Scaling Kubernetes deployments with Policy-Based Networking

Editor’s note: Today’s post is by Harmeet Sahni, Director of Product Management, at Nuage Networks, writing about their contributions to Kubernetes and insights on policy-based networking.  Although it’s just been eighteen-months since Kubernetes 1.0 was released, we’ve seen Kubernetes emerge as the leading container orchestration platform for deploying distributed applications. One of the biggest reasons for this is the vibrant open source community that has developed around it. The large number of Kubernetes contributors come from diverse backgrounds means we, and the community of users, are assured that we are investing in an open platform. Companies like Google (Container Engine), Red Hat (OpenShift), and CoreOS (Tectonic) are developing their own commercial offerings based on Kubernetes. This is a good thing since it will lead to more standardization and offer choice to the users. Networking requirements for Kubernetes applicationsFor companies deploying applications on Kubernetes, one of biggest questions is how to deploy and orchestrate containers at scale. They’re aware that the underlying infrastructure, including networking and storage, needs to support distributed applications. Software-defined networking (SDN) is a great fit for such applications because the flexibility and agility of the networking infrastructure can match that of the applications themselves. The networking requirements of such applications include:Network automation Distributed load balancing and service discoveryDistributed security with fine-grained policiesQoS PoliciesScalable Real-time MonitoringHybrid application environments with Services spread across Containers, VMs and Bare Metal ServersService Insertion (e.g. firewalls)Support for Private and Public Cloud deploymentsKubernetes NetworkingKubernetes provides a core set of platform services exposed through APIs. The platform can be extended in several ways through the extensions API, plugins and labels. This has allowed a wide variety integrations and tools to be developed for Kubernetes. Kubernetes recognizes that the network in each deployment is going to be unique. Instead of trying to make the core system try to handle all those use cases, Kubernetes chose to make the network pluggable.With Nuage Networks we provide a scalable policy-based SDN platform. The platform is managed by a Network Policy Engine that abstracts away the complexity associated with configuring the system. There is a separate SDN Controller that comes with a very rich routing feature set and is designed to scale horizontally. Nuage uses the open source Open vSwitch (OVS) for the data plane with some enhancements in the OVS user space. Just like Kubernetes, Nuage has embraced openness as a core tenet for its platform. Nuage provides open APIs that allow users to orchestrate their networks and integrate network services such as firewalls, load balancers, IPAM tools etc. Nuage is supported in a wide variety of cloud platforms like OpenStack and VMware as well as container platforms like Kubernetes and others.The Nuage platform implements a Kubernetes network plugin that creates VXLAN overlays to provide seamless policy-based networking between Kubernetes Pods and non-Kubernetes environments (VMs and bare metal servers). Each Pod is given an IP address from a network that belongs to a Namespace and is not tied to the Kubernetes node.As cloud applications are built using microservices, the ability to control traffic among these microservices is a fundamental requirement. It is important to point out that these network policies also need to control traffic that is going to/coming from external networks and services. Nuage’s policy abstraction model makes it easy to declare fine-grained ingress/egress policies for applications. Kubernetes has a beta Network Policy API implemented using the Kubernetes Extensions API. Nuage implements this Network Policy API to address a wide variety of policy use cases such as:Kubernetes Namespace isolationInter-Namespace policiesPolicies between groups of Pods (Policy Groups) for Pods in same or different NamespacesPolicies between Kubernetes Pods/Namespaces and external Networks/ServicesA key question for users to consider is the scalability of the policy implementation. Some networking setups require creating access control list (ACL) entries telling Pods how they can interact with one another. In most cases, this eventually leads to an n-squared pileup of ACL entries. The Nuage platform avoids this problem and can quickly assign a policy that applies to a whole group of Pods. The Nuage platform implements these policies using a fully distributed stateful firewall based on OVS.Being able to monitor the traffic flowing between Kubernetes Pods is very useful to both development and operations teams. The Nuage platform’s real-time analytics engine enables visibility and security monitoring for Kubernetes applications. Users can get a visual representation of the traffic flows between groups of Pods, making it easy to see how the network policies are taking effect. Users can also get a rich set of traffic and policy statistics. Further, users can set alerts to be triggered based on policy event thresholds.ConclusionEven though we started working on our integration with Kubernetes over a year ago, it feels we are just getting started. We have always felt that this is a truly open community and we want to be an integral part of it. You can find out more about our Kubernetes integration on our GitHub page.–Harmeet Sahni, Director of Product Management, Nuage Networks
Quelle: kubernetes

Amazon AppStream 2.0 Image Builder is now available

Amazon AppStream 2.0 is a fully managed, secure application streaming service that allows you to stream your desktop applications from AWS to any device running a web browser, without rewriting them. Available today, Image Builder makes it easy to import your applications to AppStream 2.0 so that you can publish them for users to access. You can import, install, and test your applications on an image builder instance, and then create images that are used on your streaming instances. You can add any application that installs and executes on the Microsoft Windows Server 2012 R2 operating system, without any modification or customization.
Quelle: aws.amazon.com

Solution guide: Creating self-service IT environments with CloudBolt

By Peter-Mark Verwoerd, Cloud Solutions Architect

IT organizations want to realize the cost and speed benefits of cloud, but can’t afford to throw away years of investment in tools, talent and governance processes they’ve built on-prem. Hybrid models of application management have emerged as a way to get the best of both worlds.

Development and test (dev/test) environments help teams create different environments to support the development, testing, staging and production of enterprise applications. Working with CloudBolt Software, we’ve prepared a full tutorial guide that describes how to quickly provision these environments in a self-service capacity, while maintaining full control over governance and policies required by enterprise IT.

CloudBolt isn’t just limited to dev/test workloads, but anything your team runs on VMs. As a cloud management platform that integrates your on-prem virtualization and private cloud resources with the public cloud, CloudBolt serves as a bridge between your existing infrastructure and Google Cloud Platform (GCP). Developers within your organization can provision the resources they need through an intuitive self-service portal, while IT maintains full control over how these provisioned environments are configured, helping them reap the cost and agility benefits of GCP using the development tools and processes they’ve built up over the years. It’s also an elegant way to rein in VM sprawl, helping organizations manage the ad-hoc environments that spring up with new projects. CloudBolt even provides a way to automatically scan and discover VMs in both on-prem and cloud environments.

Teams can get started immediately with this self-service tutorial. Or join us for our upcoming webinar featuring CloudBolt’s CTO Bernard Sanders and Google’s Product Management lead for Developer Tools on January 26th. Don’t hesitate to reach out to us to explore which enterprise workloads make the most sense for your cloud initiatives.
Quelle: Google Cloud Platform

Tesla Cleared In Fatal Autopilot Crash Investigation

Joshua Brown’s Model S after the fatal crash in Florida.

National Transportation Safety Board

A federal regulator has closed a six-month investigation into whether Tesla’s Autopilot played a role in recent crashes, finding that it could not “identify any defects in design or performance.”

The National Highway Traffic Safety Administration opened an investigation into Tesla’s Autopilot driver assistance system last June after a fatal crash in Florida. That investigation also considered a later crash in Pennsylvania. In a final report released Thursday, the agency said that it found no “defect” in Autopilot, “nor any incidents in which the systems did not perform as designed.”

In the fatal Florida accident that led NHTSA to open an investigation into the design and performance of Autopilot, “neither Autopilot nor the driver noticed the white side of the tractor trailer against a brightly lit sky, so the brake was not applied,” Tesla said in a blog post. The Model S, speeding at 74 mph with a 65 mph speed limit, hit the trailer and traveled under it before veering off the road, killing driver Joshua Brown.

NHTSA, one of two federal agencies that opened investigations into Autopilot last year, requested information from Tesla about all crashes where airbags were deployed and Autopilot had been in use during or within the last 15 seconds. It found only two of those incidents – the Florida and Pennsylvania crashes – involved fatal injuries.

The investigators determined that for at least 7 seconds prior to the Florida crash, the tractor trailer should have been visible to the driver, according to the report.

After reviewing mileage and airbag deployment data provided by the company, the investigators found that Tesla’s vehicle crash rate dropped by 40 percent when Autosteer, one function of Autopilot that helps drivers remain within lanes, was activated.

“A safety-related defect trend has not been identified at this time and further examination of this issue does not appear to be warranted,” NHTSA’s report concluded.

The agency noted that manufacturers must consider the potential for misuse of any system by drivers. In Tesla’s case, people had filmed themselves going hands-free after activating Autopilot. The name Autopilot – by definition, a system that can drive itself in place of a person – also posed confusion. Drivers who activate Autopilot, however, see a warning to keep their hands on the wheel at all times.

“It appears that over the course of researching and developing Autopilot, Tesla considered the possibility that drivers could misuse the system in a variety of ways, including those identified above – i.e., through mode confusion, distracted driving, and use of the system outside preferred environments and conditions,” NHTSA wrote in its report. “The potential for driver misuse was evaluated as part of Tesla’s design process and solutions were tested, validated, and incorporated into the wide release of the product.”

And in September, Tesla announced it would send over-the-air updates to Autopilot that restrict the amount of time drivers can keep their hands off the wheel while Autopilot is activated. At the time, Tesla CEO Elon Musk said the updates would have prevented the fatal Florida crash.

NHTSA spokesman Bryan Thomas told reporters Thursday that the agency has concerns about the naming of driver assistance systems, and that “it’s important for manufacturers to design with the inattentive driver in mind.”

A footnote in the report nods to this issue, but says that “NHTSA recognizes that other jurisdictions have raised concerns about Tesla’s use of the name ‘Autopilot.’ This issue is outside the scoop [sic] of this investigation.”

Quelle: <a href="Tesla Cleared In Fatal Autopilot Crash Investigation“>BuzzFeed

Viral WhatsApp Hoaxes Are India’s Own Fake News Crisis

Viral WhatsApp Hoaxes Are India’s Own Fake News Crisis

Akash Iyer / Via BuzzFeed India

At 8 PM on November 8, India’s Prime Minister Narendra Modi unexpectedly banned 86% of the country’s legal tender from circulation. The goal was to wipe out “black money”&;—&x200A;a term used in India for cash that’s stashed outside the banking system to evade taxes. Old notes of Rs. 500 and Rs. 1,000 would no longer be legal. Instead, the government would issue new, redesigned Rs. 2,000 notes.

Hours after the Prime Ministerial bombshell, the rumors started flying fast and thick over WhatsApp, the Facebook-owned instant messaging app used by more than 160 million Indians: the new notes would include an embedded GPS chip that would allow the government to track down hoarders.

Twitter: @Nisha__Hindu

Soon a video purporting to show one of these GPS notes being tracked on Google Maps went viral on WhatsApp, and then Facebook. And &x200A;less than 24 hours after the rumor started&x200A;, &x200A;Zee News, a leading Hindi television news channel, ran a 90-second report about the high-tech note, leading the country’s reserve bank to finally debunk it.

The United States is currently experiencing a fake news crisis – bogus news articles disguised to look like real ones to mislead people, influence public opinion, and/or to simply use their massive reach to reap advertising profits. These operations are sophisticated, data-driven and highly targeted. But in countries like India where internet penetration and literacy still lag far behind the US, misinformation tends to have a more grassroots quality. Twitter is a fertile ground for all kinds of rumor mongering, but with just over 30 million users in the country, its impact is limited.

“Our problem is WhatsApp, because it’s fast, simple, and much more intimate compared to Facebook.”

The primary vector for the spread of misinformation in India is WhatApp. The instant messenger is fast, free, and runs on nearly all of India’s 300 million smartphones. It’s also encrypted end-to-end, which means it’s nearly impossible to track what flows through it. Its real-world ramifications, nonetheless, can be brutal.

In November, WhatsApp rumors of a salt shortage sparked panic in at least four Indian states and caused stampedes outside grocery shops as people rushed to stock up. The government eventually debunked the rumours – but not before a woman died.

A Different Kind of Fake News

India’s misinformation problem predates the internet. In the early ‘90s, rabble-rousers in northern India trying to stir up tensions in Hindu and Muslim communities would mass-produce cassette recordings full of fake gunfire, screams, and chants of “Allah-ho-Akbar,” and then play them in car stereos at full volume in the dead of the night to incite communal violence.

And once the internet and social media came to the country, hoaxes took on a life of their own. In 2008, Pepsi was forced to publicly rebut a video that claimed that its Indian subsidiary manufactured Kurkure — Indian Cheetos — out of plastic. A few years later, makers of Frooti, a popular mango drink, started offering guided tours of their facilities after a rumour about the beverage containing HIV-positive blood went viral. In 2015, Mumbai’s police commissioner set up a hotline for anxious parents and urged people to ignore WhatsApp rumors, which claimed that gangs of women were kidnapping school children.

“I think it’s unfair to draw a direct parallel between the kind of organized fake news industry we saw in the lead up to the US elections and what happens in India,” said the social media strategist of a prominent political party in Delhi who did not wish to be named. “Our problem is WhatsApp, because it’s fast, simple, and much more intimate compared to Facebook. There’s more incentive for perpetrators of misinformation in India to distribute it over WhatsApp than Facebook because the chances of having real-world impact through WhatsApp are higher.”

What is also a disincentive is how little average revenue each Indian user generates for Facebook annually, despite the fact that the country is Facebook’s largest market outside the United States. According to the company’s own numbers, each user in the Asia-Pacific region generates less than $8 annually compared to a US user who generates $62. That makes India a less attractive target for people like teens in Macedonia, for instance, who earned thousands of dollars in advertising revenue peddling pro-Trump fake stories on Facebook to millions of Americans.

A Nationalist Wave

“There&;s been a sharp increase in WhatsApp forwards that are just propaganda.”

In 2014, Narendra Modi, a right-wing politician known for his close ties to Hindu supremacist group RSS, won by a landslide to become the Prime Minister of India. Like Trump, Modi is a polarizing figure – and his rise to power birthed thousands of social media trolls and organized misinformation campaigns.

“Everything changed,” said author Rupa Gulab, who is an outspoken Modi critic. “The hoaxes that went viral a few years before were just silly, but with Modi and his fanatics, there’s been a sharp increase in the amount of WhatsApp forwards you receive that are just propaganda.”

The build-up started while Modi was still campaigning in 2014. In January of that year, a quote about Modi attributed to WikiLeaks founder Julian Assange went viral on Twitter, WhatsApp, and Facebook, boosted by shares from members of Modi’s party, the Bharatiya Janata Party (BJP).

Twitter: @mrsgandhi

WikiLeaks denied the quote.

Twitter: @wikileaks

That didn’t stop the wave of Modi-related forwards on WhatsApp.

In October 2015, a photo of Modi sweeping the floor “during an RSS rally in 1988”&x200A; — &x200A;an attempt to highlight the Prime Minister’s humble roots &x200A;— &x200A;blew up. Later it became clear the image was Photoshopped.

A photo of Prime Minister Modi sweeping the floor “during an RSS rally in 1988” (left) was found to be Photoshopped from the original picture (right) in 2015.

Last year, India’s Press Information Bureau, an agency that manages government communication with the media, was left red-faced after it published a Photoshopped picture of the Prime Minister looking out on a flooded town in the flood-hit state of Tamil Nadu via its official Twitter handle. A new hashtag PhotoshopSarkar&x200A;—&x200A;Photoshop Government&x200A;—&x200A;was born.

Twitter: @SusegadGoan

And in August, Modi himself had to debunk a viral story that claimed that he had urged citizens to boycott Chinese-made firecrackers.

Twitter: @pmoindia

More recently, in a thread that went viral, Twitter user @samjawed65 deconstructed how an uncorroborated pro-government report in a mainstream Indian publication ended up in an aggregation echo chamber with half a dozen other media outlets re-reporting it, until the Huffington Post finally debunked it as fake news.

A recently published book details how the BJP deliberately created abusive social media campaigns using both WhatsApp and Twitter to troll prominent Indians and spread lies.

“[It’s clear] how seriously the political Hindu Right in India takes the online space as an ideological battlefield,” Rohit Chopra, a media studies professor at Santa Clara University who is working on a book about Hindu nationalism and new media, told BuzzFeed News. “They have invested money in it, they have mechanisms for flooding platforms like Twitter with messages either promoting their view or attacking contrary views, and they seem to employ a significant number of people in different capacities to manage this space.”

Krishna Prasad, former editor-in-chief of Indian news weekly Outlook, agrees. Once, Prasad recalls, a social media strategist asked him during a meeting with BJP politicians, “What have you gotten to trend on Twitter today?” “There are clearly people in India’s political parties buying hashtags and trying to influence trending topics,” he told BuzzFeed News.

“Individuals trying to influence trending topics are considered spammers and may have their accounts temporarily or permanently suspended,” a Twitter spokesperson told BuzzFeed News, and pointed to Twitter’s page that outlines rules for trending topics.

Dark Social

In November, local newspapers reported that a doctor in the eastern state of Bihar had died of a cardiac arrest after income tax officials raided his house and seized illegal currency – except it wasn’t true. The rumors had first spread on WhatsApp before trickling up to the local media that ran the story without verification. Eventually, the doctor had to call a press conference to declare he was still alive and there had be no raid.

WhatsApp groups are the connective tissue that bind most Indians.

India is the number one market for WhatsApp in the world. The instant messenger is the most popular messaging platform that connects everyone from school friends to India’s bureaucrats. WhatsApp groups are the connective tissue that bind most Indians — but they are also notorious for being hotbeds of spammy forwards and hoaxes.

“Most Indians belong to tight-knight groups on WhatsApp such as a friends group and a family group,” said Harsh Taneja, an assistant professor at the Missouri School of Journalism whose research focuses on audience behaviour and internet use. “But digital networks like WhatsApp are designed to connect us tightly with groups of acquittances too, who we may not otherwise have interacted with frequently.”

These “weak ties”, as Taneja calls them, are the reason why information spreads rapidly on closed networks like WhatsApp. “Most misinformation that originates within WhatsApp finds its way through this tight-knit network of weak ties,” Taneja said. But it’s tough to analyze WhatsApp. The messaging platform is encrypted end-to-end with no API, algorithms, or trending topics&x200A; – which means that it’s virtually impossible to track exactly how content spreads through it.

A spokesperson at the Hindu Sena, a Hindu nationalist party that celebrated Donald Trump’s victory in Delhi in December, told BuzzFeed News that he is a part of more than 50 right-wing WhatsApp groups, and sends “thousands of WhatsApp forwards around the country every day.”

Last year, police in different Indian states arrested half a dozen admins of WhatsApp groups, charging them with the crime of spreading misleading information, even though an admin has no control over what other members post in a group they belong to.

“We need to ask tough questions of Facebook, Twitter and Google in an Indian context.”

Other times, Indian authorities have resorted the using the bluntest weapon possible: turning off mobile internet entirely. In the first nine months of 2016, the Indian government turned off the internet 22 times in various parts of the country – including a four-month stretch in violence-ridden Kashmir – simply to prevent rumors from spreading over WhatsApp.

“We need to ask tough questions of Facebook, Twitter and Google in an Indian context, just like they are being brought to book in America,” said Prasad. “In a country like India that is so diverse and culturally different from the US, these companies cannot get away with saying that we are just platforms any longer.”

Facebook declined to comment on WhatsApp in the context of fake news. A Facebook spokesperson instead directed BuzzFeed News to CEO Mark Zuckerberg’s post on the topic. “We’ve made significant progress,” it says. “But there is more work to be done.”

Quelle: <a href="Viral WhatsApp Hoaxes Are India’s Own Fake News Crisis“>BuzzFeed

OpenShift Commons Briefing #58: Open Source Application Segmentation with Aporeto’s Trireme

In this briefing, Dimitri Stiliadis, CEO, Co-Founder of Aporeto gives an introduction to the Trireme open source project. Trireme takes a different approach to application segmentation by treating the problem as what it is: an authentication and authorization problem. Every application component, such as process, a container, a Kubernetes POD, has an identity. A segmentation function is a simple policy that defines identities of the endpoints that are allowed to communicate with each other.
Quelle: OpenShift

The Media Is Falling All Over Itself To Cover The Deploraballs

Couldn&;t get a ticket to the Deploraball, tonight&039;s not-quite-alt-right inauguration party at the National Press Club?

Don&039;t feel bad: Neither could much of the media, though we certainly tried.

Of the more than 200 requests for press passes the organizers of the event received, they granted only 20.

“Otherwise, it would have been one reporter for every fifth person,” said Jeff Giesea, one of the Deploraball&039;s planners.

The lucky outlets, among them the New Yorker, New York Magazine, Fox News, and Breitbart, will have dibs on asking questions of the 1000 guests, plied with an open bar and celebrating their victorious campaign, per the event&039;s website, “to meme our way to the Whitehouse.” (BuzzFeed News plans on covering the event.)

Of the more reasonable 50-1 ratio, Giesea said: “It&039;s still a lot of press.”

No, a lot of press is what will descend on Friday night&039;s smaller sequel, the Gay Deploraball, in the upscale DC suburb of Potomac, Maryland. That soiree will draw eighty-five news outlets, including the Washington Post, the New York Times, the New York Post, BBC, NBC News, CNN, Quartz, and BuzzFeed News. In addition, documentary crews from Vice and Anonymous Content — the production company behind The Revenant and Winter&039;s Bone — will strafe the guests.

All 200 of them.

That means, conservatively, there will be one member of the media for every two attendees.

“Isn&039;t it amazing?” said Katarina Niedermair, a spokeperson for the Gay Deploraball.

Amazing: The two parties — organized largely by political novices (Giesea, for example, has no background in politics and Niedermair is 22) — are set to receive the kind of coverage reserved for professional sporting events and major political press conferences. It&039;s a testament to the enormous public fascination generated by the meme-savvy faction of the pro-Trump internet, even as it seems to be undergoing an existential crisis.

Yes, Giesea and his co-organizers have gone to some lengths to distance themselves from the more explicitly racist elements of the pro-Trump internet — “We wanted to create a space for everyday citizens who supported trump to celebrate his inauguration,” he said. But it&039;s hard to imagine this sort of massive media interest in the event if there wasn&039;t the potential for some fireworks.

Those could come in the form of a stinkbomb attack by DC anti-fascists, or perhaps more likely, Nazi salutes from attendees unhappy with the Deploraball&039;s decision to ostracize publicly the overt racists and anti-Semites who helped fight the very same meme campaign.

The potential for such a subversion is keeping Giesea “busy and stressed,” he said, and for good reason: The infamous Nazi salute alt-right hero Richard Spencer presided over at a November conference in DC — the first post-election gathering of Trump-internet types attended en masse by reporters — led to much of the current agita within the movement. That event and that gesture controversially inflated Spencer into the leading figure in the alt-right, which had until then been a largely faceless movement.

That&039;s likely why Giesea has set a ground rule for reporters attending tomorrow night&039;s party: Interviews have to be opt-in, no ambushes by the bar. And CNN, which the Deploraball&039;s umbrella organization MAGA3X took to Twitter today to call “biased” and “irresponsible,” won&039;t be invited in. Still, hundreds of reporters and dozens of cameras at two controversial events seem likely not to let a stray gesture go unnoticed, or a stray slur go unheard.

In other words, expect a deluge of Deploraball content over the weekend. And don&039;t think that the organizers don&039;t know it.

“All the noise thats gone on has given us a pretty big opportunity,” said Niedermair. “The more coverage we can have, the better.”

Quelle: <a href="The Media Is Falling All Over Itself To Cover The Deploraballs“>BuzzFeed