Bart Farrell: For people who don't know you, who are you, what's your role and where do you work?
Chris Plank: Hello, I'm Chris Plank. In my day job, I work for one of the top four banks in the UK called NatWest Bank. I'm a CNCF ambassador; I'm an OpenUK ambassador, and I also am one of the leaders of the CNCF Platform Engineering Technical Community Group. Probably a lot of what I'm talking about today isn't really about the bank. It's more from the community perspective and discussions with lots of other banks, including our own.
Bart Farrell: Our first question relates directly to that. Platform engineering is supposed to abstract complexity away from developers. In a bank, how do you create that simplicity without also hiding the security, compliance, and operational risks that teams ultimately need to understand?
Chris Plank: I think it's really hard. I talk a lot about this. We've probably got about three broad categories of consumers. You've got the highly technical ones who want to do everything themselves. You have ones that maybe aren't as technical, maybe don't have as much money, and they want other people to do things for them. And then you want the ones who really just want to focus on application development and want to consume fully wrapped products. You've got a broad spectrum of offerings that you've got to give. And each of those has to have the controls and the guidelines baked into them. For the people who really want to do a lot of the experimentation, a lot of the things themselves, you can imagine that the controls on those guys are going to be really hard and really different from when you're baking it into a product. Because if you put it into a product, you've done it once. It's there. You can only use it; you can only consume it; you can't change it. But if you've got the engineering capability, you've given people Terraform, you've given them shared services, you've given them accounts, and you let them go forth and multiply, then you've got to have a different controls framework. We've got a lot of people in cloud platforms in our organization (and I've seen this in other orgs as well) that are just dedicated to controls. And I think that is the hard part at the moment: there's a lot of new things coming out, AI especially, and agentic AI. We'll maybe talk about that later, but controls are really where a lot of organizations are doubling down at the moment.
Bart Farrell: And when you build Kubernetes golden paths inside a regulated financial institution, which controls need to be completely non-negotiable and enforced by the platform? And where should developers still have freedom to make their own choices?
Chris Plank: I think it comes back to those three different types. If you're doing more of it yourself, then you're entitled to more of that opinion. And if you're doing the least amount of engineering, you're entitled to less of that opinion. And so from a platform perspective, I think there are primes that need to be set. It's the ingress and the egress controls, the security controls, where container images are being sourced from. I think a lot of organizations now are looking at the whole supply chain and where things are coming from and how images are ingested into their organizations and making sure that the golden paths are using maybe golden registries that have already been pre-seeded with hardened images from some of the suppliers like Chainguard or Echo or Docker Hardened Images rather than just going out to GitHub and pulling things down. So I think those are some of the non-negotiables now. I think a lot of orgs are doubling down on that. Those are the hard and fast, ring-fenced things that you must use. Some of the processes as well: things like the process to actually be allowed to use public cloud. If you're a regulated industry (and I can talk from a UK perspective), then you've got to let the regulator know what things you're putting in public cloud. So there's almost like a workload placement decision tree that you have to follow that says: What types of workloads can go out to public cloud? What notifications do we need to give to regulators and people like that? And so there are all these things: again, non-negotiable. They're not technology; they're process, and they're related to other things that maybe developers aren't aware of.
Bart Farrell: And now banks are expected to prove operational resilience, not just design for it. What evidence should a Kubernetes platform be able to produce to demonstrate that workloads can survive infrastructure, region, or cloud provider failures, and that recovery actually works as intended?
Chris Plank: That's a great question at the moment, given what's happened out in the UAE and AWS, with what went on with Iran: lost the entire region, lost a lot of the data and things out there. We've seen that in the news recently. It's very difficult to run banking operations in public cloud, dual-region, or even cross CSPs. And so it all comes down to the classification of the applications, because not every application that a bank runs needs to run to that level of resilience. And a lot of the things that banks still run (traditional things) still run, like we still run a mainframe. We still have our data centers. We're not the only organization that's like that. If I talk to any of the other banks in the UK, in fact, most of them in the world (I used to work for FIS; I talked to lots of banks when I worked for FIS), they still have their own data centers. They still have mainframes. They still have their core backend systems. They still rely on messaging. They keep the data layer maybe internally. And the stuff that's out in public cloud is not just brochureware. It may also be the stateless applications, the stateless microservices that are pushing those messages inbound and where the data is actually kept. And a lot of what our organization does, and I've seen it in other orgs, is actually about proving that multiple times a year: switching from one region to another, switching from one data center to another, providing that evidence, making sure that we've done that multiple times a year, just as part of the operational resilience and the things that people do on a day-to-day basis. We operate different platforms. We have a different approach out in public cloud from what we do internally. We have Kubernetes platforms internally that run across our two different data centers, and we move workloads between those. And all that's evidenced, just as BAU, as we call it: business as usual. You have to do it. We still follow ITIL. A lot of smaller organizations don't. But larger enterprises follow ITIL; they use ServiceNow; they use change management practices. This is baked in. This is stuff we've been doing for decades. It's not anything new to us. This is what we've always done. And Kubernetes is just another platform.
Bart Farrell: And with that in mind, we're in this AI age. You mentioned business as usual, things we've been doing for a long time. There's a certain number of conversations around the uncertainty that we're going through. I want to touch on a special point here: you have experience with fishing. In the world of fishing, you have to deal with elements of certainty and uncertainty. What can fishing teach us? What patience and peace can fishing give us in this age of AI uncertainty?
Chris Plank: Maturity. Fishing is a mature concept. We've been doing it for millennia. There's no such thing as AI maturity at the moment. Everything is new. If we look at agentics (and I don't know what it's called today), what's the claw name today? Is it OpenClaw, the latest thing? I give up trying to find the names. Agentic AI is the new kid on the block. There is no maturity there. We saw lots of things come out over recent weeks. I'm not even up to speed yet; just yesterday there was something (I think it was from NVIDIA) doing sandboxing for agents and all about hardware. It looks very similar to what Adara have been doing for a while. Some sort of VM sandboxing. So can you look at that? And this just shows there's no maturity at the moment. We talk a lot in the platform engineering community about the platform maturity model and the four levels of maturity and the different areas that you can look at. It's applicable to AI. There are a lot of things we talk about in there that are applicable to AI, but there is no separate AI maturity model for people to follow. It's very much a free-for-all at the moment. So if you go back to fishing, the rods haven't really changed in a long time. They've been perfected. There are guys like Scott that went away and looked at F1 technology and created carbon rods in Scotland. And they're world-class rods, but they cost like £1,000. Really extreme. But things have evolved over time. They've been perfected. The flies have been perfected. Again, they've evolved over time. It's mature. People know where to go and get those things from. They're a known quantity. There are standards. The lines have standards. They're different weights, different sizes, but you follow these standards and you get a predictable outcome. You're going to be able to match a line to a rod. You're going to cast that out and hopefully get a salmon on the end of it, for me anyway. And I've got two days on the day next week, so I'm really looking forward to that. End of the season. There's a history there. It's predictable. It's known. AI isn't like that at the moment, and we're hearing lots of scare stories about things: agents that are escaping and doing things that they shouldn't be allowed to do. That comes back to what I talked about earlier: guardrails. We've been doing guardrails for ages in banks. Almost forever. And there's now a new set of guardrails that we're all working on. There's an awful lot of new experimentation that people are all working on. Everyone that we're talking to in the community is now doubling down on controls and trying to figure out how they sandbox these things, how they control what these things can do. It's really interesting. I'm talking more about that at KubeCon. I just wanted to put a shout out there for the talk. But I think everyone is experimenting at the moment. Everyone is learning. Everyone is on that level zero, level one maturity drive at the moment. If anyone tells you they're at level four maturity on AI, you're having a laugh because even the AI companies aren't.
Bart Farrell: Chris, if people want to get in touch with you to find out more about your KubeCon talk, fishing or any other topics (rugby, the best place to go fishing in Scotland), what's the best way to get in touch with you?
Chris Plank: Check me out on LinkedIn. It's Chris Plank on LinkedIn. CNCF Platform Engineering Technical Community Group. Have a search for that. And you'll see the meetings. We meet every second Tuesday. We just had a meeting last night where we were talking about platform factors, which is the new thing about platform maturity. Check that out.
Bart Farrell: Excellent. Chris, looking forward to seeing you at KubeCon. Best of luck with your preparation. Take care.
Chris Plank: Awesome. Thanks, mate.
