Kubernetes 1.8: Security, Workloads and Feature Depth

Editor’s note: today’s post is by Aparna Sinha, Group Product Manager, Kubernetes, Google; Ihor Dvoretskyi, Developer Advocate, CNCF; Jaice Singer DuMars, Kubernetes Ambassador, Microsoft; and Caleb Miles, Technical Program Manager, CoreOS on the latest release of Kubernetes 1.8. We’re pleased to announce the delivery of Kubernetes 1.8, our third release this year. Kubernetes 1.8 represents a snapshot of many exciting enhancements and refinements underway. In addition to functional improvements, we’re increasing project-wide focus on maturing process, formalizing architecture, and strengthening Kubernetes’ governance model. The evolution of mature processes clearly signals that sustainability is a driving concern, and helps to ensure that Kubernetes is a viable and thriving project far into the future. Spotlight on securityKubernetes 1.8 graduates support for role based access control (RBAC) to stable.RBAC allows cluster administrators to dynamically define roles to enforceaccess policies through the Kubernetes API. Beta support for filtering outbound trafficthrough network policies augments existing support for filtering inboundtraffic to a pod. RBAC and Network Policies are two powerful tools for enforcingorganizational and regulatory security requirements within Kubernetes. Transport Layer Security (TLS) certificate rotation for the Kubelet graduates to beta. Automatic certificate rotation eases secure cluster operation.Spotlight on workload supportKubernetes 1.8 promotes the core Workload APIs to beta with the apps/v1beta2 group and version. The beta contains the current version of Deployment, DaemonSet, ReplicaSet, and StatefulSet. The Workloads APIs provide a stable foundation for migrating existing workloads to Kubernetes as well as developing cloud native applications that target Kubernetes natively. For those considering running Big Data workloads on Kubernetes, the Workloads API now enables native Kubernetes support in Apache Spark. Batch workloads, such as nightly ETL jobs, will benefit from the graduation of CronJobs to beta.Custom Resource Definitions (CRDs) remain in beta for Kubernetes 1.8. A CRDprovides a powerful mechanism to extend Kubernetes with user-defined API objects.One use case for CRDs is the automation of complex stateful applications such as key-value stores, databases and storage engines through the Operator Pattern. Expect continued enhancements to CRDs such as validation as stabilization continues.Spoilers aheadvolume snapshots, PV resizing, automatic taints, priority pods, kubectl plugins, oh my!In addition to stabilizing existing functionality, Kubernetes 1.8 offers a number of alpha features that preview new functionality. Each Special Interest Group (SIG) in the community continues to deliver the most requested user features for their area. For a complete list, please visit the release notes.AvailabilityKubernetes 1.8 is available for download on GitHub. To get started with Kubernetes, check out these interactive tutorials. Release teamThe Release team for 1.8 was led by Jaice Singer DuMars, Kubernetes Ambassador at Microsoft, and was comprised of 14 individuals  responsible for managing all aspects of the release, from documentation to testing, validation, and feature completeness. As the Kubernetes community has grown, our release process has become an amazing demonstration of collaboration in open source software development. Kubernetes continues to gain new users at a rapid clip. This growth creates a positive feedback cycle where more contributors commit code creating a more vibrant ecosystem. User highlightsAccording to Redmonk, 54 percent of Fortune 100 companies are running Kubernetes in some form with adoption coming from every sector across the world. Recent user stories from the community include: Ancestry.com currently holds 20 billion historical records and 90 million family trees, making it the largest consumer genomics DNA network in the world. With the move to Kubernetes, its deployment time for its Shaky Leaf icon service was cut down from 50 minutes to 2 or 5 minutes.Wink, provider of smart home devices and apps, runs 80 percent of its workloads on a unified stack of Kubernetes-Docker-CoreOS, allowing them to continually innovate and improve its products and services.Pear Deck, a teacher communication app for students, ported their Heroku apps into Kubernetes, allowing them to deploy the exact same configuration in lots of different clusters in 30 seconds. Buffer, social media management for agencies and marketers, has a remote team of 80 spread across a dozen different time zones. Kubernetes has provided the kind of liquid infrastructure where a developer could create an app and deploy it and scale it horizontally as necessary.Is Kubernetes helping your team? Share your story with the community. Ecosystem updatesAnnounced on September 11, Kubernetes Certified Service Providers (KCSPs) are pre-qualified organizations with deep experience helping enterprises successfully adopt Kubernetes. Individual professionals can now register for the new Certified Kubernetes Administrator (CKA) program and exam, which requires passing an online, proctored, performance-based exam that tests one’s ability to solve multiple issues in a hands-on, command-line environment.CNCF also offers online training that teaches the skills needed to create and configure a real-world Kubernetes cluster.KubeConJoin the community at KubeCon + CloudNativeCon in Austin, December 6-8 for the largest Kubernetes gathering ever. The premiere Kubernetes event will feature technical sessions, case studies, developer deep dives, salons and more! A full schedule of events and speakers will be available here on September 28. Discounted registration ends October 6.Open Source Summit EUIhor Dvoretskyi, Kubernetes 1.8 features release lead, will present new features and enhancements at Open Source Summit EU in Prague, October 23. Registration is still open.Get involvedThe simplest way to get involved with Kubernetes is by joining one of the many Special Interest Groups (SIGs) that align with your interests. Have something you’d like to broadcast to the Kubernetes community? Share your voice at our weekly community meeting, and through the channels below.Thank you for your continued feedback and support.Post questions (or answer questions) on Stack OverflowJoin the community portal for advocates on K8sPortFollow us on Twitter @Kubernetesio for latest updatesChat with the community on SlackShare your Kubernetes story.
Quelle: kubernetes

Here’s Why Content Creators Got So Mad At YouTube Today

Earlier today, some YouTube content creators got pissed. Really pissed.

They were (wrongly, it turns out) under the impression that in order to link to Patreon crowdfunding accounts or other personal websites from inside their videos, YouTube was going to require them to run ads.

But YouTube says it’s not requiring content creators to run ads, it’s only requiring them to join the YouTube Partner Program, which enables the possibility of running ads, but doesn’t require it.

Google says the new rules only apply to future content, not content that’s already been posted to YouTube. The purpose of the change, a spokesperson told BuzzFeed News via email, is to “curb abuse.” Asked what kind of end-link abuse Google is trying to curb, Google pointed to its community guidelines, which encourages users to follow “common-sense rules” and not post pornography, graphic violent content, hate speech, threats, copyright infringement, or content that encourage dangerous behavior. The idea is that, by requiring content creators to join the YouTube Partner Program, YouTube will have greater insight into what outside sites creators are linking to.

But some content creators are skeptical that curbing abuse is Google’s real reason for introducing the new requirement. In the past year, YouTube has taken steps to limit the kinds of content creators can monetize, a move which upset a number of users. That Google is now seizing more control over creators rubs some of them the wrong way.

“People hate YouTube,” said Victoria Rose, who runs gaming website Flying Courier, via DM. “YouTube’s been cutting off/restricting monetization, so people like something new to be mad at.”

As an alternative, content creators can still link to their Patreons (or their Etsy pages or Twitch sites or MySpace profiles) in their videos’ description boxes without becoming partners. They only have to join the program if they want to use the popular “end links” that pop up at the end of videos, and which content creators say are more effective. (Asked why end links are preferred to links in the description box, YouTuber Ian Danskin told BuzzFeed News via DM “Heh, because people actually click them.”)

What’s an end link?

What's an end link?

YouTubers were so worked up about this change because end links help some YouTube content creators grow their fan bases and make a significant amount of money on crowdfunding sites like Patreon.

If content creators want to use these end links, however, they are now required to join the YouTube Partner Program and turn on monetization. Google says that creators can choose which ads to monetize and have the option of not running ads on any videos.

The new rules also have a small catch: YouTube content creators with fewer than 10,000 total views across their channels were banned from joining the partner program back in April. At the time, Google said it was restricting access to the program in order to prevent copycat channels from making money off of stolen content. But the new rule requiring creators to join the partner program if they want to use end links effectively means that creators with smaller viewerships can’t use the end links at all, because their channels are too small to be allowed in the partner program. It’s a catch-22 that could make it harder for small-timers to grow their audiences anywhere other than YouTube, which could benefit YouTube in the long run.

Quelle: <a href="Here’s Why Content Creators Got So Mad At YouTube Today“>BuzzFeed

The FCC Wants Apple To Activate The Hidden FM Radio In iPhones After Recent Disasters

The FCC Wants Apple To Activate The Hidden FM Radio In iPhones After Recent Disasters

iPhone 8 Plus

Mark Lennihan / AP

Federal Communications Commission chairman Ajit Pai urged Apple on Thursday to activate the hidden FM radio inside many of its iPhone models, framing the radio functionality as a matter of public safety in the wake of recent disasters that have plagued the US and Puerto Rico.

“It is time for Apple to step up to the plate and put the safety of the American people first,” Pai said in a statement. “Apple is the one major phone manufacturer that has resisted doing so. But I hope the company will reconsider its position, given the devastation wrought by Hurricanes Harvey, Irma, and Maria.”

Samsung, LG, Motorola, and HTC all sell devices with functional FM radios, according to the radio streaming app Nextradio. The Federal Emergency Management Agency (FEMA) has also argued for enabling the FM radio chips present in many smartphones.

In his statement, Pai pointed to a Sept. 14 editorial in the Florida newspaper Sun Sentinel that argued for the same point: “Given our nation’s dependence on cell phones, the smartphone’s FM switch is a public safety issue.”

iPhone X

Marcio Jose Sanchez / AP

In response Thursday, Apple said in a statement that its newer models do not support the radio functionality.

“iPhone 7 and iPhone 8 models do not have FM radio chips in them nor do they have antennas designed to support FM signals, so it is not possible to enable FM reception in these products,” an Apple spokesperson said.

Apple did not comment on devices that preceded the iPhone 7 and 8 or other models it continues to sell, including the iPhone SE. It's also unclear how easy such an undertaking would be for Apple, and neither side went into specifics about how the company would activate the FM chips.

“Apple cares deeply about the safety of our users, especially during times of crisis and that’s why we have engineered modern safety solutions into our products,” it continued. “Users can dial emergency services and access Medical ID card information directly from the Lock Screen, and we enable government emergency notifications, ranging from Weather Advisories to AMBER alerts.”

Apple may have kept the FM chip inside its iPhone models deactivated to aid its own music store and streaming service, but as the Sun Sentinel pointed out: “Our app and streaming addictions won’t disappear if we have the option of listening to FM radio. That’s why our earbuds are plugged into an iPhone, not a Walkman.”

The FCC chairman has advocated for the activation of the FM chip before. In his statement, he noted that his first public speech as chairman urged cell phone companies to enable the functionality.

John Paczkowski contributed to this report.

Quelle: <a href="The FCC Wants Apple To Activate The Hidden FM Radio In iPhones After Recent Disasters“>BuzzFeed

Ready for JavaOne: Bringing Java and Kubernetes together in Azure

The Java team at Microsoft has been working hard during this year, collaborating with Java customers and developers around the globe to optimize the Java developer experience in Azure. In the last few weeks we’ve delivered exciting new features in Maven, Jenkins, Visual Studio Code and IntelliJ. These features help Java developers rapidly adopt cloud-native patterns in Azure and debug faster, as well as added support for Managed Disks, Cosmos DB and Container Service in the Azure Management Libraries for Java. We have collaborated with partners such as Red Hat, Pivotal, CloudBees and Azul to bring Java closer to the cloud. It’s truly momentous days for Java, and as our team gets ready for JavaOne next week (where Microsoft will be a Silver sponsor) we are excited to announce that developers can now securely deploy and redeploy Java apps to Kubernetes in Azure Container Service using Maven! Getting started Azure Container Service makes it simple to create an optimized Kubernetes-based container hosting solution for Azure to run containerized applications stored in public or private registries, including Azure Container Registry. Today, you can use Maven to securely deploy and manage your container-based apps. Let’s start with a sample Spring Boot app you can clone from GitHub: git clone -b k8s-private-registry https://github.com/microsoft/gs-spring-boot-dockercd gs-spring-boot-docker/complete After adding your private Docker registry credentials to your Maven settings.xml, build the app and containerize like you always do, and deploy to Kubernetes in Azure Container Service: mvn package docker:build docker:push fabric8:resource fabric8:apply Then, get the IP address for your deployment: kubectl get svc -w And that’s it! It’s that easy to use Maven to deploy a Spring Boot app or any other Java app to Kubernetes in Azure Container Service. Make sure you check out the step-by-step instructions to get started today. Next week: JavaOne Today’s announcement wouldn’t be possible without our joint efforts with Red Hat and the ongoing collaboration enhancing the Fabric8 Maven plugin to add secure registry references. This collaboration highlights how important engaging with the Java ecosystem is for us – a key aspect of our presence at JavaOne. The Microsoft Java team, including feature owners, developer advocates, support engineers and others, looks forward to meeting you in San Francisco next week. Swing by our booth in the Expo hall to learn more – we’d love to connect. Not attending JavaOne this year? Follow @OpenAtMicrosoft or sign up for updates!
Quelle: Azure

Twitter Tells Congress It Found 200 Russian Accounts That Overlapped With Facebook

BuzzFeed News / Getty Images

On Thursday morning, Twitter Vice President for Public Policy Colin Crowell met with the House and Senate Intelligence communities about the company's potential involvement with Russian interference in the 2016 election.

Among the information Crowell shared was that the company found around 200 accounts that seem to be linked to the same Russian groups that purchased roughly $100,000 of ads on Facebook to sway Americans and create divisions during the 2016 election. Twitter also revealed that of the 450 malicious accounts shared by Facebook, 22 had corresponding Twitter accounts. Many, Twitter, said, had already been shuttered by the network.

The company also shared information on the Russian television and media organization RT after the company was singled out by intelligence agencies for its ties to the Russian government. Twitter told the committees that three RT accounts spent $274,100 in US ads in targeted US markets in 2016. Twitter said that most of these accounts were “directed at followers of mainstream media and primarily promoted RT Tweets regarding news stories.”

While Twitter itself notes that there's plenty the company cannot share (due to security and potential exploits by bad actors), a few of the numbers released by the company detail the scale of the problem on Twitter (of which foreign bots are part of). Including:

- “On average, our automated systems catch more than 3.2 million suspicious accounts globally per week — more than double the amount we detected this time last year. “

- Twitter's automated tools “catch about 450,000 suspicious logins per day.”

- Twitter notes the prevalence of spam from single suspicious entities, noting that it stopped “more than 5.7 million spammy follows from a single source just last week (9/21/2017).”

- According to Twitter, since “June 2017, we’ve suspended more than 117,000 malicious applications for abusing our API, collectively responsible for more than 1.5 billion low-quality Tweets this year.”

The findings are just the first, small look at the platform's role in the 2016 campaign with regard to the potential spreading of propaganda and misinformation. And Twitter will likely be back in front of Congress soon. This week Recode reported that congress is expected to invite Google, Facebook, and Twitter to testify in an open session in October. Meanwhile, the Senate Intelligence Committee has extended an invitation to Facebook, Twitter, and Google to appear on November 1st.

Quelle: <a href="Twitter Tells Congress It Found 200 Russian Accounts That Overlapped With Facebook“>BuzzFeed