought

279
00:27:24,020 --> 00:27:27,860
about the deployment that should be enough totally totally and then you had yeah exactly then you have

280
00:27:27,860 --> 00:27:33,460
the second concern that's sort of like more external facing like the performance of things like

281
00:27:33,460 --> 00:27:37,940
especially if it's higher scale where you need to add in more load balancers and interact with

282
00:27:38,500 --> 00:27:41,940
cdns and everything yeah but then the other thing that also seems like a

283
00:27:43,060 --> 00:27:49,220
new and interesting maybe exciting uh like thing is like you can do security better

284
00:27:49,220 --> 00:27:53,300
like you can do security i don't even i don't know it's another thing i don't know about but it seems

285
00:27:53,300 --> 00:28:00,820
like you're given more handholds you're given more opportunity to like do stuff uh which is nice to

286
00:28:00,820 --> 00:28:05,780
layer on top of everything else there yeah i mean something you'll hear a lot of times you know in

287
00:28:05,780 --> 00:28:11,460
this industry is a thing called micro segmentation right micro segmentation is the idea that we can

288
00:28:12,180 --> 00:28:18,020
either through the construct of identity or you know understanding how to actually get really atomic with network

289
00:28:18,020 --> 00:28:24,100
policies and those sorts of things be able to describe how to segment just some small port of an

290
00:28:24,100 --> 00:28:29,380
application from some other small part of an application right right rather than gross green

291
00:28:29,380 --> 00:28:34,180
controls are you allowed in the data center or are you not that's like a that's like an external

292
00:28:34,180 --> 00:28:39,700
firewall problem right we're really familiar with how to solve that problem yeah yeah but can application

293
00:28:39,700 --> 00:28:46,900
talk to application b application a talk to application b how do you solve that problem right your west east not

294
00:28:46,900 --> 00:28:53,380
yours but the west east metaphor yeah yeah you know yeah and that's where that's where things like

295
00:28:53,380 --> 00:28:59,140
leveraging upf to kind of implement this stuff they put us as close to that endpoint as it as we can get

296
00:28:59,140 --> 00:29:05,940
right we can dynamically change the network policy or the or or the um security posture of that

297
00:29:05,940 --> 00:29:11,060
application very quickly without having to without without having to go back and configure all these

298
00:29:11,060 --> 00:29:15,700
firewalls and all those other stuff that's the big payoff for this micro segmentation right right right

299
00:29:15,700 --> 00:29:20,420
is that if you can do it and you come come up with a reasonable way to implement it and you allow your

300
00:29:20,420 --> 00:29:25,460
developer to say for example to look at all the traffic that went by or was attempting to go by the last

301
00:29:25,460 --> 00:29:29,940
couple hours and just pick the things that are supposed to be allowed and write network policy this is a

302
00:29:29,940 --> 00:29:36,340
feature of the psyllium enterprise ui right if you if you enable that sort of self-service so that people can

303
00:29:36,340 --> 00:29:40,180
actually just do the easy thing click the thing and make it and make it so that this is now their network

304
00:29:40,180 --> 00:29:48,340
policy and then that goes through an approval process if needed um then you have a much like you have a

305
00:29:48,340 --> 00:29:54,420
much more secure posture because you're securing all the way to the application yeah rather than just to

306
00:29:54,420 --> 00:30:00,500
the very large data center right lateral movement as i think most folks know in security and security

307
00:30:00,500 --> 00:30:06,980
minded lateral movement is your biggest security risk once people get in that's a big problem but

308
00:30:06,980 --> 00:30:13,620
if they can get in and own everything else around them that's a whole different problem yeah yeah yeah

309
00:30:13,620 --> 00:30:21,620
yeah for sure yeah and and so so like i mean as a as a last thing um you know well let me preface

310
00:30:21,620 --> 00:30:25,860
this is by saying like to force yourself to answer the following question you know because the answer

311
00:30:25,860 --> 00:30:32,820
is always like you know it depends it's flow right like life everything is flow right like um like

312
00:30:34,020 --> 00:30:39,380
when it comes to this type of networking like what's your model for thinking about when we're done with

313
00:30:39,380 --> 00:30:44,660
it not done like we're not going to do it anymore but that like it's now mainstream right like you know

314
00:30:45,300 --> 00:30:50,260
dns is done right like there's we're not we're not like scrapping to have it be the way that we do

315
00:30:50,260 --> 00:30:54,660
anything so like like like when you think about it like how would we know if we're sort of like

316
00:30:55,460 --> 00:30:59,540
done scrapping for this this is an interesting one because i think that

317
00:31:01,380 --> 00:31:04,820
i think it comes down you know it's like i've actually so i've worked in kubernetes for quite a

318
00:31:04,820 --> 00:31:09,380
few years and that's the same question i think the answer is the same it's going to come down to like

319
00:31:09,380 --> 00:31:15,140
when it's boring like i was saying before you're not when you are interacting with a kubernetes api or

320
00:31:15,140 --> 00:31:19,380
your ci system or what have you when you're thinking about how you're deploying your applications you're

321
00:31:19,380 --> 00:31:24,980
not thinking about the network and that's fine right i don't want you to think about that right i want

322
00:31:24,980 --> 00:31:29,540
to enable you to think about the security of that network i want you to be i want to enable you to

323
00:31:29,540 --> 00:31:35,140
say my application over here is not talking to this other application and i want to know what's

324
00:31:35,140 --> 00:31:39,380
happening on the wire between them i want some observability capability that lets me see that

325
00:31:39,380 --> 00:31:43,860
right uh-huh i want to answer that question that these are all things i would consider check marks

326
00:31:43,860 --> 00:31:48,740
to tell me the things about right yeah right and and we've done that with psyllium right psyllium

327
00:31:48,740 --> 00:31:53,620
is an OS's project i feel like we've actually we're we're at the place now where psyllium is a stable

328
00:31:53,620 --> 00:31:59,380
solid option for pretty much any of these environments and i feel like it's in a better position to call

329
00:31:59,380 --> 00:32:04,420
itself done than a lot of the others that i've seen in space right right so where do you go from here then

330
00:32:05,140 --> 00:32:10,420
well we're going from here is i think you know within isovalent we we say sometimes that if

331
00:32:11,060 --> 00:32:16,100
there is a way to leverage ebpf in the stack that would give us some competitive advantage of this

332
00:32:16,100 --> 00:32:21,940
market and the answer is yes so if we look at tetragon for example one of the other security things we

333
00:32:21,940 --> 00:32:26,980
haven't talked about tetragon gives us the ability to actually what's happened to know what's happening

334
00:32:26,980 --> 00:32:33,380
again at that what is that then tetragon what is that it is the it is the ability to instrument what's

335
00:32:33,380 --> 00:32:38,980
happening at the application layer right so before i said you can see like traffic moving back and

336
00:32:38,980 --> 00:32:45,140
forth yeah with tetragon i can show you which process made the connect call i can tell you what

337
00:32:45,140 --> 00:32:50,740
its linux capabilities which are like the permission system in front of the linux kernel i can tell you

338
00:32:50,740 --> 00:32:58,020
what capabilities it has i can let you write application policy that allows organized access to specific

339
00:32:58,660 --> 00:33:04,980
things within your underlying file system right i can actually move you know to different places in

340
00:33:04,980 --> 00:33:10,260
the evpf stack and provide primitives that allow you to improve the security for all of that as well

341
00:33:11,220 --> 00:33:16,580
and that's what's next for us it's like that piece of it the service mesh piece of it i think you know

342
00:33:16,580 --> 00:33:23,060
that's that's where we're headed all right that was fun it's like every like i said i'm always pretty

343
00:33:23,060 --> 00:33:28,500
ignorant so every time i talk with a networking person i feel a little bit better yeah i got it

344
00:33:28,500 --> 00:33:33,380
that's right i got it for now a little bit more well tomorrow alex we have a whole lot of interviews

345
00:33:33,380 --> 00:33:38,180
yeah five or six of them so if anyone's watching in the live stream turn in tomorrow and thanks so much

346
00:33:38,180 --> 00:33:42,820
for uh coming up here it was it was fun to hear about it was uh you got a nice way of explaining stuff

347
00:33:42,820 --> 00:33:48,100
that's not uh thanks toffee too technical i appreciate it appreciate it i'll see you next time bye bye