What If... Kubernetes Core Pieces Could Be Extended with Pluggable WebAssembly Modules?
Talkat Cloud Native Wasm Day Europe 2022 · on Monday, 2022-05-16· at 13:30· Pavilion 3, Room F | Level 2 | Central Forum, Feria Valencia, Spain + Live Stream·
summary
Prototype patches the API server to run OCI-distributed WebAssembly admission policies inside the process, claiming predictable, builtin-like admission with lower latency and fewer network failures. Demo uses a patched k3s single-node with a feature gate in k3s to download two wasm policies (privileged and trusted-repos), rejects privileged pods only in default namespace, emits Kubernetes events on rejection, and includes a kubectl plugin to list rejections. Also shows a crew-wasm system for wasm kubectl plugins.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:24Kubernetes Extensions
- 1:54Dynamic Admission Controller
- 2:40Cuborden
- 4:11Policies
- 4:36Advantages
- 6:15User workloads
- 7:01What if
- 7:39Disclaimer
- 8:44Demo
- 11:49Logging
- 12:58Data Plane
- 13:31Emboy
- 15:05User Plane
- 15:43Crew
- 16:51Crew Demo
- 20:00Whats Nice About Wassi
related talks
26mWhat If... Kube-Apiserver Could be Extended Via WebAssembly?
41mLeveraging WebAssembly to Write Kubernetes Admission Policies
20mLeveraging WebAssembly to Write Kubernetes Admission Policies
41mKubernetes Policy As Code using WebAssembly
15mWriting Kubectl plugins using WebAssembly
50mWebAssembly: A Recovering Kubernetes Engineer's View of the Future
32mA Tale of Two Plugins: Safely Extending the Kubernetes Scheduler with WebAssembly
20mMaking Dynamic Admission Control Even More Dynamic Using...