Secure Software Delivery Within Untrusted Environments at Scale with EVE and K3s
summary
Case study shows a global automaker (70,000 locations in 150 countries) running tens of thousands of single‑node clusters managed centrally: images are seeded, devices call home to a controller, Terraform describes per‑dealer differences, and K3s runs workloads. Project EVE (LF Edge) supplies a controller, AB network configs, TPM‑backed measured boot and remote attestation that seal keys to boot measurements, plus object signing/encryption over TLS to survive corporate proxies, enabling secure firmware delivery at scale and zero‑touch onboarding into Rancher/open shift.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:12Edge computing landscape
- 2:14Scaling 10K remote clusters
- 3:40Software deployment challenges
- 6:55Legacy apps with containers
- 9:04Automotive Edge safety
- 10:51Dealer cluster orchestration
- 12:20Why a controller is essential for Edge scale
- 14:06Project EVE introduction
- 15:57Networking in untrusted Edge
- 17:00Secure A/B network config
- 18:25Eventual consistency for Edge APIs
- 19:29Security threat analysis
- 21:57Secure boot challenges
- 23:20EVE hardware security
- 24:02Measured Boot and attestation
- 25:26EVE with K8s controllers
- 26:28Zero-touch bootstrapping
- 27:52Hardware attestation
- 29:16AI workload patterns
- 29:37Edge infrastructure needs
- 30:41Uniform cluster config
- 31:21Managing 10K controllers
- 32:05Q&A: Mutual TLS limits
related talks
52mExtending Kubernetes to the Distributed Edge with EVE-OS
42mEVE: a Secure API for the Edge That Delights App Developers
21mLessons from the Field: Running Kubernetes at the Wellsite
15mBringing Cloud Agility to the IoT Edge
06mEdge Kubernetes in Action: From Connected Vessels to Industrial Au...
35mHow to enable enterprises for DevSecOps without fighting the silos
59mCloud Native Home Lab
15mFrom ESXi to Kubernetes: Modernizing 1,400 Edge Locations with Open Source