+++
author = "AWS Kubernetes Developer Advocates"
categories = ["Archive", "2022", "Weekly"]
date = 2022-09-16T07:00:00Z
description = "#032 edition of the EKS newsletter"
draft = false
slug = "032"
title = "EKS News 032"
+++
<br/><br/><br/><br/>

## AWS Container Announcements

* [EKS Blueprints now supports local volume provisioner](https://github.com/aws-ia/terraform-aws-eks-blueprints/pull/928)
  * The local volume static provisioner manages PersistentVolume lifecycle for pre-allocated disks by detecting and creating PVs for each local disk on the host, and cleaning up the disks when released.

## AWS Container Blogs

* [Announcing AWS Observability Accelerator to configure comprehensive observability for Amazon EKS](https://aws.amazon.com/blogs/mt/announcing-aws-observability-accelerator-to-configure-comprehensive-observability-for-amazon-eks/)
  * Originially released in May, this update provides a one-click solution that deploys out-of-the-box Amazon Managed Grafana dashboards, AWS Distro for OpenTelemetry collector to collect metrics, store them on Amazon Managed Service for Prometheus and configure alerts and recording rules
  * AWS Observability Accelerator [GitHub repo](https://github.com/aws-observability/terraform-aws-observability-accelerator)
* [Implementing Zero-Trust Workload Security on Amazon EKS with Calico](https://aws.amazon.com/blogs/apn/implementing-zero-trust-workload-security-on-amazon-eks-with-calico/)
  * This blog dives into how you can apply zero-trust workload access controls along with microsegmentation for your workloads that run on Amazon EKS, and provides specific examples.

## Videos

* [Gateway API - Ingress and Service Mesh Spec Replacement?](https://www.youtube.com/watch?v=YAtXTI3NKtI)
* [ArgoCD: The first thing I deploy on Kubernetes](https://www.youtube.com/watch?v=GAu1INNeE7E)

## Ecosystem News

* [SBOM Facts: Know what's in your software to fend off supply chain attacks](https://develop.secure.software/sbom-facts-know-whats-in-software-fend-off-supply-chain-attacks)
  * SBOMs enable those who are dependent on software to understand what exactly is in the applications they’re using. This gives both software developers and users a better sense of the risks associated with their applications.
  * An SBOM is a list of third party software, open source software, statically linked packages, and other application dependencies.
  * A good SBOM will hold software development organizations accountable for tracking and documenting exactly how an application has been made. It should also include a risk analysis of each component so security teams scan understand how their software supply chain contributes to their applications’ risk profile.
* [Writing a Go service in Kubernetes](https://kubernetes7.medium.com/golang-microservice-writing-8c4158adcdba)
  * A brief tutorial showing how to create a simple web service using Go
  * Highly recommended: [Web Development with the Golang Programming Language with Todd McLeod](https://www.udemy.com/course/go-programming-language/)
* [Kubernetes Ephemeral Containers and kubectl debug Command](https://iximiuz.com/en/posts/kubernetes-ephemeral-containers/)
  * An article from May covering the use of ephemeral containers and kubectl debug. Ephemeral containers are useful for debugging containers that lack debugging tools, e.g. Distroless, and for diagnosing crash loops.
* [Securing Kubernetes cluster using Kubescape and kube-bench](https://www.cncf.io/blog/2022/09/09/securing-kubernetes-cluster-using-kubescape-and-kube-bench/)
  * Reviews 2 tools you can use to perform vulnerability assessment scans of your Kubernetes clusters: [kube-bench](https://github.com/aquasecurity/kube-bench) and [Kubescape](https://github.com/kubescape/kubescape)
  * kube-bench gives you very precise instructions regarding ownership and permissions for configuration files as well as for flags and arguments that are wrongly configured.
  * Kubescape uses the NSA/MITRE/ArmoBest/DevOpsBest guidelines to evaluate the cluster or pipeline being scanned.
* [Application Performance Monitoring vs. Application Performance Observability](https://scoutapm.com/blog/applicationperformancemonitoring-observability)
  * Traditional monitoring tools rarely include contextual information that would help you answer questions like "what changed" "why" "who's affected". Observability solutions are meant to answer questions like "show me all users that had response times over our SLA threshold at any time this month".
  * Implementing standards, cross language, and cross platform is a must for Observability in that you must be able to issue a query to answer your Observability questions across all languages you run in production, and know that the context is applied and located in the same place across your applications.
  * Observability needs to be baked into your own code and stack intentionally. OpenTelemetry is the new  ‘lingua franca’ for Observability, allowing the full stack to speak the same language, gather data in the same format, and ultimately transport that data for processing.
* [The Oberservability Newsletter, curated by Michael Hausenblas](https://o11y.news/2022-09-12/)
* [Official CVE Feed for Kubernetes](https://kubernetes.io/docs/reference/issues-security/official-cve-feed/)
  * A community maintained list of official CVEs announced by the Kubernetes Security Response Committee.
* [Introducing Ambient Mesh: Istio without Sidecars](https://istio.io/latest/blog/2022/introducing-ambient-mesh/)
  * A new Istio data plane mode that’s designed for simplified operations, broader application compatibility, and reduced infrastructure cost. Ambient mesh gives users the option to forgo sidecar proxies in favor of a mesh data plane that’s integrated into their infrastructure
* [Addressing Bandwidth Exhaustion with Cilium Bandwidth Manager](https://isovalent.com/blog/post/addressing-bandwidth-exhaustion-with-cilium-bandwidth-manager/)
  * Besides CPU and memory, it’s important to consider the impact bandwidth consumption can have on overall pod performance.
  * Cilium's Bandwidth Manager implements pod network rate-limiting by putting Earliest Departure Time (EDT) timestamps on each packet (depending on the policy and rate) and sending out packets based on the timestamp which peforms better (4x reduction of p99 latency) when compared with traditional queuing models.
* [HOL: eBPF - An Overview](https://cloudyuga.guru/hands_on_lab/ebpf-intro)
  * [BumbleBee](https://github.com/solo-io/bumblebee) helps to build, run and distribute eBPF programs using OCI images. It allows you to focus on writing eBPF code, while taking care of the user space components - automatically exposing your data as metrics or logs.
* [HOL: How does Kubernetes assign QoS class to pods through OOM score?](https://cloudyuga.guru/hands_on_lab/k8s-qos-oomkilled)
* [Protect the pipe! Secure CI/CD pipelines with a policy-based approach using Tekton and Kyverno Policies](https://nirmata.com/2022/08/25/protect-the-pipe-secure-ci-cd-pipelines-with-a-policy-based-approach-using-tekton-and-kyverno/)
  * CI/CD pipelines also have their own life cycle that includes stages like pipeline composition, configuration, invocation, execution, and completion. For comprehensive coverage, security controls need to be embedded and exercised across all these defined stages of the pipeline.
  * This blog illustrates how Kyverno can be be used to improve the overall security posture of our CI/CD pipelines, specifically Tekton piplines. For example, you can use Kyverno to require that all Tekton bundles must be signed using a trusted authority.
* [Automate All the Boring Kubernetes Operations with Python](https://martinheinz.dev/blog/73)
  * Includes sample code for scaling a deployment, execing into a pod, tainting a node, monitoring cluster resource utilization, and exporting and backing up k8s objects
* [On Amazon EKS and Fault Injection Service](https://medium.com/@micheldirk/on-amazon-eks-and-fis-fd131b6284f1)
  * This blog explores the possibilities of using AWS FIS to consolidate and coordinate experimentation across different layers of the stack and shows how you can streamline experimentation with AWS FIS across AWS Services and cloud-native chaos engineering projects.
* [Troubleshooting namespaces stuck in a terminating state](https://medium.com/dev-genius/k8s-troubleshooting-namespace-stuck-in-terminating-state-b91ab6fa8948)
* [Remote debugging of Java apps in Kubernetes](https://medium.com/devlix-blog/remote-debugging-of-java-apps-in-kubernetes-ddc130840655)

## GitHub Projects

* [KWOK](https://github.com/kubernetes-sigs/kwok)
  * Simulate thousands of Kubelets on a laptop with KWOK
* [kube-shell](https://github.com/cloudnativelabs/kube-shell)
  * Similar to the [aws-shell](https://github.com/awslabs/aws-shell) but for kubectl
* [kube-router](https://github.com/cloudnativelabs/kube-router)
  * Kube-router provides a cohesive yet lean and powerful alternative to several network components you would use with Kubernetes
  * [Documentation](https://www.kube-router.io/docs/)

## For Fun

* [An illustrated childrens guide to Kubernetes](https://speakerdeck.com/chrisshort/the-illustrated-childrens-guide-to-kubernetes)
  * For those who have had trouble explaining Kubernetes to their kids/wife/family
* [Playing Doom on Kubernetes | Kill Kubernetes Pods](https://www.youtube.com/watch?v=NGQhcJMSYDM)
  * A fun way to practice chaos engineering
* [Use Draw.io from within VSCode](https://marketplace.visualstudio.com/items?itemName=hediet.vscode-drawio)
{{< eo >}}