Jim Bugwadia, Nirmata | KubeCon + CloudNativeCon NA 2022

This is texturing TV. Hey everyone. We are back here live in Detroit for cloud nativecon.

Fubecon. It's a it's a lively crowd. You know, someone told me this about 7,000 people here live and maybe up to 7,000 people online, which is pretty cool.

Um, excuse me. I hope you've been enjoying our coverage all day. My next guest is our friend Jim bhagwatia.

Did I pronounce it? Yeah, Jim is I know it's Gymboree when I look at it on the day on the anyway James with your mother. Who's new model?

We're gonna tell you but one of the things I'll tell you is that no matter the people behind the caberno. Open source project and we're going to talk about that as well. Hey Jim, welcome, that's good.

Thank you Ellen. So let's talk about Jim first though. Okay.

Tell the people. Who are you? What do you do?

Yeah, absolutely. Would love to some Jim maguardia co-founder CEO Edna Mata and also within the community. I work in the policy working group contribute to the multitenancy working group and other security areas.

So like you mentioned we're all the nirmata is the creator of caverno is a policy engine design for kubernetes. So Saul's a lot of security and automation use cases in that. So there are a lot of security and automation use cases.

Yeah that demand attention in kubernetes. Obviously Jim let's let's go to carvano though. Yeah.

Gravano, um recently a new release came out, right? That's right. 8.

Yes. 8, let's talk about that history, right and and the relationship. I know neurology kind of.

You know started from a convertino, right? But let's you know, how did that all come about? Yeah.

Yes. So one of the things you know as we were working with large customers in the space and kind of looking at what they were struggling with most as they adopted containers and kubernetes what always came up was governance, right and we started digging into that and to say what does that mean? What are you trying to solve?

And if you the light bulb moment for us was if you kind of step back and look at kubernetes kubernetes is the first major platform designed for devsecops, you have developers. You have the operations teams. You have the security teams all trying to collaborate on kubernetes.

So what was missing there was policies as a digital contract something native to kubernetes that could bring these roles together and then providing the visibility and governance across different teams across different applications across the Enterprise. So that was the initial idea of the Genesis of the A 4K Evernote at that time in the community. There were other Alternatives like open policy agent sure.

But yeah and very popular and good tool. But what we saw there is there was a need for something very native to kubernetes because kubernetes, you know, it started with deploying containerized applications, but now as evolved into our it platform for pretty much everything including infrastructure other processes, which are being transformed. So for that bringing native policies to kubernetes allowing native tooling like gitops customized group coddle to be used was a game changer for Deaf secops teams and more importantly Governor doesn't require a programming language.

It's designed for Ops Team to use the same declarative resource configuration constructs, that could be needy's as with open API V3 schemas to be able to Define policies and get the policy reports and results as well. On Love It excellent. Thank you now.

Was there no matter before there was caberno? Yes, you're right. So a lot of projects, you know come first and then the company and actor right?

1 of governo in as in the module in their matter. So we focused initially on three things workload management cluster management policy management, like I was mentioning as we kind of looked at the customer Journey policy and governance. I mean a big game that strongest pillar and that's where Kevin out we made it.

It's open source project donated to cncf went from sandbox to incubation and about 15 months, which is pretty fast for you guys. It's very good and you need production customers are willing to interview and get results. We cross about 500 million image polls.

Wow. Yeah. So very excited to see the why did option in the community?

Absolutely. And then, you know nermata we evolved into governance as a governance platform for kubernetes users working with any other, you know solution for cluster operations and management. I love it.

All right. Let's really now just focus on news. 8 of cabrono?

Yeah, why should people what what gets you excited? Why should they be excited? Yes.

So one of the things few major features, which I'll cover but a basic, you know, almost a rewrite that we did is as we are seeing larger and larger clusters, we have customers deploying fifty thousand to a hundred thousand pods in their clusters. They are using policies and of course policies because they apply at the API level they you know, it impacts your cluster operations of there's any degradation in performance so for that we completely rewrote the event and Reporting subsystem. 8.

That's one reason to upgrade other features. We introduce is native support for part security admission. So there's a long history of part security policies and the evolution into Parts security standards and now Paul security admission and give Verno can you know take the Upstream kubernetes Library app?

That in a lot more flexible manner within you for your cluster. 8 and then also a team from IBM contributed yaml signing and verification for software Supply. That's your use cases.

Very nice. Yeah, so it's fantastic to see other vendors also now start. Well, that's the beauty of the cncf mod.

Absolutely right other vendors vendors can work together for the good of the community and that's a good thing man. Excellent. Excellent now, But the stuff going on with your mother too you let's talk about what's new at Nevada.

Yeah, so when their mother our focus is now continuous, you know governance as well as continuous compliance policies become the building block, right? That's the how nobody wakes up and says, I want more policies today, right? You're gonna want to solve a business problem.

Well anyone I know but good but so in most cases it's well, I need certain standard compliance. I have certain security needs. I want to make sure my whole ci/cd pipeline software delivery pipelines our secured.

Those are the issues the problems businesses are trying to solve and their matter has released. Now, we have compliance mappings available through nirmada policy manager, which allow you to map into these like this 853 or the NSA hardening guidelines or your custom standards. We're seeing a lot of large Enterprises right their own, you know policy standards enforce them.

Us all the Clusters in their Marta gives them scorecards compliance mappings collaboration tools results as that. We've also introduced a number of different adapters for kiberno. So kiverno because of its role as an admission controller has to make very fast policy decisions in seconds.

So for that we bring data into kaverno to be able to make enrich that and make the right decisions one example is now we can bring in data from eks configurations to be able to comply to CIS benchmarks, which allows certain policy decisions to happen in cluster. We're all so taking data out of kiborno and pushing it into external systems. So a list of integration continues growing like we support all major collaboration tools reporting tools to Sims for security to so on.

I love it. Love it. Now, of course we talked about all this we didn't tell them anywhere to go to find out get their hands on.

Yep. Check it out. Where did they go?

io is our open source, you know One Stop Shop for other be sure. That's kyv e r n o. Yep and IO kiverno means to govern in Greek and kubernetes is Greek.

So that was the fit. com for our commercial offerings and how we add value to kearno. Excellent, Jim best of luck with nirmana.

Thank you for bringing. Thank you. Very know.

Yeah, thank you for bringing us up to speed remember that's convert. io. io.

Okay, check them out. We're gonna take a break here in Detroit. We're gonna be back in a moment continuing our coverage here at kubecon.