Open Source Summit Europe 2024

Almost seventy years ago, wilderness firefighters who reeled from major losses developed a set of rules with the goal of improving incident management. These rules came to be known as the "Ten Standard Firefighting Orders" and have been the authoritative way of preparing and training for critical operations. In this talk, Kerim explains how the systematic approach of these orders can be adapted to a software engineering context, with the ultimate goal of improving operational reliability and, in the case of an outage, limit damage to human operators and (IT) infrastructure.

ASML is building a self-service, multi-tenant data platform that enables teams to work independently on data products and applications. In a secure multi-tenant Kubernetes setup, tenants get an isolated view of the cluster, allowing them to deploy workloads independently of each other. Data sharing among tenants is governed by a global policy-based access control layer. Our challenge was to introduce a shared Kafka cluster into this setup, with proper tenant isolation and seamless integration with the global access control layer. We used Istio to enable zero-configuration authentication for Kafka clients operating inside the Kubernetes cluster. This allows Kafka authentication to be done with the Kubernetes-native tenant/namespace/serviceaccount idiom. A custom operator reconciles the tenant's topic definitions and topic access requests with the platform administrator's resource allocations and the global data sharing policy, and dynamically configures the right Kafka ACLs and resource quota.

At the edge, there's one thing we know for sure: it's not to be trusted. But imagine if Kairos could change that, letting you sleep soundly knowing your intellectual property is secure. Kairos is a fully open source project to run kubernetes at the edge. As such, we have put Trusted Boot into action. Inspired by Lennard Pottering, the mind behind Systemd, we've leveraged Secure Boot, Trusted Boot, TPM, and disk encryption. The result? A Linux OS that's built tough against the challenges of untrusted environments.

This presentation outlines the design of a smart garden system. The system consists of a cloud component where data is streamed to and commands are relayed from the local sites. The other component is the locally positioned SBC-powered system that orchestrates a group of sensors and controllers while maintaining a tunnel to the cloud. The choice of protocol for local communication between the SBC-based coordinator, sensors and controllers is open. The current set up is based around Zigbee due to the small size of the deployment site and the unobstructed nature of the terrain on which the system was developed. The system leverages the power of the open-source graph visualization and monitoring platform Grafana and the time-series database Prometheus. Grafana is a natural choice for a user dashboard that can display real-time site statistics like soil-moisture, ph score and EC. Grafana provides monitoring capabilities that will be used by the operators to ensure functioning. The cloud component provides long-term storage of all locally-streamed data. It also allows the owner to export all collected data for analysis by a third-party expert.

Cloud traffic is intermittent and bursty, but cloud bills are on 24/7. While many cloud providers have scale to zero mechanisms (i.e., putting an app to sleep if it's idle, and waking it up when requests for it arrive once again), these are slow, taking seconds or minutes to kick-in. In this lightning talk, we will show that leveraging tech from the Linux Foundation OSS Unikraft project (www.unikraft.org) we can fundamentally disrupt the semantics of scale to zero and autoscale in modern cloud deployments. Concretely, we will demo the ability to (1)*cold* start standard apps (web servers, databases, etc) in milliseconds; (2) scale them to 0 within milliseconds; and (3) wake them up within milliseconds of the next request coming in -- within an Internet RTT and thus not noticeable by end users. Finally, for a bit of fun, we will push the server to the limit, by loading it with thousands of these scaled to zero instances -- and take bets from the audience as to where the system might break.

Is Distributed Tracing an observability essential or just a high-maintenance diva? Hardly, anyone wants to compromise on a trace. For an adventure, try tracing everything and watch your cloud bill explode. Yes! All those spans that you decide to keep are expensive. If you use an external APM provider, god help you before you break your bank. While tracing has solved a number of problems, the cost problem is genuine and it keeps increasing with scale. In this presentation, Prashansa narrates her experiences when she was trying to balance the costs while keeping the traces sane. It’s a humorous journey lined with some failed experiments, small peaks of joy, troughs of sorrow and finally tumbling upon a good enough solution. Join her to know how you can also maintain good and sane enough tracing with a manageable bill, with some span tweaking magic, custom sampling algorithm and fully utilising OpenTelemetry capabilities. Trace smarter to save better.

If you’ve been globally distributing digital content for a while, you’ll understand that merely having numerous datacenters with advanced caching patterns isn’t sufficient. When your users need to retrieve an object that’s available in different locations worldwide, they should ideally be directed automatically to the location that’s nearest and fastest for the best experience. Cloud service providers typically offer services to handle this for you within their own clouds, but what if you are running a multi-cloud or hybrid environment? K8GB is a cloud-native solution that handles GeoDNS across heterogeneous environments and enables you to reach the same level of multiregion service resilience offered by cloud providers.

Within AI workloads, a few key traffic flows drive significant data movement between GPUs across nodes. Optimizing these flows for efficient bandwidth, low latency, and minimal jitter is critical to prevent GPU underutilization. Additionally, in the context of AI Cloud infrastructure, accommodating numerous users and concurrent AI workloads introduces competition for shared network resources, potentially impacting application performance. Hence, ensuring isolation between workloads within and across tenants is paramount. This session will explain ways to achieve network isolation (overlay virtual network topology) and efficient bandwidth (end-to-end QoS) between AI workloads using Open Source SDN solution, namely, Open vSwitch (OVS), Open Virtual Network (OVN), and OVN-Kubernetes CNI. With OVS-offloadable hardware the gains are much more significant.