Bart Farrell: Kubernetes is now being called a mature technology. It's going to turn 12 years old in June. What do you think are still the biggest challenges or unanswered questions, unfinished business, unsolved problems on Kubernetes?
Jacopo Bufalino: I can tell you what I've been working on. Kubernetes networking needs a lot of fixing. We've come up with this idea that Kubernetes shouldn't handle low-level connectivity between components. But that is actually causing misconfigurations in production. And in my research group, we've actually seen that misconfiguration can cause vulnerabilities at some point. And many of them relate to the fact that Kubernetes is not aware of the real network connections that are possible in the cluster. And I think fixing that may help reach a more mature project, which is actually aware of every component and every connection in the cluster.
Bart Farrell: Yesterday we had a conversation about the Ingress NGINX deprecation. You didn't think that was that big of a deal, why not?
Jacopo Bufalino: Technology evolves and the deprecation is a community effort, a community decision, and there were many things that needed to be fixed in the NGINX controller. The community decides and then we have to adapt. For some people it's easier, for others it's not, but that's simply how things go and how things evolve in the community.
Bart Farrell: We ask a lot of people about their least favorite Kubernetes features and very often we'll hear about CRDs, which some people also say is their favorite feature, and other people will often chime in saying that network policy management is their least favorite part of Kubernetes. Do you agree? Why or why not?
Jacopo Bufalino: I agree with the network policy part. It is very hard to create policies if you don't know the underlying application. That's one of the things that we've done for research. We looked at many open source Helm charts and applications, and almost no one ships with the network policies, which is a problem. The way you define network policies is problematic, because you need to know the ports that are exposed and the services that are exposed. Handling them could be improved. That's also why we see a lot of custom CRDs, custom implementations of network policies.
Bart Farrell: AI. What are things that you're comfortable using AI for on Kubernetes? And what are things you'd say absolutely not?
Jacopo Bufalino: Everything that does not involve adding an agent inside my cluster is okay. But I'm not comfortable giving read and write access to an LLM, to secrets or any type of resource in my cluster. What we're trying to do in my research group is to move away from this concept and just use the AI to modify resources or infrastructure components without having access to the system. In that case, we can have a bit more control over what happens. It was two or three weeks ago that the company database was completely wiped out by an AI agent.
Bart Farrell: What's next for you?
Jacopo Bufalino: I'm still working on AI and networking and software supply chain security. That's what we're going to work on next.
