devrelshow episode 42 - Sonali Srivastava from InfraCloud Technologies

devrelshow episode 42 - Sonali Srivastava from InfraCloud Technologies 🔗 **Source:** [devrelshow episode 42 - Sonali Srivastava from InfraCloud Technologies](https://www.youtube.com/watch?v=F_NNue6n3dY) > [!note]+ Document Notes > tags: [developer-relations, devrel-show, kubernetes-security, kyverno, women-in-tech] > author: Frederic Harper > source: DevRel Show > reference: https://www.youtube.com/watch?v=F_NNue6n3dY > date created: 2024-12-11 15:30 > > # 🏷️ Title: DevRel Show Episode 42 - Sonali Srivastava on Kubernetes Security & Career Journey >  ## 🧰 Action Inbox - [H1] Explore Kyverno's new MCP server integration for policy management — 33:45 #kubernetes #security - [H2] Consider implementing CNCF Women in Cloud Native community programs — 25:30 #community #inclusion - [H3] Research Outreachy internship opportunities for career transitions — 18:22 #open-source #career-development ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Kyverno Project](https://kyverno.io) - [Outreachy Internships](https://outreachy.org) ## 📝 Summary - DevRel Show episode featuring Sonali Srivastava discussing her journey from system administration to developer advocacy - Focus on Kyverno's new MCP server for Kubernetes security policy management - Key themes: career transitions, women in tech challenges, open source contributions, and AI-enhanced security tools - Practical demonstration of policy validation using Kyverno with LLM integration - Emphasis on community support and inclusive hiring practices in tech ## 📖 Main Content Sonali Srivastava shares her unconventional path to developer relations, starting with Linux system administration and progressing through DevOps, open source contributions, and finally landing in developer advocacy at InfraCloud Technologies. Her story illustrates the challenges women face in tech careers, particularly during life transitions like motherhood. The technical focus centers on Kyverno, a Kubernetes security policy management tool that helps implement guardrails and compliance rules. The new Model Context Protocol (MCP) server integration allows users to interact with policy violations through natural language queries, making Kubernetes security more accessible to platform engineers and developers. Key insights include the importance of giving candidates time to learn new technologies during interviews, the value of open source contributions for career transitions, and the role of community organizations like CNCF Women in Cloud Native in supporting underrepresented groups. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/F_NNue6n3dY?t=0) — Episode Introduction and Format Changes - Key idea: DevRel Show episode 42, last show of 2025 due to holiday schedule - Evidence: "I have guests for the next about two years, I think, if I do a show every two weeks" #### ⏱️ [02:30](https://youtu.be/F_NNue6n3dY?t=150) — Sonali's Dual Roles - Key idea: Balancing motherhood and senior developer advocacy positions - Evidence: "I am currently having two full-time roles. The first one is I'm a mother... And the other one is as a senior developer advocate at InfraCloud Technologies" #### ⏱️ [04:15](https://youtu.be/F_NNue6n3dY?t=255) — Developer Advocacy Role Definition - Key idea: Making technology accessible to people from different backgrounds - Evidence: "My job is to make that easier for them from understanding perspective if I have to put it in a very simple English way" #### ⏱️ [05:45](https://youtu.be/F_NNue6n3dY?t=345) — Early Linux Experience - Key idea: Started with Ubuntu in 2012, struggled with basic tasks like playing videos - Evidence: "First task for us was to figure out how to play a VLC media player... and play a video in it" #### ⏱️ [09:30](https://youtu.be/F_NNue6n3dY?t=570) — System Administration Career - Key idea: Transitioned from Python development to Linux system administration - Evidence: "I pursued that for almost three years. So from 2016 to 2019... monitoring of the servers, there were almost 30,000 servers" #### ⏱️ [12:45](https://youtu.be/F_NNue6n3dY?t=765) — Career Transition Challenges - Key idea: Geographic relocation forced career change and remote work exploration - Evidence: "I moved to a city in India where we didn't have any IT options... I had to quit my role" #### ⏱️ [15:20](https://youtu.be/F_NNue6n3dY?t=920) — Platform Engineering Before the Term - Key idea: Built educational lab platform using AWS, Terraform, and Ansible - Evidence: "This is about 2019 when there was no term like platform engineering coined... giving them an isolated environment" #### ⏱️ [18:22](https://youtu.be/F_NNue6n3dY?t=1102) — Outreachy Internship Experience - Key idea: Contributing to systemd project while caring for newborn - Evidence: "I was selected and I was given a project to fix suspend and hibernate on Linux... I used to code mostly at night because my son was born" #### ⏱️ [21:15](https://youtu.be/F_NNue6n3dY?t=1275) — Discovering Developer Advocacy - Key idea: First company to recognize diverse skill set as valuable - Evidence: "You're the first person in the past four or five interviews... to say this actually takes everything I've done makes sense" #### ⏱️ [25:30](https://youtu.be/F_NNue6n3dY?t=1530) — Women in Tech Support Systems - Key idea: Importance of giving candidates time to learn and adapt - Evidence: "Can you give me 15 days to come back and maybe answer questions on that?... The HR said yes, we can do that" #### ⏱️ [28:45](https://youtu.be/F_NNue6n3dY?t=1725) — CNCF Community Leadership - Key idea: Women in Cloud Native community creating opportunities - Evidence: "This year for KubeCon India 2026 I have been selected [as co-chair]" #### ⏱️ [33:45](https://youtu.be/F_NNue6n3dY?t=2025) — Kubernetes Security Fundamentals - Key idea: Policies provide additional guardrails beyond RBAC - Evidence: "That's where the policies actually help. You put another level of guardrail on your cluster" #### ⏱️ [36:20](https://youtu.be/F_NNue6n3dY?t=2180) — Kyverno Policy Types - Key idea: Validate rules warn about violations, mutate rules automatically fix them - Evidence: "Validate rule would do like... the resource creation will not be allowed... mutate rule will help you update your resource also" #### ⏱️ [40:15](https://youtu.be/F_NNue6n3dY?t=2415) — MCP Server Integration - Key idea: Model Context Protocol standardizes LLM tool integration - Evidence: "It standardizes how the integration will be done between the LLMs and the tools out there" ## 📚 References - [Kyverno Official Documentation](https://kyverno.io) - [Outreachy Internship Program](https://outreachy.org) - [CNCF Women in Cloud Native](https://community.cncf.io/cloud-native-community-women/) - [Kubernetes Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) ## 🗣️ Paraphrase - Sonali's journey demonstrates how diverse technical experience can converge into developer advocacy roles that value breadth over specialization - Kubernetes security requires layered approaches beyond RBAC, with policies providing essential guardrails for production environments - The integration of AI through MCP servers makes complex security tools more accessible to platform engineers without deep policy expertise ## 📰 Newsletter 🚀 **Making Kubernetes Security Accessible Through AI** This week's DevRel Show featured an inspiring conversation with Sonali Srivastava about her journey from system administration to developer advocacy, with a fascinating demo of Kyverno's new AI integration. **Key Takeaway**: The new Model Context Protocol (MCP) server for Kyverno transforms how we interact with Kubernetes security policies. Instead of deciphering YAML configurations, platform engineers can now ask natural language questions about policy violations and get actionable insights. **Why This Matters**: As Kubernetes adoption grows, security complexity increases. Tools that bridge the gap between security best practices and developer experience are crucial for sustainable platform engineering. **Try It Yourself**: Start with Kyverno's Pod Security Standards policies on a local minikube cluster, then explore the MCP server integration with Claude Desktop. Resources: [Kyverno Documentation](https://kyverno.io), [MCP Server Setup](https://github.com/kyverno/kyverno), [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) ## ✅ Action Items #### Community - Research CNCF Women in Cloud Native programs for inclusive community building - Explore Outreachy internship mentorship opportunities - Implement inclusive interview practices allowing learning time #### Kubernetes - Evaluate Kyverno for policy management and security guardrails - Test MCP server integration for improved developer experience - Document policy-as-code approaches for security compliance - Create learning resources for Kubernetes security fundamentals #### DevRel - Developer experience: Improve onboarding documentation for complex tools - Education: Create beginner-friendly security content - Community management: Support underrepresented groups in tech transitions ## 🧪 Hypotheses - AI integration through MCP servers reduces barriers to Kubernetes security adoption - Diverse career backgrounds create stronger developer advocates than traditional linear paths - Flexible interview processes improve diversity in technical hiring - Community support systems significantly impact career transition success ### 📊 Methodology - Compare policy adoption rates before and after MCP integration - Survey developer advocates on career path diversity and effectiveness - Measure hiring diversity metrics with flexible vs. rigid interview timelines ### ❓ Questions - How does MCP server integration affect policy compliance rates in production clusters? - What specific support structures most effectively help career transitions in tech? - How can organizations better recognize and value non-linear technical experience? ### 🔮 Future Research - Long-term impact of AI-assisted security tools on platform engineering practices - Effectiveness of community-driven support programs for underrepresented groups - Evolution of developer advocacy skill requirements with AI integration ### 💡 Implications - Practice: AI integration makes complex tools more accessible to broader audiences - Policy: Inclusive hiring practices require rethinking traditional technical assessments - Security: Natural language interfaces reduce friction in security tool adoption - Education: Career transition stories provide valuable learning resources - Community: Structured support programs create measurable impact on diversity ### 🧠 Learning Styles Assessment Reading level estimate: Flesch-Kincaid Grade 10 #### 👀 Visual learners - Present: Screen sharing of Kyverno policies, terminal commands, cluster configurations - Improve: Architecture diagrams showing MCP integration, policy flow visualizations #### 🔊 Aural learners - Present: Live conversation format, detailed explanations of technical concepts - Improve: Audio summary of key technical concepts, recorded policy examples #### 🗣️ Verbal learners - Present: Story-driven career narrative, analogies (door access for RBAC), technical definitions - Improve: Glossary of Kubernetes security terms, comparison tables #### 🧩 Kinesthetic learners - Present: Live demonstration of policy creation, hands-on terminal usage - Improve: Step-by-step setup guide, reproducible minikube environment #### 🧠 Logical learners - Present: Technical progression from RBAC to policies, systematic problem-solving approach - Improve: Decision tree for policy types, security maturity framework #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion format, emphasis on mentorship and support networks - Improve: Discussion prompts about career transitions, community resource lists #### 🧘‍♀️ Solitary learners - Present: Individual career reflection points, self-directed learning emphasis - Improve: Self-assessment questions, independent study materials #### 🌿 Naturalistic learners - Present: Growth metaphors in career development, ecosystem thinking about tech communities - Improve: Career development lifecycle analogies, community ecosystem mapping ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear verbal descriptions of visual demonstrations - Improve: Alt text for code examples, structured headings for navigation #### Keyboard navigation - Present: Terminal-based demonstrations accessible via keyboard - Improve: Keyboard shortcuts documentation, screen reader friendly code blocks #### Contrast and readability - Present: High contrast terminal display, clear code formatting - Improve: Consistent color coding, larger text options #### Text resizing and reflow - Present: Standard video player controls support zoom - Improve: Transcript formatting that reflows properly #### Media and captions - Present: Live conversation with clear audio - Improve: Auto-generated captions review, downloadable transcript #### Forms and interactions - Present: Simple command-line interactions - Improve: Alternative input methods documentation ### 🌍 DEIB Assessment #### Cultural breadth - Present: Indian perspective on tech career challenges, global remote work discussion - Improve: More diverse geographic examples, cross-cultural career transition stories #### Inclusive language - Present: Gender-neutral technical terms, clear jargon definitions - Improve: Plain language summaries, avoid cultural idioms #### Neurodiversity support - Present: Step-by-step technical demonstration, structured conversation flow - Improve: Content warnings for sudden loud noises, predictable format #### Representation - Present: Women in tech leadership discussion, motherhood in tech careers - Improve: Broader identity representation, intersectional perspectives #### Psychological safety - Present: Respectful discussion of challenges, supportive community framing - Improve: Content warnings for career stress discussion, resource links ### ✅ Logical Validity #### Strong reasoning - Deductive strength: "Policies needed because RBAC has limitations" → Clear logical progression - Inductive strength: Personal experience generalizes to broader hiring practices - Causal reasoning: Community support leads to career success with evidence - Analogical strength: Door access analogy for RBAC concepts effective #### Fallacies - Hasty generalization: Single positive hiring experience doesn't guarantee universal applicability - Anecdotal evidence: Career success story doesn't prove general patterns #### Tone of voice - Overall tone: Conversational, supportive, technically informed with personal vulnerability ### 🛡️ DARVO Analysis - Deny: No defensive patterns observed - Attack: No attacks on questioners or critics present - Reverse victim/offender: No victim/offender reversals identified - Emotional cues and rhetoric: Positive, solution-focused discussion throughout ## 🎯 Conclusion This episode demonstrates how diverse technical backgrounds strengthen developer advocacy while showcasing practical AI integration in Kubernetes security tools. Sonali's journey illustrates the importance of inclusive hiring practices and community support systems for career transitions. The Kyverno MCP server represents a significant step toward making complex security tools accessible through natural language interfaces, potentially accelerating adoption of security best practices in cloud-native environments. ## 🧱 Refactor Appendix ### 📚 Literature Split Pad ### [H1] AI integration reduces Kubernetes security barriers > [!quote] [DevRel Show Episode 42](https://youtu.be/F_NNue6n3dY) by --- ## Full Transcript [00:10] Heat. Heat. [00:31] Hello, hello lovely people. Welcome to [00:35] another episode of the Devil Show. This [00:37] is episode 42 which is crazy. I can't [00:41] believe it's been 42 episode that I'm [00:43] doing of the Devil Show. still always [00:46] happy, always excited to be here to do [00:48] the show with amazing folks, amazing [00:51] guests. Um, with that said, you may have [00:53] noticed, I think I warned you like it's [00:56] not every other week like it used to be. [00:58] It's mostly every other week, but [01:00] because I started to travel again and go [01:01] to events, it's a little more difficult [01:03] to do the show as I used to do it. But [01:05] I'm still continue to do it. I have [01:08] guests for the next about two years, I [01:10] think. uh if I do a show every two [01:12] weeks, I have a pretty good wait list uh [01:15] for uh the next shows. With that said [01:18] though, it is the last show of 2025 [01:22] uh because you know after that that's [01:24] going to go something around like [01:25] actually the 25 on Christmas uh [01:28] everybody's off. It's Christmas. You [01:29] don't want to see my face on Christmas [01:31] day. So that's going to be the last show [01:33] of the year and I will come back at the [01:35] uh beginning of January. If I'm not [01:38] wrong, I think the first show is going [01:39] to be in the eight if I'm not mistaken. [01:41] Uh the first show of 2026. So with that [01:45] said, super happy to be here. Hello, [01:47] Anush. It's been a while. Miss you, my [01:50] friend. So, uh thanks for being here and [01:53] um super happy I'm finishing that year [01:56] strong with my guest today. Sonali, how [01:58] are you? [02:00] >> Hi, I'm good. Thank you for having me, [02:02] Fred. [02:03] >> Thanks. Thanks for being here. Uh, it's [02:05] a pleasure to have you, especially [02:07] because, uh, from my point of view, it's [02:09] way too late for you to be on a live [02:11] stream. I think it's like something like [02:13] 1:00 a.m. for you. Uh, which I need to [02:16] tell people listening, I offered her to [02:19] put it like like earlier, it was better [02:21] for her time zone, but she was like, [02:23] "No, I'm used to it. It's fine." So, I [02:27] mean, you're good. I'm not able maybe [02:28] I'm too old. I'm just not able to like [02:30] do a live stream or give a talks at one. [02:32] I did it once. um in a hackathon. Uh it [02:37] was even in person so I should have been [02:38] more energized but you know it was those [02:40] kind of you know all like 24 hours 48 [02:43] hours hackathon and my talk about the [02:46] technology. I was at Fitbit at the time. [02:48] My talk was at 2 a.m. That was the worst [02:51] talk I've ever given. Like I was so [02:54] tired. I was blabbering. I did not know [02:56] my technology at all. Like I like at [02:59] that time I was working at Fitbit for a [03:00] year so I know the Fitbit SDK. But that [03:03] talk was terrible. I was just not there [03:05] anymore. I'm not a nightly person. Like [03:08] I go to bed at 10, 11 and like that's [03:10] the maximum. So anyway, thanks for being [03:13] in the show. Uh so late right now. Uh so [03:18] I will go with my first question I have [03:19] for every guest. Please please let us [03:22] know who you are. Who are you? [03:25] >> So yeah, thank you for introducing me [03:28] and uh I am Sunalis Shavasta. I am [03:32] currently having two full-time roles. [03:34] Okay. So, the first one is I'm a mother. [03:37] Okay. So, that explains why I can stay [03:40] awake at one or maybe I can stay awake [03:42] at whatever time my client expects me [03:46] to, you can say. [03:48] So, yeah, I'm a mom. That's my full-time [03:50] role. And the other one is uh as a [03:54] senior developer advocate at Infraoud [03:57] Technologies which has been recently [03:58] acquired by improving. [04:01] Oh, that made more sense. So two things [04:03] because I was looking at your LinkedIn [04:04] and I was like I'm pretty sure I did the [04:06] promotion about cloud but when I went on [04:09] LinkedIn I was like oh my god no she's [04:11] working and proving and I realized that [04:13] like yeah you had some acquisition that [04:15] happened and um by the way I did a weird [04:18] face when you said like I'm a mom. It's [04:20] just because I was expecting you were [04:21] saying like oh I have two jobs in tech [04:24] but it was not to diminish mom's job at [04:27] all like I have a lot of respect for mom [04:30] for fathers out there um I do not have [04:33] kids and there is a reasons because I [04:34] barely I I am barely able to keep myself [04:38] like as an adult uh so having to be [04:41] responsible for other people uh would be [04:43] terrible so I just have cats and it's [04:45] just enough because they're cats for me [04:47] it's good enough but huge respect for uh [04:50] all the moms out there, all the fathers, [04:53] the dads out there that it's a full-time [04:55] job. It's more than a full-time job. And [04:58] because like, you know, because we live [05:00] in a world where we need money, we also [05:02] need like a a paid job uh with most of [05:05] us working tech. So, yeah, you [05:07] definitely have like two full-time jobs. [05:09] So, uh congratulation and a lot of [05:11] respect for that. Seriously. [05:15] >> Thank you. Thank you. [05:16] >> Seriously. So um about the the tech job [05:19] so not the uh not the uh I have kids job [05:22] but u now you're uh senior developer [05:25] advocate um at improving or or uh for [05:29] cloud so what what do you say right now [05:31] like are you just saying like I work for [05:34] improving or do you say I work from m [05:37] for cloud part of improving [05:40] >> so we say we work for infraoud [05:42] technologies which is an improving [05:45] company so improving even though has [05:47] acquired us uh we still keep our name. [05:51] >> Okay. Okay. So you are a senior [05:53] developer advocate for uh M for cloud. [05:57] Uh what what does that mean? Like what's [06:00] what's your job? What are you doing? [06:02] So um my day in day out job is [06:06] definitely uh my readers whatever I work [06:11] uh with or uh the projects that I work [06:14] on they I have to make the technology [06:19] easy to understand for them like a [06:21] 5-year-old maybe you can say when you [06:23] have to explain something to them they [06:25] might come from a different background [06:27] they might come from different tech so [06:29] they have to understand the technology [06:31] And my job is to make that easier for [06:33] them just to from understanding [06:35] perspective if I have to put it in a [06:37] very simple English way. [06:39] >> Yeah. And I know that makes sense. uh I [06:41] mean that that's the job of a developer [06:43] advocate to try to you know uh get [06:46] people excited about the technology but [06:48] also help them to understand uh what are [06:50] the technology that you're talking about [06:53] and it's true like I've see sometime and [06:55] I love I love that you said like it [06:58] thinking about the fact that people have [06:59] different background which I think is [07:01] important like I see quite often talks [07:04] where like or advocates that are just [07:07] like oh I'm going to talk to developer [07:09] as if they were as experienced as me, [07:12] but like they may not have the same [07:13] experience. They may be a little more [07:15] junior. They may have more experience, [07:16] but they may also not been working in [07:19] tech for a long time. They may not know [07:20] the programming language or the [07:22] technology or the acronyms you're using. [07:25] So, I think it's great like sometimes [07:27] you can't define like, oh, this is my [07:30] target audience and this is my [07:32] expectation of you in terms of like the [07:34] knowledge that you should have to be [07:35] able to understand this. But part of her [07:38] job is to as you said kind of like [07:40] communicate about those technology to [07:43] people from different background with [07:44] different experience that need to [07:46] understand uh whatever we're talking [07:49] about. [07:50] >> Yeah. Exactly. And uh I I think uh that [07:53] has come uh that understanding I have [07:56] gained because of the kind of switches [07:59] that I made uh across my journey. So I [08:02] started my engineering in uh 2012 and [08:06] then at that time around uh uh being [08:10] women in tech was very rare in our [08:13] country and when you get such kind of [08:15] exposure uh it's it's very good it's [08:17] very energizing and uh when I started [08:20] learning few things there was something [08:22] that excited me the most which was Linux [08:25] and that's when I when I got my first [08:27] laptop uh I didn't have windows in it [08:30] and it had Ubuntu which I did not even [08:33] know how to play a video on. So you can [08:35] imagine 2012 and uh uh it was so [08:39] difficult to even get uh so me and my [08:42] brother we were the first task for us [08:44] was to figure out how to play play a VC [08:48] uh player VC media player that we used [08:50] to have back in those days and play a [08:52] video in it. So um yeah that was my [08:55] starting point in in the direction of [08:57] tech you can say and yeah the first [09:00] reaction was why did we even buy such a [09:02] thing [09:03] >> because there was [09:05] >> there's a manual out there uh at least [09:08] in 2012 that can explain tech so well [09:11] and I think if there would have been a [09:12] better developer advocate doing their [09:14] job at that time they would have [09:16] explained when you buy a Ubuntu laptop [09:18] what do you have to do okay maybe all [09:21] these things. [09:23] >> So, are you still using Linux right now [09:25] or did you change your OS? [09:28] >> No, it's it's it's been always the same. [09:30] I mean, definitely I've been given uh [09:33] Mac OS by clients and then I have to use [09:35] it, but I still have one laptop which [09:37] has it [09:40] >> any other respect for that. I I um you [09:43] know, I started my jour my journey in [09:45] tech um I'm hold way too long. it was [09:48] like um DOS or MS DOS and uh like in [09:52] proper computer and I sometime Windows [09:55] and and Linux was like for like the [09:58] ultra geek so like it was not used uh by [10:01] families but when I started in tech yeah [10:03] I moved to uh to Linux and Linux was my [10:06] main OS for many many years but at some [10:09] point a little bit like you said like I [10:10] was quote unquote forced to like with [10:13] the work laptop to either choose between [10:15] Mac OS and Windows and Um I went to Mac [10:19] OS actually I work at Microsoft before [10:21] so I had to use Windows but as and it [10:23] was during the less open era of [10:25] Microsoft but after that when I moved to [10:27] Mozilla um so I went with MacOSS and I [10:30] was like you know what I'm going to try [10:33] the uh the OS because I thought that it [10:35] was a great mix between I still have [10:37] access to the terminal so I can do like [10:39] basically I want whatever I want to do [10:41] because I'm a terminal person um I love [10:44] to to like you know that black screen [10:46] and like just or I saw your yours is [10:48] white but mine is black and like just [10:49] writing my text. Uh and I had like the [10:51] convenience of like a nice UI but it was [10:54] also at a time where like Linux was not [10:57] that friendly and two was not even a [10:59] thing. So um every time you wanted to do [11:02] something you have to recompile the [11:04] kernel and that was a pain in the ass. [11:06] But um I kind of miss a little bit my [11:08] days of Linux but right now I'm maybe [11:10] I'm a little bit lazy. I just want [11:12] things to work and and I'm just like [11:14] happy with my OS because as I said I [11:16] have some kind of like a little bit of a [11:18] boat of the best work from my point of [11:20] view like a proper UI which I don't [11:23] always like but good enough and and and [11:26] the terminal to do whatever I want to do [11:29] in every nearly every Linux comment that [11:32] I'm used to use. So that's good. Uh [11:35] there's [11:36] >> Yeah. Yeah. Go ahead. Go ahead. [11:37] >> No, no, go ahead. I was I was going in a [11:39] different direction. [11:40] >> Okay. Yes. I I you reminded me of [11:42] something of those black screens that [11:44] you're saying. So I I remember during my [11:46] college days I was exploring tech and [11:49] wanted to understand you know what what [11:51] which area I want. So I was doing [11:53] bachelor's in information technology and [11:56] I was trying to understand you know [11:57] which direction I want to pursue in. So [12:00] there was like Android Android [12:01] development that was booming at that [12:03] time and there were iOS app development [12:06] that was again booming. So there was [12:08] this one uh lab that used to happen in [12:11] our college which was for uh [12:14] understanding system administration. So [12:16] basic of Linux basic of systems like [12:19] what's a user ID, what's a system ID and [12:22] how a system works or suppose uh what [12:25] what happens if you do www. That's [12:28] that's the very simple question that [12:30] used to ask. So the kind of basic [12:32] questions uh uh they intrigued me and [12:35] that's when I started to learn these uh [12:38] bits and pieces and I stumbled upon a [12:40] project which was for setting up a mail [12:43] server. Okay. It was I think 2014 maybe [12:47] and uh when I got that project uh from [12:50] an organization it it was sort of an [12:52] internship. Uh but the we had to use a [12:56] laptop which had no UI OS. It was Debian [13:00] and only CLI and for the first time when [13:02] I saw I did not know something like this [13:04] existed also. So it was a surprise to [13:07] me. And then how a way to figure out in [13:10] that to do a Google search via command [13:12] line. [13:14] I think one of the most interesting [13:16] point in my life. [13:19] So yeah that reminded me of those days [13:21] when you have complete black screens and [13:23] you have just you you just type and do [13:25] things. [13:26] >> So yeah that that was actually a turning [13:29] point in my career. I I was pursuing [13:31] Python development also at the same time [13:34] and trying to uh understand a few things [13:36] around Django, Flax and uh see if I can [13:41] do uh do pursue that and understand [13:44] development also but then yeah I got [13:46] somehow interested in system [13:48] administration and then I pursued that [13:49] for almost three years. So from 2016 to [13:52] 2019. Yeah. Learning all about Linux [13:55] system administration, doing Red Hat [13:57] certifications, [13:59] monitoring that that was a very good [14:02] journey I must say. Yeah. [14:03] >> Yeah. And and you move uh I don't know [14:06] if it's before or after that but like uh [14:08] you were like software developer but [14:11] like at some point you move as a uh in [14:14] developer relation. What prompted the [14:16] the change from like coding full day and [14:19] uh all day long and now like having a [14:21] role that is a little more centric [14:23] around people and education. [14:26] >> Okay. So again there there is there's a [14:29] story there that's actually interesting. [14:32] Uh when yeah when um I I I was in the [14:36] system administration role uh my day out [14:40] day in dayout job used to be monitoring [14:42] of the servers. there were almost 30,000 [14:43] servers and uh monitoring was enabled. [14:46] So I used to be writing checks and all [14:49] which was again programming oriented [14:50] role uh even though it said system [14:53] administration but then uh since you [14:55] know things can come on your plate if [14:57] you grow. So I was product owner for one [15:00] of the uh products which was based on [15:03] one of the Microsoft's protocol. In fact [15:05] I think it was exchange active sync or [15:07] something around that. So I I still was [15:10] connected to development in some way and [15:12] bridging the gap between uh uh the [15:15] system administration, the back end, the [15:17] development, the UI, everything of that [15:19] product. So I was learning those things [15:21] and uh uh I I moved to a city in India [15:25] where we didn't have any IT options. So [15:28] I there was no choice for me to go to [15:30] the office in the city and um uh I I [15:33] mean my husband was hosted over there [15:36] and uh since I didn't have any options I [15:39] had to quit my role and move to that [15:41] city and I started figuring out uh ways [15:44] to keep myself connected to tech and uh [15:48] uh when I did that I uh came across a [15:51] few folks who have worked in uh course [15:54] development as in uh the courses that [15:58] people take online on any particular [16:00] domain like maybe [16:01] >> okay [16:03] so I came across those people they were [16:04] trying to develop a platform uh which uh [16:08] so this is about 2019 when there was no [16:10] term like platform engineering coined I [16:13] I got an opportunity to uh to develop [16:16] something which where these college [16:18] students can go ahead and use it as a [16:21] lab so they'll have uh they can SSH to [16:24] that server and uh so that's what the [16:26] idea I came up it so they can SSH to [16:28] that server. It was running on AWS. It [16:31] was all managed using Terraform packer [16:34] and uh the users were managed using [16:36] anible and it was giving them an [16:38] isolated environment. So all the [16:40] concepts that I had learned during my [16:42] system admin days where you can create [16:44] an isolated environment for a user. So [16:47] all the students used to get access to a [16:49] specific lab for themselves dedicated [16:52] where they can view their slides [16:55] everything CLI um uh they can view the [16:58] slides they can perform those commands [16:59] on the lab and that environment was [17:03] actually very uh lightweight so you [17:05] didn't need much of uh uh compute [17:08] resources from AWS to basically make it [17:11] run. So it used to be EC2 instances [17:12] also. So, so that that was my learning [17:16] point uh where I realized you know I [17:18] have good understanding of dev I have a [17:20] good understanding of uh programming [17:23] also um and then I uh uh I understood [17:28] that you know this is something that I [17:29] want to do but then the problem was [17:31] getting a full-time role because I moved [17:34] to a city where there's no uh no um tech [17:39] jobs available so uh I was trying to [17:42] find these remote roles and I came [17:44] across open source projects which is uh [17:47] any open source project you can say so I [17:49] I tried to contribute to uh one of them [17:53] and then I understood it's not easy [17:55] maybe your uh issue may get uh someone [17:57] can see your issue that you're fixing [17:59] someone may not so it can get it can get [18:02] complicated after some point when you [18:04] are not seen sorry I'll wait for [18:11] so I came across this internship which [18:13] is outreaching. [18:15] So uh uh I applied for that. I was very [18:18] hesitant while applying because I was [18:19] not very sure that they'll take me. But [18:22] uh they have the first round where they [18:24] talk about your journey, how you have [18:26] been treated [18:28] differently in tech and they have some [18:30] sort of questions that you have to [18:31] answer. Uh so I gave their first round. [18:34] The second round they came back saying [18:36] that you have to contribute. So these [18:38] are the list of uh open source projects [18:40] and you can contribute to any one of [18:42] them based upon your skill set. So it's [18:45] not necessary you have to be very [18:47] advanced. There were tickets I mean [18:49] there were issues that were of [18:51] preliminary level you can say get [18:52] started type of good first issues were [18:54] there in that. [18:56] >> So that was a way for sorry I'm cutting [18:58] that was a way kind of like you know [19:00] some some interview process to give you [19:02] homework to give you test to do. So that [19:05] was their equivalent but they were like [19:07] oh you need to like contribute to open [19:09] source. [19:10] >> Yeah. So there's no test. Yeah. They [19:12] they'll give you open source projects [19:14] and a list of projects. It's not [19:15] necessary that you know you have to [19:17] choose this one only. They'll give you a [19:18] list of projects [19:19] >> and uh uh you can choose from that and [19:22] there was one project called systemd in [19:24] that [19:24] >> uh system D that's that makes run [19:26] everything on Linux. [19:29] So uh while working as a system admin [19:32] that was something that I have always [19:34] used and I know there's a man page that [19:37] exist for it. So uh uh past and someday [19:41] maybe that was my dream to you know [19:43] someday write myself in a man page and I [19:47] I think I got that chance by uh um by [19:51] chance you can say and um I started [19:54] contributing to systemd and luckily I [19:57] was able to make enough contribution to [19:59] get selected. So there there were like a [20:01] bunch of people who were who selected [20:04] system D as a project. So there's a [20:05] filtering process at that round also [20:07] there there there will be couple of [20:09] people who were who will contribute to [20:11] that project. It was actually uh [20:13] overwhelming to see the kind of response [20:16] that come to open source project because [20:17] it's a paid internship out a paid [20:19] internship. So um uh people do uh [20:23] diligently participate in it and uh yeah [20:26] then I was selected and I was given a [20:28] project to fix suspend and hibernate on [20:31] Linux and uh that's when my development [20:34] journey started. So I contributed to [20:37] that project. I used to code uh mostly [20:39] at night because my son was born in that [20:42] duration early. So I used to yeah so [20:44] during the days I used to take care of [20:46] him and maybe doze off a bit when he's [20:49] sleeping and then I used to utilize [20:52] nights to contribute. I think when [20:54] GitHub sent me one year report the most [20:57] of the contributions that I had were [20:59] around one to three. [21:00] >> Oh god. [21:04] So so yeah and it was in pure C. I had [21:07] never written in PRC before but yeah so [21:10] that was very interesting learning point [21:12] and the interesting thing that Outrigi [21:15] asked me to do was whatever you have [21:17] contributed you have to write a blog out [21:19] of it. [21:20] >> So it was a development role uh even [21:23] though it was a development role it kind [21:26] of brought that writer outside and [21:30] >> yeah and I I think I used github.io only [21:33] and there they have the pages that you [21:35] can write wrote a few pages on my [21:38] project itself what project I was doing [21:40] and yeah that's how I knew that I can [21:42] write also tech so so yeah so when I [21:47] started looking for full-time employment [21:50] uh all these experiences of you know um [21:54] DevOps which was deploying instances on [21:56] AWS then system administration and then [21:59] contributing to opensource project and [22:01] writing also [22:02] actually helped but there are people who [22:05] will not treat you equally in outside. [22:07] So I was giving this um interview at one [22:11] of the companies and the HR uh wanted to [22:14] understand the kind of projects that [22:16] I've worked on and they said you know [22:18] you seem like you know you have done XY [22:21] Z things but they are not linked. So, so [22:24] I I would okay I was like okay yeah it [22:28] may be that okay that may be the case [22:30] because [22:32] um I'm applying for an application [22:34] development role so yeah definitely all [22:36] you want to talk about is application [22:38] development you don't want about system [22:39] administration [22:40] >> that's true but my projects are around [22:42] that only so that's kind of bit [22:45] complicated thing question to answer too [22:47] and then uh my recent contribution was [22:50] to system D which is again a very [22:52] hardcore development type of a project. [22:55] So definitely they those two were not [22:57] going along and uh till then I had never [23:00] heard of a role called developer [23:02] advocate. So when infraoud reached out [23:05] to me uh uh and uh they they I saw the [23:10] job posting but I never applied to it. [23:12] Okay. So when they reached out to me uh [23:15] one of the HRs that you know uh this is [23:17] the role I asked them what is the [23:18] meaning of developer advocate and then I [23:20] went back and googled also. [23:23] So uh they uh the HR explained it to me [23:26] and uh they said you know we are looking [23:29] for someone who actually ticks all the [23:31] boxes. So they have developer [23:33] experience, they have DevOps experience, [23:36] uh they have uh open source [23:38] contributions and they know how to write [23:40] or to communicate well. That's what we [23:43] are looking for. I'm like you're the [23:44] first person in the past four or five [23:46] interviews that I have given to say this [23:49] is this actually takes [23:52] everything I've done makes sense like [23:54] all together now. Yeah. [23:56] >> So yeah, I think that was 2022 and since [24:00] then I've been at In fact. So the change [24:02] the reason of the change was just you [24:04] know I was n the reason behind it was [24:06] just I was navigating cities or [24:09] navigating the phases of life like [24:11] becoming a kid. Sorry having a [24:16] >> Oh, what's happening? I think there's [24:18] some background. [24:26] There was a huge background noise. [24:28] >> Yeah. Like I didn't know what it was. [24:31] Are you okay? Everything's fine. [24:38] >> Yeah. I'll just be back. I'll turn off [24:40] my camera. Okay. [24:44] >> Hopefully everything is fine. like that [24:46] that [24:48] noise sound like a big crash or bone or [24:50] or maybe a how do you call that? I'm [24:53] looking for the word in English. Um [24:56] anyway, it doesn't matter. Uh so folks, [24:59] uh keep with us. Um I really like the [25:02] that old story. I always like to ask [25:05] folk like because most folk don't start [25:09] as developer advocate right away. So I [25:11] always like to ask like okay what's your [25:13] story? Why did you move? which is the [25:15] move that most people do most of the [25:17] time is from developer to developer [25:18] advocate. So, uh, pretty good story [25:21] here. Are you okay? Everything's fine. [25:24] >> Yeah, I can see anything and there's no [25:25] noise. Probably Yeah, something [25:29] something going wrong somewhere. [25:33] >> Oh god, [25:35] that is not what I expected. [25:38] No, [25:39] >> that sound is not uh it's frightening a [25:42] little bit. Hopefully everything's fine. [25:45] It's Mumbai. That's it's very rare to [25:48] happen something like this. [25:51] >> Yeah, usually in Mumbai it's car honk, [25:54] people honking [25:56] all the time. But you know, [25:59] >> but yeah, it's it's very late in the [26:00] night. Something like this is not [26:02] expected to happen. [26:03] >> Probably somewhere some factory or [26:05] something might have [26:07] >> there's a construction work actually [26:09] going nearby only. We have a new airport [26:12] under construction. Oh, okay. [26:14] >> So, yeah, that could be a reason [26:16] probably. Yeah. [26:18] >> Okay. Awesome. Happy to know that [26:20] everything's fine. No worries. No [26:22] worries. [26:22] >> Uh, [26:24] >> so yeah, we're telling you you've been [26:26] at uh for cloud for like 10 years. [26:29] >> No, no, the infraoud three year 2022. [26:32] >> Oh, okay. Okay. Okay. Three years. Okay. [26:34] I miss I misunderstood. I was like, wow, [26:35] that's a long three years. Still good in [26:38] tech. Uh there's a lot of people like [26:40] had the the the unfortunate uh history [26:43] of not being that long at different [26:45] companies. Most of the time was not my [26:47] fault. It was just you know it's life. [26:49] It's tech is change in the priorities [26:51] and devril may not be important anymore. [26:54] The startups run out of money. Uh so [26:57] people change jobs a little bit too [26:59] often in tech but um it's good to see u [27:02] people sticking around. So um one last [27:05] question about your job and and your [27:07] history about the job. Uh you know your [27:09] first title was uh technology evangelist [27:13] and now it is uh developer advocate or [27:16] senior developer advocate and um that [27:18] happened once in a while to folks. Uh [27:20] I'm just curious about like what prompt [27:23] uh that change in title. [27:27] >> It's just a business decision not [27:29] >> Okay. Okay. Okay. Yeah. Sometime there's [27:31] like some very valid reasons. Sometimes [27:33] it's just like okay we we'll go to trans [27:35] because when I started uh being a [27:36] developer advocate in 2011 um like the [27:42] developer advocate title I don't think [27:44] did not even exist. Uh we were all [27:47] called developer evangelist or technical [27:50] evangelist or technology evangelist. Um [27:53] I really love the word evangelist. I [27:54] know some of my colleagues didn't like [27:56] it. Uh maybe it's because I'm not [27:58] religious so I don't think it was offend [28:00] like it was not offending me but like it [28:02] was maybe offending some people uh [28:04] because like it has like some religious [28:06] connotation which I think makes sense [28:08] because like tech is is really religious [28:10] in a sense like we're not praying a god [28:12] but like we we all have like our [28:14] technology god like oh no I'm I'm an [28:16] Android person so I don't like Apple I'm [28:18] an Apple person or oh no my technology [28:20] is Ruby like I don't like PHP like we [28:23] have like like developers stick to their [28:25] own things and like it's that's the only [28:27] truth and the only technology. That [28:28] makes sense. But yeah, um after two [28:31] three jobs um the the industry move or [28:35] started to have more developer advocates [28:37] or more people doing Devril and we move [28:40] from technical evangelist or developer [28:42] evangelist to developer advocates. So [28:44] yeah and but there's still some company [28:46] that use them and and being really with [28:49] a mindset of like an evangelist going to [28:52] be more about the outreach. So creating [28:54] a lot of awareness and the developer [28:57] advocates is going to be like really an [28:59] advocate for developers like like being [29:01] that two-way street between the [29:03] developer and the company. From my point [29:05] of view, even when I had the title [29:06] evangelist, uh that was still a two-way [29:08] street like my job was always to [29:10] represent developer internally. But [29:12] anyway, now I'm just I'm just [29:13] blabbering. Um [29:15] >> no, it's it's completely fine. I think I [29:17] understand that. I I think I have seen [29:19] couple of folks I still in my network [29:21] who use chief evangelist or you know [29:23] technology evangelist as titles as [29:25] designations but at the end of the day I [29:28] I I believe that you know one must be [29:30] comfortable enough to adapt to the new [29:31] technology that's coming up because AI [29:33] has been booming like anything and uh [29:36] when it comes to tech we don't know what [29:38] will come 5 years later so as long as we [29:41] are comfortable in adapting to the new [29:43] tech we are open to understanding new [29:45] tech um yeah it should be cool ass the [29:49] the job remains the same. [29:52] >> You have to write a blog to uh make [29:54] technology easy to understand. You have [29:56] to do a video, record a video on uh [30:00] explaining how to set up this or set up [30:02] that or do go ahead do an integration or [30:06] probably contribute to an open source [30:07] project. I mean that's that's the best [30:09] way to give back to community. But yeah, [30:11] at the end of the day the job remains [30:13] the same for everyone for a for a [30:14] developer advocate. [30:16] >> No, it makes sense. Makes sense. I was [30:17] just curious because yeah, as I said [30:18] sometimes it like there is a [30:21] specific reason and not just like oh [30:23] yeah it make more sense for us to call [30:26] uh or change the name to to fit put in [30:28] more the like the industry standard. I [30:30] have one last questions and and you do [30:32] not have to answer but uh you said when [30:34] you started you know you didn't have a [30:36] lot of women in tech or or not that much [30:38] like where you live. Um [30:41] I'm not a woman. I'm a white dude. Life [30:44] is easy for me. Um, but I still feel [30:47] like the tech industry is not that [30:49] welcoming yet. It's I think it may be a [30:52] little bit better from my point of view, [30:53] but again, I'm not a woman, so I may be [30:54] wrong. But I think there's still a lot [30:55] of work to do. Um, I know it's not your [30:58] job as a woman to educate us uh men to [31:02] be better. But like if there is anything [31:04] you would like to share to to help uh [31:07] people understand like the the little or [31:09] big thing they can do to be just more [31:12] welcoming to women in tech or um that [31:15] would be [31:16] >> that would be nice but you don't have to [31:18] because I know like I don't want to put [31:20] the burden on you to educate us on that [31:23] but like if you want to um that that [31:25] could be great. Now uh so part of my [31:29] work to giving back to the community has [31:32] been around this also when I came back I [31:34] knew coming back uh I was on a maternity [31:37] break even though I was working on on [31:39] and off projects I was on a maternity [31:40] break and coming back was not easy I [31:43] think outreachy was the point that [31:44] helped me and it is run by all men most [31:47] of men most of them were men only so I'm [31:49] not going to blame a man for that [31:52] because somewhere or the other someone [31:54] is responsible for me to coming back to [31:56] And it's not about a man or a woman. [31:59] It's about uh people being open to uh uh [32:04] giving a chance to someone. And uh when [32:07] you see uh someone has been navigating [32:10] uh navigating jobs or someone has been [32:12] on a break uh uh it might not be wise to [32:16] judge them on the latest tech because in [32:19] the past 3 years or four years for which [32:22] they have been away [32:25] things could have changed right that [32:27] that could be very easily possible. So [32:30] one thing that could be done in this [32:31] direction is when they are sitting in a [32:34] panel interviewing someone who has [32:36] applied for such a role for for a role [32:39] uh I I how I learned this is uh I when I [32:43] g when I was giving infra's interview [32:45] and they asked me uh uh you know that [32:48] this is our requirement and you'll be [32:49] working on kubernetes that will be some [32:52] some tech stack which you'll be using [32:53] day in day out have you heard of it so [32:56] your next round of interview will be on [32:57] this and my reaction was Uh yes, can you [33:00] give me 15 days to come back and maybe [33:03] answer questions on that? So can the [33:05] interview be scheduled 15 days later? So [33:07] the HR said yes, we can do that. You [33:09] have not heard of the tech. I'm like I [33:10] have heard of the tech but I've never [33:12] explored before. [33:13] >> So uh that's that's good thing someone [33:16] did to me. Maybe someone can be this [33:18] open to talk about uh the opportunities [33:21] that are there and then if someone is [33:23] not aware who's giving the interview is [33:25] not aware of the tech maybe give them 15 [33:27] days and see if they are able to grasp [33:29] those things quickly that quickly [33:31] because it matters at the end of the day [33:33] you have to deliver in in in an [33:35] organization. So if you're good and 15 [33:37] days in my understanding is good enough [33:39] for anyone to understand the basics of [33:41] any concept there is so much amount of [33:43] content available out there. [33:46] So, so the content uh available around [33:50] uh us has to be improved and that's why [33:53] uh I have been part of this CNCF [33:56] community group which is women and cloud [33:57] native. Uh I've been organizer for them [34:00] for almost a year and we have been doing [34:02] sessions or tech sessions. uh we invite [34:05] uh uh uh people from all background uh [34:07] people from all community and uh we talk [34:11] about text tag we talk about demos um [34:14] and uh yeah that's what we have been [34:16] trying to do to include more people and [34:18] to make uh make women aware specifically [34:22] that you know there is so much amount of [34:23] knowledge available. So it's not about [34:25] uh uh the people on the other side [34:27] trying to do something. It's more about [34:29] women who have been outside of work or [34:31] who are not trying uh or sorry who who [34:35] who are uh not getting that much [34:37] opportunity to grow. Uh we have to make [34:40] them understand that the uh knowledge is [34:43] available out there. We just have to try [34:45] a little harder maybe uh to understand [34:47] those uh to understand those things and [34:50] uh once we do um there are people in the [34:53] community in the CNCF landscape who can [34:55] help us and uh yeah I mean you can I [35:00] think this is this is a very uh very big [35:03] accomplishment for me and for women in [35:05] cloud native is uh last year CubeCon the [35:08] co-chair for CubeCon India 2025 was [35:11] Bhavani who is an organizer for women in [35:13] cloud native and this year for CubeCon [35:15] India 2026 I have been selected. So the [35:19] uh this is what uh the message that we [35:22] want to put out there is someone who has [35:24] been on a break, someone who has been [35:25] navigating jobs, someone uh who was not [35:29] continuously there in a full-time role [35:32] can actually get such type of [35:33] opportunity if they are open to ask [35:36] questions if they are open to take help [35:39] because I've taken a lot of help and I [35:40] never uh feel embarrassed about uh uh [35:44] talking about it. I never feel Yeah. I'm [35:47] like yeah I worked on this project. I [35:49] mean this is defin definitely not [35:51] related to what I knew before. Uh but [35:54] yeah I'm not hesitant in learning new [35:56] things. So you have to learn be open to [35:58] learning new things and uh you have to [36:01] explore a bit more. There are so many [36:03] open source projects that one can [36:05] understand and contribute to. I'm not [36:07] saying it's easy but yeah it takes [36:08] effort to come back and then when if [36:11] someone for someone on the other side if [36:13] you are taking interviews yeah give them [36:15] a chance maybe 15 20 days like someone [36:18] gave it to me and when I went back I [36:21] knew I knew Kubernetes yeah so that's [36:23] that's good enough for me [36:25] >> oh that's good uh a lot of great advices [36:29] uh advices here um especially like my my [36:32] previous life before that job um I was [36:34] in the uh cloud native space And um I [36:38] know people like to say that Kubernetes [36:39] is easy but like my my premises was like [36:42] no no Kubernetes is complex. It's a [36:44] complex be. So uh like yeah give time to [36:47] people to learn. And like when you hire [36:48] someone I know you like the best case [36:51] scenario you want someone that has the [36:53] experience about the technology they're [36:55] going to use. But at the same time when [36:57] I used to hire developers I was [36:59] preferring to have someone who know how [37:02] to learn technology than someone to [37:04] learn by heart some specific technology [37:06] because who knows as you said like who [37:08] knows in like five years what's going to [37:09] happen in two years or two years who may [37:11] change their project we may work on a [37:13] new product we may change the technology [37:15] and I need someone who's able to adapt. [37:17] Uh it's great to also uh from my point [37:20] of view CNCF uh is is quite inclusive. [37:23] Uh they even had like um what is it [37:26] called deaf and hard earring hard of [37:29] hearing uh working group uh I'm hard [37:31] earring have hearing aids and I I was [37:33] like oh yeah it's rare that would like [37:35] to think about folks like me so uh now [37:38] CNCF is is uh is pretty good for that. [37:41] Uh on that note, speaking of CNCF, [37:44] uh you we we talked a lot. Uh I have the [37:48] impression that we could continue to [37:49] talk a lot, but um I think it's time for [37:51] me to tell ourselves to stop talking or [37:54] at least myself and uh move to the demo [37:57] part of the show and uh why I was [38:00] talking about CNCF is that first you are [38:02] a contributor on uh Kerno. [38:06] >> Yeah. So I continued my open source [38:07] contribution uh after systemd I joined [38:10] aka came into this role and I tried to [38:12] contribute a little bit uh to other [38:14] projects as well. So kerno has been one. [38:17] So we so like you mentioned Kubernetes [38:19] is is not easy once you understand when [38:22] once you try to understand Kubernetes [38:24] you come across the major thing that is [38:26] Kubernetes security right. So uh [38:29] Kubernetes security has has been I think [38:32] people are underestimated but if you try [38:35] to understand uh it it well I think [38:37] things can be done in that direction [38:38] from day one or like people try to call [38:41] it shift lift. So, so uh there are [38:45] things that you can do, you can [38:46] understand and one of them is uh uh one [38:49] of them is understanding [38:52] why Kubernetes security is important and [38:54] why you you need uh guard rails or [38:57] policies in place that can help you with [39:00] uh enforcing compliances and everything [39:02] in this on on a cluster or any [39:04] infrastructure. So uh uh when I started [39:08] uh exploring Kubernetes landscape that's [39:10] when uh and Kubernetes uh security [39:12] specifically I came across this project [39:15] called Kerno and uh yeah I learned that [39:18] they are very good to implement [39:19] policies. Uh I'm not promoting them. I [39:23] don't work for them. It's just that uh [39:26] >> no but I will I will I will promote [39:27] them. I mean uh Jim uh the CEO of the [39:32] company behind near nearm [39:35] the main company behind it uh who built [39:38] Kerno uh when I uh previous company I [39:40] was doing a live stream also called cube [39:42] first live and uh I had him as a guest [39:45] uh so he demoed kuberno and we were [39:48] using kerno internally so uh it's a [39:50] great product if you want to manage [39:52] security uh within your kubernetes [39:54] clusters and you want to have like an [39:57] easier way to implement policies. So, [39:59] but anyway, um this is what you're going [40:01] to talk about today. This is what you're [40:03] going to demo actually the specifically [40:05] uh you wanted to show the MCP the new [40:07] MCP server. [40:08] >> Yeah. So, let me give a brief overview [40:11] before uh uh before talking about the [40:14] Kubern MCP. So uh once you have a basic [40:17] understanding of policies like why [40:20] policies are needed on a cluster. So you [40:22] need policies just to make sure that [40:24] anyone uh so we had ourbacks before [40:26] right they existed for a reason for our [40:29] audiences role based access controls [40:31] where uh you decide or an admin decides [40:34] who gets an access to what. So suppose [40:37] you have three doors in your houses and [40:40] you want a person to get the door access [40:42] of only door one. You want B person to [40:44] get the access to door two and you want [40:46] the C person to access only door three. [40:47] You don't want the C person to access [40:49] the door one. Even though get they get [40:51] the key somehow they should not be [40:53] allowed. That should the should be the [40:55] ideal case. So Harbach used to make sure [40:58] that only C person gets into the door [41:00] three but then uh what if that C C user [41:04] got the key also to the door one. Okay. [41:07] So who will stop that person then in [41:10] that scenario in somehow in such that [41:12] scenario. So that's where the policies [41:13] actually help. You can control uh you [41:16] put another level of uh guardrail on [41:19] your cluster on or on your resources [41:22] where these policies can put a check [41:25] that if someone is even uh getting an [41:28] access they should not be able to [41:30] perform more than the privileged action [41:33] actions you can say. So uh there is this [41:36] uh field I it's very interesting I think [41:39] uh just let me tell you. Yeah. So it's [41:42] called allow privilege escalation that [41:44] you can set in on a on a pod or on a [41:47] container where uh uh your privileges [41:50] cannot go more than its parent process. [41:52] Right? So uh even though even though [41:56] somehow you got access to so your [41:58] privileges will not be more than your [42:00] more than your parent process. So these [42:02] type of uh so these type of uh [42:04] constraints can be implemented you using [42:06] the policies and you cannot uh allow [42:10] someone to run as root because that's [42:12] when that's when the major incidents [42:15] have happened in the past the security [42:17] incidents where uh if if uh someone has [42:21] gotten access to to a pod which is [42:23] running as a root they can access the [42:25] host also they can access the main [42:27] container and then they can kill some [42:29] important process also in the process. [42:31] So uh uh so policies help you uh take a [42:35] better control of your cluster and that [42:37] is why you need them in place. So Kerno [42:39] has been doing an amazing job uh they [42:41] have been releasing versions after [42:43] versions and now they came earlier they [42:45] used to have cluster policies uh where [42:47] you can uh write different rules like [42:50] validate rules, mutate rules. Uh so [42:52] validate rules a brief overview validate [42:55] rule would do like uh I am a resource [42:58] okay and this is the policy and if uh if [43:02] um if the resource is uh not adhering to [43:05] the conditions that are mentioned in the [43:07] policy in in the validator rule [43:09] specifically [43:11] then uh the resource creation will not [43:13] be allowed or it there will be a warning [43:16] when you are creating the resource okay [43:18] that you know you have not defined [43:19] suppose a CPU limit or a memory limit it [43:22] in your uh in your resource. Suppose [43:25] you're creating a pod in that scenario [43:27] in that scenario. So you would get some [43:29] sort of warning. So you'll uh uh the [43:31] admin would get to know this beforehand [43:33] okay that uh okay I'm implementing some [43:36] level of security on my cluster in this [43:39] way and uh similarly uh when it comes to [43:43] mutate rule the mutate rule what it does [43:46] is uh not only it gives you uh uh it [43:50] will let you know that your uh resource [43:51] is not adhering it will help you update [43:54] your resource also. So in the mutate [43:56] rules there will be a condition if it [43:58] matches if your resource matches with it [44:01] and it's not adhering to some of the [44:03] policies that are mentioned uh the [44:05] mutate rule will have uh the things that [44:07] are missing in your resource and it will [44:09] be appended or updated in your resource [44:12] configuration so that your resource now [44:13] adheres to the policies. So earlier they [44:16] used to have these validate rules uh [44:18] mutate rules. [44:21] Now they released uh uh with Kubernetes [44:24] advancing and Kubernetes coming up with [44:27] uh new support. [44:29] Uh Kibano launched uh different type of [44:32] policies called validating policies, [44:34] mutating policies. They uh one can check [44:36] the repository. The latest development [44:39] have been very good. I'll show one [44:40] example also. So uh let me show one [44:43] example also. Wait, let me share my [44:45] screen. [44:52] >> And during that time, I'm just going to [44:53] thank uh sponsor Tanium Z, which is my [44:57] employer. So, if you need if you're a [44:59] developer and you need a rich text [45:00] editor, need a wizawig within your [45:02] application, just a couple of couple of [45:05] line of JavaScript and you're good to [45:06] go. And just hit me up if you have any [45:08] question or concern about it. [45:11] So, [45:13] >> yeah. So uh is my screen visible? [45:15] >> Yeah. [45:16] >> Yeah. So this is one of the cluster [45:18] policies where we have written a [45:20] validate uh resource rule and in that we [45:25] are defining for a pod a condition that [45:28] C CPU and memory uh memory resource [45:31] request and memory limits are required [45:32] for containers. So we are defining a set [45:35] of conditions like this. Okay. uh where [45:38] uh you can check whether the containers [45:41] or the init containers or the ephemeral [45:43] containers have uh memory and the CPU [45:47] because at the end of the day these are [45:49] going to impact your cloud bills right [45:51] so you don't want to exhaust your [45:53] resources or you don't want to [45:54] overutilize the resources [45:57] so to avoid all those things these type [45:59] of policies can also help so this is one [46:02] of the policies uh that one can easily [46:05] uh write it's like security as a code I [46:08] I like to call it. So you can easily [46:10] write a uh a cluster policy which will [46:13] help you validate the resource. So [46:15] suppose um this is let me go back to a [46:18] polic a resource. Uh [46:22] >> this is one of the thing that I I I [46:25] didn't tell I would miss from my [46:26] Kubernetes day YAML but actually I you [46:29] miss YAML. [46:32] It's it's uh yeah, initial days it's a [46:34] little complicated complicated to get [46:36] acquainted to it, but yeah, once you get [46:38] it's good. [46:39] >> Oh yeah, I hated it at first when I I [46:41] was forced to use YAML and I hated it. [46:43] And at some point I was like, hey, you [46:45] know what? It's not that bad because you [46:46] know, I was doing JSON all the time [46:47] before. I was like there's a lot less [46:50] like like decoration around stuff and [46:53] like it's more straightforward. But it [46:54] took me a while to like it and and I but [46:57] I never thought I would say like I kind [46:59] of like miss YAML which is a weird [47:01] things for me to say but I'm looking at [47:03] it right now like like yeah I missed it [47:05] a little bit [47:07] >> but maybe you can go back. [47:10] >> So yeah so uh so the okay this uh one [47:13] has uh okay there's no limit to okay [47:17] there's a limit to it. So this is the [47:19] repository I have. I can give you the [47:21] link. I I think I missed you to give [47:22] give a link. But this is an example of [47:26] of a pod where we have not defined any [47:28] sort of limit. So if you go ahead and [47:30] create this type of pod uh Kerno will uh [47:33] uh give you a warning and will tell you [47:35] okay the pod that you are deploying does [47:38] not for does not adheres to these these [47:40] these policies which says you know you [47:42] have to have uh resource limit or memory [47:45] limit in your uh in your resource. So if [47:49] you see this um [47:53] uh the failure action that has been [47:55] mentioned over here is enforce and this [47:58] is actually aligning with uh what uh [48:03] Kubernetes has defined it. So if I go to [48:06] here I think [48:10] okay I thought I had it okay maybe [48:13] import security standards. So these [48:16] these documentations are actually very [48:18] helpful if you'll see. So uh uh one can [48:22] define whether they want to enforce a [48:25] policy or whether they want to uh uh uh [48:29] they want to audit set it on audit. [48:31] Yeah, this is the term that I was [48:32] missing. So if you if you put it on an [48:34] audit mode then in that case you'll just [48:37] get a warning. If you put it on enforce [48:40] then in that case it will not allow you [48:41] to even create that risk. the admin will [48:44] uh the user will not be able to even [48:45] create that resource on the [48:46] infrastructure. So these type of uh uh [48:49] these type of constraints uh that exist [48:51] in the policy uh will not allow you to [48:53] even create that resource. So the [48:55] policies are very easy to write but then [48:57] the problem is we talk about shifting [49:00] left and we cannot expect uh a DevOps [49:02] engineer or a platform engineer to have [49:05] uh understanding of all this from day [49:08] one. So what Kano did uh they came up [49:12] with this uh um um what do you call um [49:17] set of policies okay and these port [49:20] security standards they have already [49:22] implemented and uh they have put it in [49:26] their policies repository and in that [49:29] once you go ahead and you just uh dep uh [49:31] deploy it on your cluster. So I have put [49:33] this is what I have done uh on my uh let [49:38] me go to my terminal. Yeah. So [49:47] so I have a question for you unrelated [49:49] to all the tech stack but I had a whole [49:51] joke with my previous CEO and CTO. How [49:54] do you call the the the common line tool [49:57] that you just use? [49:59] How do you how do you say it? Uh, cube. [50:04] >> Oh, you saying it like my CEO and my CTO [50:08] were saying it and I was like, "No, [50:10] that's cubectl." And and we had a war [50:12] every live stream that we're using [50:14] cubectl or cube cuddle. Okay, that's [50:17] interesting. Okay. I was just curious. [50:19] My my my my CEO my previous CEO would [50:22] love that you said cube cuddle. [50:25] So, so if you go ahead and if you see [50:28] these cluster policies, I have not [50:31] written any one of them. So, this is [50:33] Kerno trying to uh help people shift [50:36] left. They have already written these [50:38] policies which are on based on the PSS [50:40] that I just showed and uh the bot [50:43] security standards and uh these are [50:46] already applied on the cluster that I [50:48] have. So, I what I did for the demo [50:49] purposes I have kept everything ready on [50:52] my cluster. I have uh I have installed [50:55] Kiverno and uh I have deployed these [50:58] cluster policies using the documentation [51:00] the quick start guide. Uh once you have [51:03] these policies in place uh uh one can go [51:06] ahead and apply the manifest that I [51:08] showed of a pod and they would get a [51:10] warning. Okay. But that is that is like [51:12] uh year ago approach since the AI has [51:16] advanced. Uh things have changed [51:18] definitely and Kano released their new [51:20] MCP server. uh let me give a brief uh [51:24] overview of what the MCP is. So uh if I [51:27] have to so I'm not the best person to [51:28] explain MCPS but uh let me try it. So if [51:32] if h if someone understands LLM the [51:36] large uh uh language models uh earlier [51:39] in earlier days what used to happen is [51:41] you you give a prompt and you get a [51:43] response but then in that scenario that [51:45] LLM had to uh had a limited knowledge or [51:48] they had a limited access to some tool [51:50] or someone had to spend time to figure [51:53] out how it will be LLM would be [51:55] integrated to a particular tool or to a [51:58] particular API to get the information [52:00] that the prompt that has been asked in [52:02] the prompt right so uh with with things [52:07] advancing MCP servers came in uh uh uh [52:11] the concept came which is the model [52:14] context protocol what the protocol does [52:16] is it it standardizes how the [52:18] integration will be done between the uh [52:21] LLMs and the tools out there uh which [52:25] suppose you are trying to do a Google [52:26] search not you are not trying the the [52:30] agent is trying to do with the Google [52:32] search. So in that scenario or it's [52:34] trying to access an API or it's trying [52:36] to run a command on a cluster, right? So [52:39] uh something something like that. So it [52:41] standardize the connection between the [52:43] two. So all the companies who have these [52:47] type of products they are now trying to [52:49] come up with their own MCPS where uh [52:52] users can give prompt using any agent [52:55] and uh behind the scenes the MCP server [52:58] would go the MCP server would help [53:02] standardize this process and soo the [53:04] connection. So if if I have to show you [53:07] how it's working, what I did was um I I [53:11] once I installed Kerno on this cluster. [53:14] So if I get uh yeah, so this is the the [53:19] Kerno name space where all the resources [53:21] are up and running. So in in in that uh [53:24] name space uh I I didn't have to do [53:27] anything manually. The documentation is [53:29] very straightforward. You go ahead, you [53:31] just uh install using the Helm charts [53:33] cover and then use the Helmchart again [53:36] to deploy these policies. I installed [53:38] cloud desktop which is for uh uh which [53:41] again uh an agent you can chat to it [53:43] directly and I configured in that um one [53:48] of the files which is let me remember [53:52] what it was uh yeah libraryations [53:59] yeah support [54:06] so I installed claw desktop on my system [54:08] and this is where [54:12] I configured this file. Okay. So in this [54:16] file I provided it uh the path to Kerno [54:20] MCP. So I installed Kerno MCP. It's [54:22] again a oneliner command where you can [54:24] install Kerno MCP binary on your local [54:27] machine and I gave it the path to where [54:30] my miniQ cluster is running. So all of [54:32] this I have done it on my local machine [54:34] itself. I didn't have to use a big big [54:36] server or something like that. It's just [54:37] this is for learning purposes. So, uh I [54:40] I configured this on my local machine [54:43] and the magic happened after it. [54:47] Once I saved this file, I mean this is [54:48] already uh set up on my local. I was [54:51] able to [54:54] uh interact with claude uh and I just [54:56] gave it uh get context and it was able [55:01] to identify my cluster. So if you just [55:03] wait for a few seconds. [55:06] So yeah it it asks you you know you can [55:08] allow it once or you can always allow it [55:10] and allow always allow. [55:14] So this is the cluster that I have. [55:16] Okay. I should have told that before. [55:18] Okay. So if I give uh yeah this is the [55:22] cluster. [55:23] >> Yeah. If you're new to uh Kubernetes [55:25] mini cube is is pretty good. Um I was [55:28] using key3d for reasons but mini cube is [55:31] pretty good if you want to test locally. [55:33] You don't have to pay AWS bill or any [55:36] other provider. [55:38] >> Exactly. Exactly. So yeah so this is I [55:40] had set up a mini cube cluster and on [55:43] that uh I had deployed no and these [55:46] policies. So yeah I gave uh this and [55:50] then I just showed you the repository. I [55:52] have a bunch of files over there in this [55:56] uh the resources you can say uh like a [56:00] pod or some any any resource that's not [56:02] adhering to any policy or you can say [56:04] just a pod with has which has no [56:06] limitations set. So I went ahead and I [56:08] created that on the cluster and when I [56:12] do a basic search on this that you know [56:15] uh show me the policy violations. So the [56:18] policies we are we have already seen. [56:22] Show me the policy violations. [56:26] I'll tell you the good part of this in [56:28] in a few seconds. uh the the the Kerno [56:31] has tried very in a very good way uh uh [56:34] to make uh all the platform engineers [56:36] and DevOps engineer [56:39] uh feel maybe strong you can say because [56:42] now they don't have to spend a lot of [56:44] time in figuring out the correct [56:46] policies that their resources should [56:48] adhere to in the beginning days itself. [56:50] This is actually shift lift where you [56:52] are already having a bunch of policies. [56:54] You are already having the capability to [56:56] scan those policies on your resources. [56:58] So see if I go ahead with something that [57:01] I understand very easily is running as [57:03] root. So I have four violations for [57:06] running as root. Now uh this uh uh this [57:10] MCP uh does not has much power in terms [57:14] of it cannot go ahead and perform. So [57:16] the first question that comes is when [57:18] I'm giving someone access uh uh my cube [57:20] config will it not be able to go ahead [57:22] and perform commands on my cluster? No, [57:24] you can just ask it what path do I have? [57:30] that I asked that question as the first [57:31] one. What part do I have? So, uh it it [57:36] will come back with a with a very uh [57:39] good answer. So, I can do a context [57:41] management. I can detect the policy [57:43] violation. I can apply terno policies [57:47] and scan. [57:48] >> Okay. I have documentation access but I [57:50] cannot execute direct commands or uh [57:54] view resource details. [57:56] >> Okay. So everything that that that [57:59] should not be known to any agent is [58:01] actually controlled over here by the [58:04] Kerno MCPS. So Kerno MCP. So it will not [58:08] be able to de deploy or delete any [58:10] workload or it cannot access the logs or [58:12] the events. So this is a very uh uh [58:15] secured way of setting up an AI AI tool [58:19] and I think there there is this concept [58:21] that I have talked uh I at least I've [58:23] tried to learn about it in the past is a [58:25] how one can focus on AI security and [58:29] this is one good example of it. So you [58:31] do not even allow the MCP server to have [58:33] this much level of access. So one even [58:36] if someone gets an access they will not [58:38] be able to execute these type of [58:40] commands or they'll not be able to [58:41] access the logs or the recent incident [58:44] uh that happened with one of the [58:45] organizations where uh uh someone was [58:48] able to even get the keys and uh access [58:52] to the database passwords from the logs [58:54] itself because they had some uh uh they [58:58] were able to scan the repository [59:00] repositories that were public [59:02] >> and from that they were able to reach [59:03] the keys of the cluster. [59:05] Oh sorry environment variables in the [59:07] cluster that existed. So uh yeah so u [59:11] I'm just forgetting code rabbit or [59:13] something it was I I'm not sure. Yeah [59:16] they had something they had a huge [59:18] incident some time back. So uh uh so uh [59:22] uh so this type of control is actually [59:25] very good and you can be sure that while [59:28] I'm using it I at least these are these [59:30] are the things that I can be sure of [59:32] will not be of risk. So let me go back [59:35] and show. So this this is telling that [59:39] you know you are running as root and [59:40] this is the policy that is being [59:42] violated. Now uh if I'm being very [59:44] direct or even though I'm aware of the [59:46] cuper commands of how to check I'll ask [59:48] this how to check [59:51] which resource is violating [59:57] uh [59:59] you know running as root. [60:02] Yeah, the good thing with uh [60:05] those little MM is that you can make [60:07] mistakes when you type. It will still [60:09] understand. You don't have to correct [60:11] yourself. [60:13] >> The force of habit of writing. [60:15] >> I know. No, but I was doing that at the [60:17] beginning. I was like making a typo. I [60:18] was like, I know I need to go back. And [60:20] after a while, I was like, why do I do [60:22] that? I'm just like, let's go. They will [60:24] still understand. [60:27] that that happens when you are so [60:30] accustomed to writing rightly. So uh so [60:34] yeah how is this uh Kerno getting to [60:36] know about the violations? So Kerno [60:38] creates a policy report as a resource uh [60:41] where it gathers all the uh pass the [60:44] failure. So let's get let's see one of [60:46] the policy reports. Okay. [60:50] Yeah. [60:57] So these are the policy reports. Uh you [60:59] can say even though they are UIDs, you [61:01] can see there are four fails where at [61:03] least our agent was right. It's it it [61:06] gave us the right information that you [61:08] know this particular policy has uh four [61:11] violations. Now let's go back and let's [61:14] see if we can uh okay maybe check [61:18] something else in this. So you have the [61:21] power now to actually understand which [61:24] which resource is violating what. Uh so [61:26] we got that and [61:30] let's get this one maybe. Yeah, this [61:34] one. [61:44] I don't want this. I'll go with the [61:47] default. [61:54] Cool. So if I say this uh [62:02] let's see the one that has been. [62:06] So if you see this one, this says uh [62:09] validation failure containers must drop [62:11] all capabilities. So okay this is which [62:13] policy wait I think I opened the wrong [62:16] one which we didn't wanted to discuss we [62:19] wanted to discuss run as root okay let's [62:21] go ahead that's not a problem we'll [62:22] discuss this one so uh uh this one shows [62:25] that you know what is the where is uh [62:26] where exactly the uh violation has [62:29] happened uh this is the particular uh uh [62:33] rule that has been violated [62:35] the autogen privilege escalation it does [62:38] not uh exist and for what uh resources [62:42] Let me try to find that for what parts [62:45] it has. [62:49] Okay, let's see a different report. So [62:51] if you can see this is telling us [62:52] actually for a replica set. Okay, it's [62:54] telling us for the user app. [62:57] If I get my capital gets [63:01] sorry. Yeah. So you can see for uh uh [63:05] okay it has created for this one. Yeah. [63:09] So this is the one that is being uh this [63:12] is currently violating the uh the uh [63:16] basically the kibo policy. Now um if I [63:20] go back and I ask the MCP server to give [63:23] me uh so these type of tools are not for [63:26] someone who has been so accustomed to [63:28] using CLI and running the commands and [63:30] finding things because this this [63:32] sometimes it feels like you know it's [63:34] making me uh not do the stuff which I'm [63:38] so accustomed to do because I have to go [63:40] back and ask it. I know what the answer [63:42] is. But then for someone who uh who who [63:45] is coming from a different background [63:46] like I said uh and they don't want uh to [63:49] spend so much time in understanding how [63:51] Kerno works or where the policy report [63:53] is or how the policy reports are [63:55] configured or which resources are being [63:57] impacted they can just go ahead and you [63:59] know you make use of this to [64:03] uh find it. So yeah it it has given me [64:04] even the command see okay find [64:07] deployments missing run as root. So [64:09] that's okay that's okay that's [64:11] beautiful. So it will give you all the [64:14] commands. I mean I was just thinking [64:16] what command to write you see. So it's [64:19] giving me all the deployments which [64:22] which which is actually violating the uh [64:25] run as root uh uh policy. So so uh those [64:30] are the kerno resources also. But if I [64:33] just uh I shouldn't have done that. But [64:36] yeah, their own resources are not maybe [64:38] not be adhering to all the policy. [64:40] That's [64:41] >> yeah, it makes it could make sense. [64:43] Yeah, [64:44] >> it could make sense. So, so uh this is [64:46] the default user app that I had deployed [64:48] manually myself and this is also not [64:50] adhering to uh run as root as one of the [64:53] policies. So, so yeah, so you get to [64:56] know all the resources now. You can even [64:59] ask it. Okay. So I know now okay which [65:02] resources which of my deployment or pod [65:04] is basically not following the policy. [65:07] Now how should I fix it? [65:11] And as you said, it's good to also like [65:13] cubectl is is can be complicated at the [65:16] beginning or just kubernetes like [65:17] understanding like all the pieces and [65:19] and and like most of the time I was [65:21] trying to get information from the [65:23] common line and I was not even in the [65:25] right cluster or like I forgot about the [65:28] namespace because like namespace is a [65:30] thing that you have to live with [65:32] community world but at the beginning you [65:34] always like never think about having [65:36] like dash n and it's always the default [65:38] and usually you don't have a lot of [65:40] things there because you create like [65:41] other name spaces. So having a tool like [65:43] that will help you to navigate that uh [65:46] more easily. Yeah. [65:47] >> Yeah. Because the this command that I [65:49] just typed I think uh even though I have [65:52] been using proper Kubernetes for past [65:54] three years almost I mean uh writing [65:57] this in one go would be difficult for me [65:59] also. So yeah, even I I can try make an [66:03] effort to explain to our readers the to [66:05] our viewers that you know in this here [66:07] we are getting the deployments we we [66:09] have it in J we'll get the JSON format a [66:12] means you get all the deployments [66:14] >> yeah and then uh the pipe so it's a bash [66:18] uh thing where the output of this will [66:21] be considered as an input for this and [66:23] then you use jq to basically parse [66:26] through the through the JSON and get [66:29] this particular ular index where the G [66:32] this particular run as root is not set [66:33] as true and then yeah again the output [66:36] of this is going to work as an input for [66:38] this and then you can filter this [66:39] particular thing [66:42] >> jQ is is one of the two like if you do a [66:44] lot of JSONs uh even if you're not a [66:47] terminal person jq is is your best [66:49] friend [66:50] >> exactly I think one a few of them g jq v [66:54] grep the those are some things that that [66:57] are very again reminder of my system [66:59] admin you cannot live without pipe jq [67:02] prep [67:04] they help you find command so command a [67:08] good learning of uh command line I I [67:10] think is needed that should be part of [67:12] even college education I feel like [67:14] sometimes [67:15] >> because at the end of the day you need [67:17] to figure out uh uh command lines and [67:20] then commands like this so yeah so [67:22] getting back to the demo so uh this is [67:24] the resource and when I asked uh the [67:26] clot to how to fix that particular [67:30] resource. It's it's telling me the whole [67:33] uh detail. So what policy it was [67:36] violating run as root, right? So now it [67:39] has given me the manifest which is now [67:41] updated with port level security context [67:44] where run as root is now set as true. [67:46] Okay. So uh and it's passing all the [67:50] different other uh parameters. So [67:52] container level security it is [67:53] implementing. So this is giving all the [67:56] examples that one needs to uh update and [67:59] it's even giving the direct command to [68:02] patch it. So you don't have to go ahead [68:04] and uh you know open your manifest or if [68:06] you're using VS code you have to go [68:08] ahead update that file and then you know [68:10] apply that file again. It will give you [68:13] one cube cuttle command directly where [68:15] you can patch the deployment and uh it's [68:17] giving all the information that's [68:19] needed. So it's it's making the job [68:21] easier. It's when we uh when we uh say [68:24] we should focus on shift left when it [68:26] comes to security sorry uh when it comes [68:29] to security this is actually shift lift [68:31] uh which is going to uh save the [68:34] developers time or that the devops [68:36] engineers time to let them focus on the [68:39] essential stuff and these are the basic [68:41] stuff that can get covered in the [68:42] process. Yeah. [68:43] >> Yeah. No, makes sense and because he has [68:46] access to your cube config because you [68:49] could probably try to replicate that by [68:51] copy pasting YAML file to like and they [68:55] give you answer and you have to do a lot [68:56] of manual things but now you give them [68:58] access directly to your cluster and uh [69:01] it's it's so much more straightforward [69:03] and and you don't have to look about [69:05] what you're looking for because if you [69:07] don't know what you're looking for like [69:09] it's it's just like the the the number [69:12] of YAML files [69:14] and and type of resources in a cluster [69:17] >> one or two [69:19] cluster resources there are like [69:20] hundreds of them so definitely uh when [69:23] one has to scale this is a big problem I [69:26] understand that and that's why Kerno has [69:28] come up with something because they want [69:29] to strengthen the devops engineers they [69:32] want to provide them with the with such [69:34] type of tools uh uh that can help them [69:37] enhance the security on their cluster [69:39] and they don't have to spend more time [69:40] in figuring out you know which resources [69:43] is uh uh which resource is not adhering [69:45] to this policy or uh which resource uh [69:49] uh if they are writing a news resource [69:51] then in that scenario what policies they [69:53] have to make sure that are being [69:54] adherred to. So all these type of things [69:56] are definitely going to help. Yeah. [69:59] >> Awesome. [70:00] >> Short but yeah I hope I was able to [70:02] cover it in the time. [70:04] >> Yeah. No no no that's pretty good. Um as [70:07] I tell people the length or my guest the [70:10] length of the show depend on the guest. [70:12] So, um I mean sometimes it's shorter, [70:15] sometimes longer. As long as you're [70:16] having fun talking about the topic, uh [70:19] I'm good and I think you had fun and I [70:22] had fun and hopefully the people [70:23] listening to us are watching the [70:24] recording. Uh we'll learn some new [70:27] stuff. I didn't know about uh the I know [70:29] about Kerno. I didn't know about the the [70:31] MCP, the the newish project that had. [70:34] So, uh it was pretty interesting. Thanks [70:36] for sharing that with us. And on that [70:38] note, I think I'm going to let you go [70:40] because it's close to 3:00 a.m. for you. [70:42] But uh seriously, thanks a lot for your [70:44] time. Thanks, uh for being on the show. [70:46] Uh that was a pleasure to have you and [70:50] uh hopefully the construction is going [70:52] well uh for your report and it's not uh [70:55] disrupting the sleep of uh of your [70:57] people with the big noise. [71:02] Yeah, if you can cut that part [71:05] because it's for a second I felt like [71:06] then that there is some terror attack [71:08] happening but then I suddenly remembered [71:10] that there's an airport construction. [71:12] It's almost 2 km from here but yeah it's [71:15] happened. [71:15] >> Yeah know it felt like it was uh like an [71:18] attack or something. I was like oh [71:20] I hope I be safe but uh it was the case. [71:23] So um thanks again for being my guest. [71:25] It was a real pleasure for having you. [71:27] Thanks for uh being the guest on the [71:29] last show of 2025. Do not worry folks uh [71:33] we will be back in 2026 the second week [71:35] if I'm not wrong of January. Uh so I [71:39] will be back and thanks for the people [71:41] who are live. Uh you are a little bit [71:43] silent today. Always feel free to ask [71:45] questions or at least uh leave comments [71:48] or just say hi. It's always appreciated. [71:50] And also thanks for the people watching [71:52] the recording. And I know I'm really [71:54] hurly about that, but uh because that's [71:57] the last show of the year, I wish you uh [72:00] you know a good holiday season uh either [72:03] you're uh like celebrating Christmas or [72:05] NA or whatever you're celebrating. I [72:08] wish you a good time hopefully with a [72:10] lot of love and friends and family. Uh [72:14] if it's your thing, if you prefer to [72:15] stay alone, hopefully you're going to be [72:16] able to stay alone if it's your thing. [72:19] But uh see you in uh next year for next [72:22] episode of the Devil Show. [72:25] >> Yeah. [72:25] >> Bye everyone. [72:27] >> Bye everyone.  ## 📺 Video ![](https://www.youtube.com/watch?v=F_NNue6n3dY) --- # 📝 Full Notes (Deep-Read Analysis) # 🏷️ Title: DevRel Show Episode 42 - Sonali Srivastava on Kubernetes Security & Career Journey ## 🧰 Action Inbox - [H1] Explore Kyverno's new MCP server integration for policy management — 33:45 #kubernetes #security - [H2] Consider implementing CNCF Women in Cloud Native community programs — 25:30 #community #inclusion - [H3] Research Outreachy internship opportunities for career transitions — 18:22 #open-source #career-development ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [Kyverno Project](https://kyverno.io) - [Outreachy Internships](https://outreachy.org) ## 📝 Summary - DevRel Show episode featuring Sonali Srivastava discussing her journey from system administration to developer advocacy - Focus on Kyverno's new MCP server for Kubernetes security policy management - Key themes: career transitions, women in tech challenges, open source contributions, and AI-enhanced security tools - Practical demonstration of policy validation using Kyverno with LLM integration - Emphasis on community support and inclusive hiring practices in tech ## 📖 Main Content Sonali Srivastava shares her unconventional path to developer relations, starting with Linux system administration and progressing through DevOps, open source contributions, and finally landing in developer advocacy at InfraCloud Technologies. Her story illustrates the challenges women face in tech careers, particularly during life transitions like motherhood. The technical focus centers on Kyverno, a Kubernetes security policy management tool that helps implement guardrails and compliance rules. The new Model Context Protocol (MCP) server integration allows users to interact with policy violations through natural language queries, making Kubernetes security more accessible to platform engineers and developers. Key insights include the importance of giving candidates time to learn new technologies during interviews, the value of open source contributions for career transitions, and the role of community organizations like CNCF Women in Cloud Native in supporting underrepresented groups. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/F_NNue6n3dY?t=0) — Episode Introduction and Format Changes - Key idea: DevRel Show episode 42, last show of 2025 due to holiday schedule - Evidence: "I have guests for the next about two years, I think, if I do a show every two weeks" #### ⏱️ [02:30](https://youtu.be/F_NNue6n3dY?t=150) — Sonali's Dual Roles - Key idea: Balancing motherhood and senior developer advocacy positions - Evidence: "I am currently having two full-time roles. The first one is I'm a mother... And the other one is as a senior developer advocate at InfraCloud Technologies" #### ⏱️ [04:15](https://youtu.be/F_NNue6n3dY?t=255) — Developer Advocacy Role Definition - Key idea: Making technology accessible to people from different backgrounds - Evidence: "My job is to make that easier for them from understanding perspective if I have to put it in a very simple English way" #### ⏱️ [05:45](https://youtu.be/F_NNue6n3dY?t=345) — Early Linux Experience - Key idea: Started with Ubuntu in 2012, struggled with basic tasks like playing videos - Evidence: "First task for us was to figure out how to play a VLC media player... and play a video in it" #### ⏱️ [09:30](https://youtu.be/F_NNue6n3dY?t=570) — System Administration Career - Key idea: Transitioned from Python development to Linux system administration - Evidence: "I pursued that for almost three years. So from 2016 to 2019... monitoring of the servers, there were almost 30,000 servers" #### ⏱️ [12:45](https://youtu.be/F_NNue6n3dY?t=765) — Career Transition Challenges - Key idea: Geographic relocation forced career change and remote work exploration - Evidence: "I moved to a city in India where we didn't have any IT options... I had to quit my role" #### ⏱️ [15:20](https://youtu.be/F_NNue6n3dY?t=920) — Platform Engineering Before the Term - Key idea: Built educational lab platform using AWS, Terraform, and Ansible - Evidence: "This is about 2019 when there was no term like platform engineering coined... giving them an isolated environment" #### ⏱️ [18:22](https://youtu.be/F_NNue6n3dY?t=1102) — Outreachy Internship Experience - Key idea: Contributing to systemd project while caring for newborn - Evidence: "I was selected and I was given a project to fix suspend and hibernate on Linux... I used to code mostly at night because my son was born" #### ⏱️ [21:15](https://youtu.be/F_NNue6n3dY?t=1275) — Discovering Developer Advocacy - Key idea: First company to recognize diverse skill set as valuable - Evidence: "You're the first person in the past four or five interviews... to say this actually takes everything I've done makes sense" #### ⏱️ [25:30](https://youtu.be/F_NNue6n3dY?t=1530) — Women in Tech Support Systems - Key idea: Importance of giving candidates time to learn and adapt - Evidence: "Can you give me 15 days to come back and maybe answer questions on that?... The HR said yes, we can do that" #### ⏱️ [28:45](https://youtu.be/F_NNue6n3dY?t=1725) — CNCF Community Leadership - Key idea: Women in Cloud Native community creating opportunities - Evidence: "This year for KubeCon India 2026 I have been selected [as co-chair]" #### ⏱️ [33:45](https://youtu.be/F_NNue6n3dY?t=2025) — Kubernetes Security Fundamentals - Key idea: Policies provide additional guardrails beyond RBAC - Evidence: "That's where the policies actually help. You put another level of guardrail on your cluster" #### ⏱️ [36:20](https://youtu.be/F_NNue6n3dY?t=2180) — Kyverno Policy Types - Key idea: Validate rules warn about violations, mutate rules automatically fix them - Evidence: "Validate rule would do like... the resource creation will not be allowed... mutate rule will help you update your resource also" #### ⏱️ [40:15](https://youtu.be/F_NNue6n3dY?t=2415) — MCP Server Integration - Key idea: Model Context Protocol standardizes LLM tool integration - Evidence: "It standardizes how the integration will be done between the LLMs and the tools out there" ## 📚 References - [Kyverno Official Documentation](https://kyverno.io) - [Outreachy Internship Program](https://outreachy.org) - [CNCF Women in Cloud Native](https://community.cncf.io/cloud-native-community-women/) - [Kubernetes Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) ## 🗣️ Paraphrase - Sonali's journey demonstrates how diverse technical experience can converge into developer advocacy roles that value breadth over specialization - Kubernetes security requires layered approaches beyond RBAC, with policies providing essential guardrails for production environments - The integration of AI through MCP servers makes complex security tools more accessible to platform engineers without deep policy expertise ## 📰 Newsletter 🚀 **Making Kubernetes Security Accessible Through AI** This week's DevRel Show featured an inspiring conversation with Sonali Srivastava about her journey from system administration to developer advocacy, with a fascinating demo of Kyverno's new AI integration. **Key Takeaway**: The new Model Context Protocol (MCP) server for Kyverno transforms how we interact with Kubernetes security policies. Instead of deciphering YAML configurations, platform engineers can now ask natural language questions about policy violations and get actionable insights. **Why This Matters**: As Kubernetes adoption grows, security complexity increases. Tools that bridge the gap between security best practices and developer experience are crucial for sustainable platform engineering. **Try It Yourself**: Start with Kyverno's Pod Security Standards policies on a local minikube cluster, then explore the MCP server integration with Claude Desktop. Resources: [Kyverno Documentation](https://kyverno.io), [MCP Server Setup](https://github.com/kyverno/kyverno), [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) ## ✅ Action Items #### Community - Research CNCF Women in Cloud Native programs for inclusive community building - Explore Outreachy internship mentorship opportunities - Implement inclusive interview practices allowing learning time #### Kubernetes - Evaluate Kyverno for policy management and security guardrails - Test MCP server integration for improved developer experience - Document policy-as-code approaches for security compliance - Create learning resources for Kubernetes security fundamentals #### DevRel - Developer experience: Improve onboarding documentation for complex tools - Education: Create beginner-friendly security content - Community management: Support underrepresented groups in tech transitions ## 🧪 Hypotheses - AI integration through MCP servers reduces barriers to Kubernetes security adoption - Diverse career backgrounds create stronger developer advocates than traditional linear paths - Flexible interview processes improve diversity in technical hiring - Community support systems significantly impact career transition success ### 📊 Methodology - Compare policy adoption rates before and after MCP integration - Survey developer advocates on career path diversity and effectiveness - Measure hiring diversity metrics with flexible vs. rigid interview timelines ### ❓ Questions - How does MCP server integration affect policy compliance rates in production clusters? - What specific support structures most effectively help career transitions in tech? - How can organizations better recognize and value non-linear technical experience? ### 🔮 Future Research - Long-term impact of AI-assisted security tools on platform engineering practices - Effectiveness of community-driven support programs for underrepresented groups - Evolution of developer advocacy skill requirements with AI integration ### 💡 Implications - Practice: AI integration makes complex tools more accessible to broader audiences - Policy: Inclusive hiring practices require rethinking traditional technical assessments - Security: Natural language interfaces reduce friction in security tool adoption - Education: Career transition stories provide valuable learning resources - Community: Structured support programs create measurable impact on diversity ### 🧠 Learning Styles Assessment Reading level estimate: Flesch-Kincaid Grade 10 #### 👀 Visual learners - Present: Screen sharing of Kyverno policies, terminal commands, cluster configurations - Improve: Architecture diagrams showing MCP integration, policy flow visualizations #### 🔊 Aural learners - Present: Live conversation format, detailed explanations of technical concepts - Improve: Audio summary of key technical concepts, recorded policy examples #### 🗣️ Verbal learners - Present: Story-driven career narrative, analogies (door access for RBAC), technical definitions - Improve: Glossary of Kubernetes security terms, comparison tables #### 🧩 Kinesthetic learners - Present: Live demonstration of policy creation, hands-on terminal usage - Improve: Step-by-step setup guide, reproducible minikube environment #### 🧠 Logical learners - Present: Technical progression from RBAC to policies, systematic problem-solving approach - Improve: Decision tree for policy types, security maturity framework #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion format, emphasis on mentorship and support networks - Improve: Discussion prompts about career transitions, community resource lists #### 🧘‍♀️ Solitary learners - Present: Individual career reflection points, self-directed learning emphasis - Improve: Self-assessment questions, independent study materials #### 🌿 Naturalistic learners - Present: Growth metaphors in career development, ecosystem thinking about tech communities - Improve: Career development lifecycle analogies, community ecosystem mapping ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear verbal descriptions of visual demonstrations - Improve: Alt text for code examples, structured headings for navigation #### Keyboard navigation - Present: Terminal-based demonstrations accessible via keyboard - Improve: Keyboard shortcuts documentation, screen reader friendly code blocks #### Contrast and readability - Present: High contrast terminal display, clear code formatting - Improve: Consistent color coding, larger text options #### Text resizing and reflow - Present: Standard video player controls support zoom - Improve: Transcript formatting that reflows properly #### Media and captions - Present: Live conversation with clear audio - Improve: Auto-generated captions review, downloadable transcript #### Forms and interactions - Present: Simple command-line interactions - Improve: Alternative input methods documentation ### 🌍 DEIB Assessment #### Cultural breadth - Present: Indian perspective on tech career challenges, global remote work discussion - Improve: More diverse geographic examples, cross-cultural career transition stories #### Inclusive language - Present: Gender-neutral technical terms, clear jargon definitions - Improve: Plain language summaries, avoid cultural idioms #### Neurodiversity support - Present: Step-by-step technical demonstration, structured conversation flow - Improve: Content warnings for sudden loud noises, predictable format #### Representation - Present: Women in tech leadership discussion, motherhood in tech careers - Improve: Broader identity representation, intersectional perspectives #### Psychological safety - Present: Respectful discussion of challenges, supportive community framing - Improve: Content warnings for career stress discussion, resource links ### ✅ Logical Validity #### Strong reasoning - Deductive strength: "Policies needed because RBAC has limitations" → Clear logical progression - Inductive strength: Personal experience generalizes to broader hiring practices - Causal reasoning: Community support leads to career success with evidence - Analogical strength: Door access analogy for RBAC concepts effective #### Fallacies - Hasty generalization: Single positive hiring experience doesn't guarantee universal applicability - Anecdotal evidence: Career success story doesn't prove general patterns #### Tone of voice - Overall tone: Conversational, supportive, technically informed with personal vulnerability ### 🛡️ DARVO Analysis - Deny: No defensive patterns observed - Attack: No attacks on questioners or critics present - Reverse victim/offender: No victim/offender reversals identified - Emotional cues and rhetoric: Positive, solution-focused discussion throughout ## 🎯 Conclusion This episode demonstrates how diverse technical backgrounds strengthen developer advocacy while showcasing practical AI integration in Kubernetes security tools. Sonali's journey illustrates the importance of inclusive hiring practices and community support systems for career transitions. The Kyverno MCP server represents a significant step toward making complex security tools accessible through natural language interfaces, potentially accelerating adoption of security best practices in cloud-native environments. ## 🧱 Refactor Appendix ### 📚 Literature Split Pad ### [H1] AI integration reduces Kubernetes security barriers > [!quote] [DevRel Show Episode 42](https://youtu.be/F_NNue6n3dY) by --- # 📄 Full Transcript *Auto-generated from YouTube captions · timestamps roughly every 30 seconds · [watch on YouTube](https://www.youtube.com/watch?v=F_NNue6n3dY)* **[00:03]** [music] Heat. Heat. [music] >> [music] [music] >> Hello, hello lovely people. Welcome to **[00:35]** another episode of the Devil Show. This is episode 42 which is crazy. I can't believe it's been 42 episode that I'm doing of the Devil Show. still always happy, always excited to be here to do the show with amazing folks, amazing guests. Um, with that said, you may have noticed, I think I warned you like it's not every other week like it used to be. It's mostly every other week, but because I started to travel again and go to events, it's a little more difficult to do the show as I used to do it. But **[01:05]** I'm still continue to do it. I have guests for the next about two years, I think. uh if I do a show every two weeks, I have a pretty good wait list uh for uh the next shows. With that said though, it is the last show of 2025 uh because you know after that that's going to go something around like actually the 25 on Christmas uh everybody's off. It's Christmas. You don't want to see my face on Christmas day. So that's going to be the last show of the year and I will come back at the **[01:35]** uh beginning of January. If I'm not wrong, I think the first show is going to be in the eight if I'm not mistaken. Uh the first show of 2026. So with that said, super happy to be here. Hello, Anush. It's been a while. Miss you, my friend. So, uh thanks for being here and um super happy I'm finishing that year strong with my guest today. Sonali, how are you? >> Hi, I'm good. Thank you for having me, Fred. >> Thanks. Thanks for being here. Uh, it's a pleasure to have you, especially **[02:07]** because, uh, from my point of view, it's way too late for you to be on a live stream. I think it's like something like 1:00 a.m. for you. Uh, which I need to tell people listening, I offered her to put it like like earlier, it was better for her time zone, but she was like, "No, I'm used to it. It's fine." So, I mean, you're good. I'm not able maybe I'm too old. I'm just not able to like do a live stream or give a talks at one. I did it once. um in a hackathon. Uh it was even in person so I should have been **[02:38]** more energized but you know it was those kind of you know all like 24 hours 48 hours hackathon and my talk about the technology. I was at Fitbit at the time. My talk was at 2 a.m. That was the worst talk I've ever given. Like I was so tired. I was blabbering. I did not know my technology at all. Like I like at that time I was working at Fitbit for a year so I know the Fitbit SDK. But that talk was terrible. I was just not there anymore. I'm not a nightly person. Like I go to bed at 10, 11 and like that's **[03:10]** the maximum. So anyway, thanks for being in the show. Uh so late right now. Uh so I will go with my first question I have for every guest. Please please let us know who you are. Who are you? >> So yeah, thank you for introducing me and uh I am Sunalis Shavasta. I am currently having two full-time roles. Okay. So, the first one is I'm a mother. Okay. So, that explains why I can stay awake at one or maybe I can stay awake **[03:42]** at whatever time my client expects me to, you can say. So, yeah, I'm a mom. That's my full-time role. And the other one is uh as a senior developer advocate at Infraoud Technologies which has been recently acquired by improving. Oh, that made more sense. So two things because I was looking at your LinkedIn and I was like I'm pretty sure I did the promotion about cloud but when I went on LinkedIn I was like oh my god no she's working and proving and I realized that **[04:13]** like yeah you had some acquisition that happened and um by the way I did a weird face when you said like I'm a mom. It's just because I was expecting you were saying like oh I have two jobs in tech but it was not to diminish mom's job at all like I have a lot of respect for mom for fathers out there um I do not have kids and there is a reasons because I barely I I am barely able to keep myself like as an adult uh so having to be responsible for other people uh would be **[04:43]** terrible so I just have cats and it's just enough because they're cats for me it's good enough but huge respect for uh all the moms out there, all the fathers, the dads out there that it's a full-time job. It's more than a full-time job. And because like, you know, because we live in a world where we need money, we also need like a a paid job uh with most of us working tech. So, yeah, you definitely have like two full-time jobs. So, uh congratulation and a lot of respect for that. Seriously. **[05:15]** >> Thank you. Thank you. >> Seriously. So um about the the tech job so not the uh not the uh I have kids job but u now you're uh senior developer advocate um at improving or or uh for cloud so what what do you say right now like are you just saying like I work for improving or do you say I work from m for cloud part of improving >> so we say we work for infraoud technologies which is an improving company so improving even though has **[05:47]** acquired us uh we still keep our name. >> Okay. Okay. So you are a senior developer advocate for uh M for cloud. Uh what what does that mean? Like what's what's your job? What are you doing? So um my day in day out job is definitely uh my readers whatever I work uh with or uh the projects that I work on they I have to make the technology **[06:19]** easy to understand for them like a 5-year-old maybe you can say when you have to explain something to them they might come from a different background they might come from different tech so they have to understand the technology And my job is to make that easier for them just to from understanding perspective if I have to put it in a very simple English way. >> Yeah. And I know that makes sense. uh I mean that that's the job of a developer advocate to try to you know uh get people excited about the technology but also help them to understand uh what are **[06:50]** the technology that you're talking about and it's true like I've see sometime and I love I love that you said like it thinking about the fact that people have different background which I think is important like I see quite often talks where like or advocates that are just like oh I'm going to talk to developer as if they were as experienced as me, but like they may not have the same experience. They may be a little more junior. They may have more experience, but they may also not been working in tech for a long time. They may not know **[07:20]** the programming language or the technology or the acronyms you're using. So, I think it's great like sometimes you can't define like, oh, this is my target audience and this is my expectation of you in terms of like the knowledge that you should have to be able to understand this. But part of her job is to as you said kind of like communicate about those technology to people from different background with different experience that need to understand uh whatever we're talking about. >> Yeah. Exactly. And uh I I think uh that **[07:53]** has come uh that understanding I have gained because of the kind of switches that I made uh across my journey. So I started my engineering in uh 2012 and then at that time around uh uh being women in tech was very rare in our country and when you get such kind of exposure uh it's it's very good it's very energizing and uh when I started learning few things there was something that excited me the most which was Linux **[08:25]** and that's when I when I got my first laptop uh I didn't have windows in it and it had Ubuntu which I did not even know how to play a video on. So you can imagine 2012 and uh uh it was so difficult to even get uh so me and my brother we were the first task for us was to figure out how to play play a VC uh player VC media player that we used to have back in those days and play a video in it. So um yeah that was my **[08:55]** starting point in in the direction of tech you can say and yeah the first reaction was why did we even buy such a thing >> because there was >> there's a manual out there uh at least in 2012 that can explain tech so well and I think if there would have been a better developer advocate doing their job at that time they would have explained when you buy a Ubuntu laptop what do you have to do okay [laughter] maybe all these things. >> So, are you still using Linux right now or did you change your OS? **[09:28]** >> No, it's it's it's been always the same. I mean, definitely I've been given uh Mac OS by clients and then I have to use it, but I still have one laptop which has it >> any other respect for that. I I um you know, I started my jour my journey in tech um I'm hold way too long. it was like um DOS or MS DOS and uh like in proper computer and I sometime Windows and and Linux was like for like the **[09:58]** ultra geek so like it was not used uh by families but when I started in tech yeah I moved to uh to Linux and Linux was my main OS for many many years but at some point a little bit like you said like I was quote unquote forced to like with the work laptop to either choose between Mac OS and Windows and Um I went to Mac OS actually I work at Microsoft before so I had to use Windows but as and it was during the less open era of Microsoft but after that when I moved to Mozilla um so I went with MacOSS and I **[10:30]** was like you know what I'm going to try the uh the OS because I thought that it was a great mix between I still have access to the terminal so I can do like basically I want whatever I want to do because I'm a terminal person um I love to to like you know that black screen and like just or I saw your yours is white but mine is black and like just writing my text. Uh and I had like the convenience of like a nice UI but it was also at a time where like Linux was not that friendly and two was not even a thing. So um every time you wanted to do **[11:02]** something you have to recompile the kernel and that was a pain in the ass. But um I kind of miss a little bit my days of Linux but right now I'm maybe I'm a little bit lazy. I just want things to work and and I'm just like happy with my OS because as I said I have some kind of like a little bit of a boat of the best work from my point of view like a proper UI which I don't always like but good enough and and and the terminal to do whatever I want to do in every nearly every Linux comment that I'm used to use. So that's good. Uh **[11:35]** there's >> Yeah. Yeah. Go ahead. Go ahead. >> No, no, go ahead. I was I was going in a different direction. >> Okay. Yes. I I you reminded me of something of those black screens that you're saying. So I I remember during my college days I was exploring tech and wanted to understand you know what what which area I want. So I was doing bachelor's in information technology and I was trying to understand you know which direction I want to pursue in. So there was like Android Android development that was booming at that time and there were iOS app development **[12:06]** that was again booming. So there was this one uh lab that used to happen in our college which was for uh understanding system administration. So basic of Linux basic of systems like what's a user ID, what's a system ID and how a system works or suppose uh what what happens if you do www. That's that's the very simple question that used to ask. So the kind of basic questions uh uh they intrigued me and that's when I started to learn these uh **[12:38]** bits and pieces and I stumbled upon a project which was for setting up a mail server. Okay. It was I think 2014 maybe and uh when I got that project uh from an organization it it was sort of an internship. Uh but the we had to use a laptop which had no UI OS. It was Debian and only CLI and for the first time when I saw I did not know something like this existed also. So it was a surprise to me. And then how a way to figure out in **[13:10]** that to do a Google search via command line. [laughter] I think one of the most interesting point in my life. So yeah that reminded me of those days when you have complete black screens and you have just you you just type and do things. >> So yeah that that was actually a turning point in my career. I I was pursuing Python development also at the same time and trying to uh understand a few things around Django, Flax and uh see if I can **[13:41]** do uh do pursue that and understand development also but then yeah I got somehow interested in system administration and then I pursued that for almost three years. So from 2016 to 2019. Yeah. Learning all about Linux system administration, doing Red Hat certifications, monitoring that that was a very good journey I must say. Yeah. >> Yeah. And and you move uh I don't know if it's before or after that but like uh you were like software developer but **[14:11]** like at some point you move as a uh in developer relation. What prompted the the change from like coding full day and uh all day long and now like having a role that is a little more centric around people and education. >> Okay. So again there there is there's a story there that's actually interesting. Uh when yeah when um I I I was in the system administration role uh my day out day in dayout job used to be monitoring **[14:42]** of the servers. there were almost 30,000 servers and uh monitoring was enabled. So I used to be writing checks and all which was again programming oriented role uh even though it said system administration but then uh since you know things can come on your plate if you grow. So I was product owner for one of the uh products which was based on one of the Microsoft's protocol. In fact I think it was exchange active sync or something around that. So I I still was connected to development in some way and **[15:12]** bridging the gap between uh uh the system administration, the back end, the development, the UI, everything of that product. So I was learning those things and uh uh I I moved to a city in India where we didn't have any IT options. So I there was no choice for me to go to the office in the city and um uh I I mean my husband was hosted over there and uh since I didn't have any options I had to quit my role and move to that city and I started figuring out uh ways **[15:44]** to keep myself connected to tech and uh uh when I did that I uh came across a few folks who have worked in uh course development as in uh the courses that people take online on any particular domain like maybe >> okay so I came across those people they were trying to develop a platform uh which uh so this is about 2019 when there was no term like platform engineering coined I I got an opportunity to uh to develop **[16:16]** something which where these college students can go ahead and use it as a lab so they'll have uh they can SSH to that server and uh so that's what the idea I came up it so they can SSH to that server. It [snorts] was running on AWS. It was all managed using Terraform packer and uh the users were managed using anible and it was giving them an isolated environment. So all the concepts that I had learned during my system admin days where you can create an isolated environment for a user. So **[16:47]** all the students used to get access to a specific lab for themselves dedicated where they can view their slides everything CLI um uh they can view the slides they can perform those commands on the lab and that environment was actually very uh lightweight so you didn't need much of uh uh compute resources from AWS to basically make it run. So it used to be EC2 instances also. So, so that that was my learning point uh where I realized you know I **[17:18]** have good understanding of dev I have a good understanding of uh programming also um and then I uh uh I understood that you know this is something that I want to do but then the problem was getting a full-time role because I moved to a city where there's no uh no um tech jobs available so uh I was trying to find these remote roles and I came across open source projects which is uh any open source project you can say so I **[17:49]** I tried to contribute to uh one of them and then I understood it's not easy maybe your uh issue may get uh someone can see your issue that you're fixing someone may not so it can get it can get complicated after some point when you are not seen sorry I'll wait for so I came across this internship which is outreaching. So uh uh I applied for that. I was very hesitant while applying because I was **[18:19]** not very sure that they'll take me. But uh they have the first round where they talk about your journey, how you have been treated differently in tech and they have some sort of questions that you have to answer. Uh so I gave their first round. The second round they came back saying that you have to contribute. So these are the list of uh open source projects and you can contribute to any one of them based upon your skill set. So it's not necessary you have to be very advanced. There were tickets I mean there were issues that were of **[18:51]** preliminary level you can say get started type of good first issues were there in that. >> So that was a way for sorry I'm cutting that was a way kind of like you know some some interview process to give you homework to give you test to do. So that was their equivalent but they were like oh you need to like contribute to open source. >> Yeah. So there's no test. Yeah. They they'll give you open source projects and a list of projects. It's not necessary that you know you have to choose this one only. They'll give you a list of projects >> and uh uh you can choose from that and **[19:22]** there was one project called systemd in that >> uh system D that's that makes run everything on Linux. So uh while working as a system admin that was something that I have always used and I know there's a man page that exist for it. So uh uh past and someday maybe that was my dream to you know someday write myself in a man page and I I think I got that chance by uh um by chance you can say and um I started **[19:54]** contributing to systemd and luckily I was able to make enough contribution to get selected. So there there were like a bunch of people who were who selected system D as a project. So there's a filtering process at that round also there there there will be couple of people who were who will contribute to that project. It was actually uh overwhelming to see the kind of response that come to open source project because it's a paid internship out a paid internship. So um uh people do uh diligently participate in it and uh yeah **[20:26]** then I was selected and I was given a project to fix suspend and hibernate on Linux and uh that's when my development journey started. So I contributed to that project. I used to code uh mostly at night because my son was born in that duration early. So I used to yeah so during the days I used to take care of him and maybe doze off a bit when he's sleeping and then I used to utilize nights to contribute. I think when GitHub sent me one year report the most **[20:57]** of the contributions that I had were around one to three. >> Oh god. [laughter] So so yeah and it was in pure C. I had never written in PRC before but yeah so that was very interesting learning point and the interesting thing that Outrigi asked me to do was whatever you have contributed you have to write a blog out of it. >> So it was a development role uh even though it was a development role it kind of brought that writer outside and **[21:30]** >> yeah and I I think I used github.io only and there they have the pages that you can write wrote a few pages on my project itself what project I was doing and yeah that's how I knew that I can write also tech [snorts] so so yeah so when I started looking for full-time employment uh all these experiences of you know um DevOps which was deploying instances on AWS then system administration and then contributing to opensource project and writing also **[22:02]** actually helped but there are people who will not treat you equally in outside. So I was giving this um interview at one of the companies and the HR uh wanted to understand the kind of projects that I've worked on and they said you know you seem like you know you have done XY Z things but they are not linked. So, so I I would okay I was like okay yeah it may be that okay that may be the case because um I'm applying for an application **[22:34]** development role so yeah definitely all you want to talk about is application development you don't want about system administration >> that's true but my projects are around that only so that's kind of bit complicated thing question to answer too and then uh my recent contribution was to system D which is again a very hardcore development type of a project. So definitely they those two were not going along and uh till then I had never heard of a role called developer advocate. So when infraoud reached out **[23:05]** to me uh uh and uh they they I saw the job posting but I never applied to it. Okay. So when they reached out to me uh one of the HRs that you know uh this is the role I asked them what is the meaning of developer advocate and then I went back and googled also. [laughter] So uh they uh the HR explained it to me and uh they said you know we are looking for someone who actually ticks all the boxes. So they have developer experience, they have DevOps experience, **[23:36]** uh they have uh open source contributions and they know how to write or to communicate well. That's what we are looking for. I'm like you're the first person in the past four or five interviews that I have given to say this is this actually takes [laughter] everything I've done makes sense like all together now. Yeah. >> So yeah, I think that was 2022 and since then I've been at In fact. So the change the reason of the change was just you know I was n the reason behind it was **[24:06]** just I was navigating cities or navigating the phases of life like becoming a kid. Sorry having a >> Oh, what's happening? I think there's some background. There was a huge background noise. >> Yeah. Like I didn't know what it was. Are you okay? Everything's fine. **[24:38]** >> Yeah. I'll just be back. I'll turn off my camera. Okay. >> Hopefully everything is fine. like that that noise sound like a big crash or bone or or maybe a how do you call that? I'm looking for the word in English. Um anyway, it doesn't matter. Uh so folks, uh keep with us. Um I really like the that old story. I always like to ask folk like because most folk don't start **[25:09]** as developer advocate right away. So I always like to ask like okay what's your story? Why did you move? which is the move that most people do most of the time is from developer to developer advocate. So, uh, pretty good story here. Are you okay? Everything's fine. >> Yeah, I can see anything and there's no noise. Probably Yeah, something something going wrong somewhere. >> Oh god, that is not what I expected. No, **[25:39]** >> that sound is not uh it's frightening a little bit. Hopefully everything's fine. It's Mumbai. That's it's very rare to happen something like this. >> Yeah, usually in Mumbai it's car honk, people honking all the time. But you know, >> but yeah, it's it's very late in the night. Something like this is not expected to happen. >> Probably somewhere some factory or something might have >> there's a construction work actually going nearby only. We have a new airport **[26:12]** under construction. Oh, okay. >> So, yeah, that could be a reason probably. Yeah. >> Okay. Awesome. Happy to know that everything's fine. No worries. No worries. >> Uh, >> so yeah, we're telling you you've been at uh for cloud for like 10 years. >> No, no, the infraoud three year 2022. >> Oh, okay. Okay. Okay. Three years. Okay. I miss I misunderstood. I was like, wow, that's a long three years. Still good in tech. Uh there's a lot of people like had the the the unfortunate uh history **[26:43]** of not being that long at different companies. Most of the time was not my fault. It was just you know it's life. It's tech is change in the priorities and devril may not be important anymore. The startups run out of money. Uh so people change jobs a little bit too often in tech but um it's good to see u people sticking around. So um one last question about your job and and your history about the job. Uh you know your first title was uh technology evangelist **[27:13]** and now it is uh developer advocate or senior developer advocate and um that happened once in a while to folks. Uh I'm just curious about like what prompt uh that change in title. >> It's just a business decision not >> Okay. Okay. Okay. Yeah. Sometime there's like some very valid reasons. Sometimes it's just like okay we we'll go to trans because when I started uh being a developer advocate in 2011 um like the developer advocate title I don't think **[27:44]** did not even exist. Uh we were all called developer evangelist or technical evangelist or technology evangelist. Um I really love the word evangelist. I know some of my colleagues didn't like it. Uh maybe it's because I'm not religious so I don't think it was offend like it was not offending me but like it was maybe offending some people uh because like it has like some religious connotation which I think makes sense because like tech is is really religious in a sense like we're not praying a god but like we we all have like our technology god like oh no I'm I'm an **[28:16]** Android person so I don't like Apple I'm an Apple person or oh no my technology is Ruby like I don't like PHP like we have like like developers stick to their own things and like it's that's the only truth and the only technology. That makes sense. But yeah, um after two three jobs um the the industry move or started to have more developer advocates or more people doing Devril and we move from technical evangelist or developer evangelist to developer advocates. So yeah and but there's still some company that use them and and being really with **[28:49]** a mindset of like an evangelist going to be more about the outreach. So creating a lot of awareness and the developer advocates is going to be like really an advocate for developers like like being that two-way street between the developer and the company. From my point of view, even when I had the title evangelist, uh that was still a two-way street like my job was always to represent developer internally. But anyway, now I'm just I'm just blabbering. Um >> no, it's it's completely fine. I think I understand that. I I think I have seen couple of folks I still in my network **[29:21]** who use chief evangelist or you know technology evangelist as titles as designations but at the end of the day I I I believe that you know one must be comfortable enough to adapt to the new technology that's coming up because AI has been booming like anything and uh when it comes to tech we don't know what will come 5 years later so as long as we are comfortable in adapting to the new tech we are open to understanding new tech um yeah it should be cool ass the the job remains the same. **[29:52]** >> You have to write a blog to uh make technology easy to understand. You have to do a video, record a video on uh explaining how to set up this or set up that or do go ahead do an integration or probably contribute to an open source project. I mean that's that's the best way to give back to community. But yeah, at the end of the day the job remains the same for everyone for a for a developer advocate. >> No, it makes sense. Makes sense. I was just curious because yeah, as I said sometimes it like there is a specific reason and not just like oh **[30:23]** yeah it make more sense for us to call uh or change the name to to fit put in more the like the industry standard. I have one last questions and and you do not have to answer but uh you said when you started you know you didn't have a lot of women in tech or or not that much like where you live. Um I'm not a woman. I'm a white dude. Life is easy for me. Um, but I still feel like the tech industry is not that welcoming yet. It's I think it may be a little bit better from my point of view, but again, I'm not a woman, so I may be **[30:54]** wrong. But I think there's still a lot of work to do. Um, I know it's not your job as a woman to educate us uh men to be better. But like if there is anything you would like to share to to help uh people understand like the the little or big thing they can do to be just more welcoming to women in tech or um that would be >> that would be nice but you don't have to because I know like I don't want to put the burden on you to educate us on that but like if you want to um that that **[31:25]** could be great. Now uh so part of my work to giving back to the community has been around this also when I came back I knew coming back uh I was on a maternity break even though I was working on on and off projects I was on a maternity break and coming back was not easy I think outreachy was the point that helped me and it is run by all men most of men most of them were men only so I'm not going to blame a man for that because somewhere or the other someone is responsible for me to coming back to **[31:56]** And it's not about a man or a woman. It's about uh people being open to uh uh giving a chance to someone. And uh when you see uh someone has been navigating uh navigating jobs or someone has been on a break uh uh it might not be wise to judge them on the latest tech because in the past 3 years or four years for which they have been away things could have changed right that **[32:27]** that could be very easily possible. So one thing that could be done in this direction is [clears throat] when they are sitting in a panel interviewing someone who has applied for such a role for for a role uh I I how I learned this is uh I when I g when I was giving infra's interview and they asked me uh uh you know that this is our requirement and you'll be working on kubernetes that will be some some tech stack which you'll be using day in day out have you heard of it so your next round of interview will be on this and my **[32:58]** reaction was Uh yes, can you give me 15 days to come back and maybe answer questions on that? So can the interview be scheduled 15 days later? So the HR said yes, we can do that. You have not heard of the tech. I'm like I have heard of the tech but I've never explored before. >> So uh that's that's good thing someone did to me. Maybe someone can be this open to talk about uh the opportunities that are there and then if someone is not aware who's giving the interview is not aware of the tech maybe give them 15 days and see if they are able to grasp **[33:29]** those things quickly that quickly because it matters at the end of the day you have to deliver in in in an organization. So if you're good and 15 days in my understanding is good enough for anyone to understand the basics of any concept there is so much amount of content available out there. So, so the content uh available around uh us has to be improved and that's why uh I have been part of this CNCF community group which is women and cloud native. Uh I've been organizer for them **[34:00]** for almost a year and we have been doing sessions or tech sessions. uh we invite uh uh uh people from all background uh people from all community and uh we talk about text tag we talk about demos um and uh yeah that's what we have been trying to do to include more people and to make uh make women aware specifically that you know there is so much amount of knowledge available. So it's not about uh uh the people on the other side trying to do something. It's more about women who have been outside of work or **[34:31]** who are not trying uh or sorry who who who are uh not getting that much opportunity to grow. Uh we have to make them understand that the uh knowledge is available out there. We just have to try a little harder maybe uh to understand those uh to understand those things and uh once we do um there are people in the community in the CNCF landscape who can help us and uh yeah I mean you can I think this is this is a very uh very big **[35:03]** accomplishment for me and for women in cloud native is uh last year CubeCon the co-chair for CubeCon India 2025 was Bhavani who is an organizer for women in cloud native and this year for CubeCon India 2026 I have been selected. So the uh this is what uh the message that we want to put out there is someone who has been on a break, someone who has been navigating jobs, someone uh who was not continuously there in a full-time role can actually get such type of **[35:33]** opportunity if they are open to ask questions if they are open to take help because I've taken a lot of help and I never uh feel embarrassed about uh uh talking about it. I never feel Yeah. I'm like yeah I worked on this project. I mean this is defin definitely not related to what I knew before. Uh but yeah I'm not hesitant in learning new things. So you have to learn be open to learning new things and uh you have to explore a bit more. There are so many open source projects that one can **[36:05]** understand and contribute to. I'm not saying it's easy but yeah it takes effort to come back and then when if someone for someone on the other side if you are taking interviews yeah give them a chance maybe 15 20 days like someone gave it to me and when I went back I knew I knew Kubernetes yeah so that's that's good enough for me >> oh that's good uh a lot of great advices uh advices here um especially like my my previous life before that job um I was in the uh cloud native space And um I **[36:38]** know people like to say that Kubernetes is easy but like my my premises was like no no Kubernetes is complex. It's a complex be. So uh like yeah give time to people to learn. And like when you hire someone I know you like the best case scenario you want someone that has the experience about the technology they're going to use. But at the same time when I used to hire developers I was preferring to have someone who know how to learn technology than someone to learn by heart some specific technology because who knows as you said like who **[37:08]** knows in like five years what's going to happen in two years or two years who may change their project we may work on a new product we may change the technology and I need someone who's able to adapt. Uh it's great to also uh from my point of view CNCF uh is is quite inclusive. Uh they even had like um what is it called deaf and hard earring hard of hearing uh working group uh I'm hard earring have hearing aids and I I was like oh yeah it's rare that would like to think about folks like me so uh now CNCF is is uh is pretty good for that. **[37:41]** Uh on that note, speaking of CNCF, uh you we we talked a lot. Uh I have the impression that we could continue to talk a lot, but um I think it's time for me to tell ourselves to stop talking or at least myself and uh move to the demo part of the show and uh why I was talking about CNCF is that first you are a contributor on uh Kerno. >> Yeah. So I continued my open source contribution uh after systemd I joined aka came into this role and I tried to **[38:12]** contribute a little bit uh to other projects as well. So kerno has been one. So we so like you mentioned Kubernetes is is not easy once you understand when once you try to understand Kubernetes you come across the major thing that is Kubernetes security right. So uh Kubernetes security has has been I think people are underestimated but if you try to understand uh it it well I think things can be done in that direction from day one or like people try to call it shift lift. So, so uh there are **[38:45]** things that you can do, you can understand and one of them is uh uh one of them is understanding why Kubernetes security is important and why you you need uh guard rails or policies in place that can help you with uh enforcing compliances and everything in this on on a cluster or any infrastructure. So uh uh when I started uh exploring Kubernetes landscape that's when uh and Kubernetes uh security specifically I came across this project **[39:15]** called Kerno and uh yeah I learned that they are very good to implement policies. Uh I'm not promoting them. I don't work for them. It's just that uh >> no but I will I will I will promote them. I mean uh Jim uh the CEO of the company behind near nearm the main company behind it uh who built Kerno uh when I uh previous company I was doing a live stream also called cube first live and uh I had him as a guest **[39:45]** uh so he demoed kuberno and we were using kerno internally so uh it's a great product if you want to manage security uh within your kubernetes clusters and you want to have like an easier way to implement policies. So, but anyway, um this is what you're going to talk about today. This is what you're going to demo actually the specifically uh you wanted to show the MCP the new MCP server. >> Yeah. So, let me give a brief overview before uh uh before talking about the Kubern MCP. So uh once you have a basic **[40:17]** understanding of policies like why policies are needed on a cluster. So you need policies just to make sure that anyone uh so we had ourbacks before right they existed for a reason for our audiences role based access controls where uh you decide or an admin decides who gets an access to what. So suppose you have three doors in your houses and you want a person to get the door access of only door one. You want B person to get the access to door two and you want the C person to access only door three. **[40:47]** You don't want the C person to access the door one. Even though get they get the key somehow they should not be allowed. That should the should be the ideal case. So Harbach used to make sure that only C person gets into the door three but then uh what if that C C user got the key also to the door one. Okay. So who will stop that person then in that scenario in somehow in such that scenario. So that's where the policies actually help. You can control uh you put another level of uh guardrail on **[41:19]** your cluster on or on your resources where these policies can put a check that if someone is even uh getting an access they should not be able to perform more than the privileged action actions you can say. So uh there is this uh field I it's very interesting I think uh just let me tell you. Yeah. So it's called allow privilege escalation that you can set in on a on a pod or on a container where uh uh your privileges **[41:50]** cannot go more than its parent process. Right? So uh even though even though somehow you got access to so your privileges will not be more than your more than your parent process. So these type of uh so these type of uh constraints can be implemented you using the policies and you cannot uh allow someone to run as root because that's when that's when the major incidents have happened in the past the security incidents where uh if if uh someone has **[42:21]** gotten access to to a pod which is running as a root they can access the host also they can access the main container and then they can kill some important process also in the process. So uh uh so policies help you uh take a better control of your cluster and that is why you need them in place. So Kerno has been doing an amazing job uh they have been releasing versions after versions and now they came earlier they used to have cluster policies uh where you can uh write different rules like validate rules, mutate rules. Uh so **[42:52]** validate rules a brief overview validate rule would do like uh I am a resource okay and this is the policy and if uh if um if the resource is uh not adhering to the conditions that are mentioned in the policy in in the validator rule specifically then uh the resource creation will not be allowed or it there will be a warning when you are creating the resource okay that you know you have not defined suppose a CPU limit or a memory limit it in your uh in your resource. Suppose **[43:25]** you're creating a pod in that scenario in that scenario. So you would get some sort of warning. So you'll uh uh the admin would get to know this beforehand okay that uh okay I'm implementing some level of security on my cluster in this way and uh similarly uh when it comes to mutate rule the mutate rule what it does is uh not only it gives you uh uh it will let you know that your uh resource is not adhering it will help you update your resource also. So in the mutate **[43:56]** rules there will be a condition if it matches if your resource matches with it and it's not adhering to some of the policies that are mentioned uh the mutate rule will have uh the things that are missing in your resource and it will be appended or updated in your resource configuration so that your resource now adheres to the policies. So earlier they used to have these validate rules uh mutate rules. Now they released uh uh with Kubernetes advancing and Kubernetes coming up with **[44:27]** uh new support. Uh Kibano launched uh different type of policies called validating policies, mutating policies. They uh one can check the repository. The latest development have been very good. I'll show one example also. So uh let me show one example also. Wait, let me share my screen. >> And during that time, I'm just going to thank uh sponsor Tanium Z, which is my **[44:57]** employer. So, if you need if you're a developer and you need a rich text editor, need a wizawig within your application, just a couple of couple of line of JavaScript and you're good to go. And just hit me up if you have any question or concern about it. So, >> yeah. So uh is my screen visible? >> Yeah. So this is one of the cluster policies where we have written a validate uh resource rule and in that we are defining for a pod a condition that **[45:28]** C CPU and memory uh memory resource request and memory limits are required for containers. So we are defining a set of conditions like this. Okay. uh where uh you can check whether the containers or the init containers or the ephemeral containers have uh memory and the CPU because at the end of the day these are going to impact your cloud bills right so you don't want to exhaust your resources or you don't want to overutilize the resources so to avoid all those things these type **[45:59]** of policies can also help so this is one of the policies uh that one can easily uh write it's like security as a code I I like to call it. So you can easily write a uh a cluster policy which will help you validate the resource. So suppose um this is let me go back to a polic a resource. Uh >> this is one of the thing that I I I didn't tell I would miss from my Kubernetes day YAML but actually I you **[46:29]** miss YAML. It's it's uh yeah, initial days it's a little complicated complicated to get acquainted to it, but yeah, once you get it's good. >> Oh yeah, I hated it at first when I I was forced to use YAML and I hated it. And at some point I was like, hey, you know what? It's not that bad because you know, I was doing JSON all the time before. I was like there's a lot less like like decoration around stuff and like it's more straightforward. But it took me a while to like it and and I but I never thought I would say like I kind of like miss YAML which is a weird **[47:01]** things for me to say but I'm looking at it right now like like yeah I missed it a little bit >> but maybe you can go back. >> So yeah so uh so the okay this uh one has uh okay there's no limit to okay there's a limit to it. So this is the repository I have. I can give you the link. I I think I missed you to give give a link. But this is an example of of a pod where we have not defined any sort of limit. So if you go ahead and create this type of pod uh Kerno will uh **[47:33]** uh give you a warning and will tell you okay the pod that you are deploying does not for does not adheres to these these these policies which says you know you have to have uh resource limit or memory limit in your uh in your resource. So if you see this um uh the failure action that has been mentioned over here is enforce and this is actually aligning with uh what uh **[48:03]** Kubernetes has defined it. So if I go to here I think okay I thought I had it okay maybe import security standards. So these these documentations are actually very helpful if you'll see. So uh uh one can define whether they want to enforce a policy or whether they want to uh uh uh they want to audit set it on audit. Yeah, this is the term that I was missing. So if you if you put it on an **[48:34]** audit mode then in that case you'll just get a warning. If you put it on enforce then in that case it will not allow you to even create that risk. the admin will uh the user will not be able to even create that resource on the infrastructure. So these type of uh uh these type of constraints uh that exist in the policy uh will not allow you to even create that resource. So the policies are very easy to write but then the problem is we talk about shifting left and we cannot expect uh a DevOps engineer or a platform engineer to have **[49:05]** uh understanding of all this from day one. So what Kano did uh they came up with this uh um um what do you call um set of policies okay and these port security standards they have already implemented and uh they have put it in their policies repository and in that once you go ahead and you just uh dep uh deploy it on your cluster. So I have put this is what I have done uh on my uh let **[49:38]** me go to my terminal. Yeah. So so I have a question for you unrelated to all the tech stack but I had a whole joke with my previous CEO and CTO. How do you call the the the common line tool that you just use? How do you how do you say it? Uh, cube. >> Oh, you saying it like my CEO and my CTO were saying it and I was like, "No, **[50:10]** that's cubectl." And and we had a war every live stream that we're using cubectl or cube cuddle. Okay, that's interesting. Okay. I was just curious. My my my my CEO my previous CEO would love that you said cube cuddle. [laughter] So, so if you go ahead and if you see these cluster policies, I have not written any one of them. So, this is Kerno trying to uh help people shift left. They have already written these policies which are on based on the PSS **[50:40]** that I just showed and uh the bot security standards and uh these are already applied on the cluster that I have. So, I what I did for the demo purposes I have kept everything ready on my cluster. I have uh I have installed Kiverno and uh I have deployed these cluster policies using the documentation the quick start guide. Uh once you have these policies in place uh uh one can go ahead and apply the manifest that I showed of a pod and they would get a warning. Okay. But that is that is like **[51:12]** uh year ago approach since the AI has advanced. Uh things have changed definitely and Kano released their new MCP server. uh let me give a brief uh overview of what the MCP is. So uh if I have to so I'm not the best person to explain MCPS but uh let me try it. So if if h if someone understands LLM the large uh uh language models uh earlier in earlier days what used to happen is you you give a prompt and you get a **[51:43]** response but then in that scenario that LLM had to uh had a limited knowledge or they had a limited access to some tool or someone had to spend time to figure out how it will be LLM would be integrated to a particular tool or to a particular API to get the information that the prompt that has been asked in the prompt right so uh with with things advancing MCP servers came in uh uh uh the concept came which is the model **[52:14]** context protocol what the protocol does is it it standardizes how the integration will be done between the uh LLMs and the tools out there uh which suppose you are trying to do a Google search not you are not trying the the agent is trying to do with the Google search. So in that scenario or it's trying to access an API or it's trying to run a command on a cluster, right? So uh something something like that. So it standardize the connection between the two. So all the companies who have these **[52:47]** type of products they are now trying to come up with their own MCPS where uh users can give prompt using any agent and uh behind the scenes the MCP server would go the MCP server would help standardize this process and soo the connection. So if if I have to show you how it's working, what I did was um I I once I installed Kerno on this cluster. So if I get uh yeah, so this is the the **[53:19]** Kerno name space where all the resources are up and running. So in in in that uh name space uh I I didn't have to do anything manually. The documentation is very straightforward. You go ahead, you just uh install using the Helm charts cover and then use the Helmchart again to deploy these policies. I installed cloud desktop which is for uh uh which again uh an agent you can chat to it directly and I configured in that um one of the files which is let me remember **[53:52]** what it was uh yeah libraryations yeah support so I installed claw desktop on my system and this is where I configured this file. Okay. So in this file I provided it uh the path to Kerno MCP. So I installed Kerno MCP. It's **[54:22]** again a oneliner command where you can install Kerno MCP binary on your local machine and I gave it the path to where my miniQ cluster is running. So all of this I have done it on my local machine itself. I didn't have to use a big big server or something like that. It's just this is for learning purposes. So, uh I I configured this on my local machine and the magic happened after it. Once I saved this file, I mean this is already uh set up on my local. I was able to **[54:54]** uh interact with claude uh and I just gave it uh get context and it was able to identify my cluster. So if you just wait for a few seconds. So yeah it it asks you you know you can allow it once or you can always allow it and allow always allow. So this is the cluster that I have. Okay. I should have told that before. Okay. So if I give uh yeah this is the cluster. >> Yeah. If you're new to uh Kubernetes **[55:25]** mini cube is is pretty good. Um I was using key3d for reasons but mini cube is pretty good if you want to test locally. You don't have to pay AWS bill or any other provider. >> Exactly. Exactly. So yeah so this is I had set up a mini cube cluster and on that uh I had deployed no and these policies. So yeah I gave uh this and then I just showed you the repository. I have a bunch of files over there in this **[55:56]** uh the resources you can say uh like a pod or some any any resource that's not adhering to any policy or you can say just a pod with has which has no limitations set. So I went ahead and I created that on the cluster and when I do a basic search on this that you know uh show me the policy violations. So the policies we are we have already seen. [cough] Show me the policy violations. I'll tell you the good part of this in **[56:28]** in a few seconds. uh the the the Kerno has tried very in a very good way uh uh to make uh all the platform engineers and DevOps engineer uh feel maybe strong you can say because now they don't have to spend a lot of time in figuring out the correct policies that their resources should adhere to in the beginning days itself. This is actually shift lift where you are already having a bunch of policies. You are already having the capability to scan those policies on your resources. **[56:58]** So see if I go ahead with something that I understand very easily is running as root. So I have four violations for running as root. Now uh this uh uh this MCP uh does not has much power in terms of it cannot go ahead and perform. So the first question that comes is when I'm giving someone access uh uh my cube config will it not be able to go ahead and perform commands on my cluster? No, you can just ask it what path do I have? **[57:30]** that I asked that question as the first one. What part do I have? So, uh it it will come back with a with a very uh good answer. So, I can do a context management. I can detect the policy violation. I can apply terno policies and scan. >> Okay. I have documentation access but I cannot execute direct commands or uh view resource details. >> Okay. So everything that that that should not be known to any agent is **[58:01]** actually controlled over here by the Kerno MCPS. So Kerno MCP. So it will not be able to de deploy or delete any workload or it cannot access the logs or the events. So this is a very uh uh secured way of setting up an AI AI tool and I think there there is this concept that I have talked uh I at least I've tried to learn about it in the past is a how one can focus on AI security and this is one good example of it. So you do not even allow the MCP server to have **[58:33]** this much level of access. So one even if someone gets an access they will not be able to execute these type of commands or they'll not be able to access the logs or the recent incident uh that happened with one of the organizations where uh uh someone was able to even get the keys and uh access to the database passwords from the logs itself because they had some uh uh they were able to scan the repository repositories that were public >> and from that they were able to reach the keys of the cluster. **[59:05]** Oh sorry environment variables in the cluster that existed. So uh yeah so u I'm just forgetting code rabbit or something it was I I'm not sure. Yeah they had something they had a huge incident some time back. So uh uh so uh uh so this type of control is actually very good and you can be sure that while I'm using it I at least these are these are the things that I can be sure of will not be of risk. So let me go back and show. So this this is telling that **[59:39]** you know you are running as root and this is the policy that is being violated. Now uh if I'm being very direct or even though I'm aware of the cuper commands of how to check I'll ask this how to check which resource is violating uh you know running as root. Yeah, the good thing with uh those little MM is that you can make mistakes when you type. It will still **[60:09]** understand. You don't have to correct yourself. [sighs] [gasps] >> The force of habit of writing. >> I know. No, but I was doing that at the beginning. I was like making a typo. I was like, I know I need to go back. And after a while, I was like, why do I do that? I'm just like, let's go. They will still understand. that that happens when you are so accustomed to writing rightly. [laughter] So uh so yeah how is this uh Kerno getting to know about the violations? So Kerno creates a policy report as a **[60:40]** resource uh where it gathers all the uh pass the failure. So let's get let's see one of the policy reports. Okay. Yeah. So these are the policy reports. Uh you can say even though they are UIDs, you can see there are four fails where at least our agent was right. It's it it gave us the right information that you know this particular policy has uh four **[61:11]** violations. Now let's go back and let's see if we can uh okay maybe check something else in this. So you have the power now to actually understand which which resource is violating what. Uh so we got that and let's get this one maybe. Yeah, this one. **[61:44]** I don't want this. I'll go with the default. Cool. So if I say this uh [snorts] let's see the one that has been. So if you see this one, this says uh validation failure containers must drop all capabilities. So okay this is which policy wait I think I opened the wrong **[62:16]** one which we didn't wanted to discuss we wanted to discuss run as root okay let's go ahead that's not a problem we'll discuss this one so uh uh this one shows that you know what is the where is uh where exactly the uh violation has happened uh this is the particular uh uh rule that has been violated the autogen privilege escalation it does not uh exist and for what uh resources Let me try to find that for what parts it has. **[62:49]** Okay, let's see a different report. So if you can see this is telling us actually for a replica set. Okay, it's telling us for the user app. If I get my capital gets sorry. Yeah. So you can see for uh uh okay it has created for this one. Yeah. So this is the one that is being uh this is currently violating the uh the uh basically the kibo policy. Now um if I **[63:20]** go back and I ask the MCP server to give me uh so these type of tools are not for someone who has been so accustomed to using CLI and running the commands and finding things because this this sometimes it feels like you know it's making me uh not do the stuff which I'm so accustomed to do because I have to go back and ask it. I know what the answer is. But then for someone who uh who who is coming from a different background like I said uh and they don't want uh to spend so much time in understanding how **[63:51]** Kerno works or where the policy report is or how the policy reports are configured or which resources are being impacted they can just go ahead and you know you make use of this to uh find it. So yeah it it has given me even the command see okay find deployments missing run as root. So that's okay that's okay that's beautiful. So it will give you all the commands. I mean I was just thinking what command to write you see. So it's giving me all the deployments which **[64:22]** which which is actually violating the uh run as root uh uh policy. So so uh those are the kerno resources also. But if I just uh I shouldn't have done that. But yeah, their own resources are not maybe not be adhering to all the policy. That's [laughter] >> yeah, it makes it could make sense. Yeah, >> it could make sense. So, so uh this is the default user app that I had deployed manually myself and this is also not adhering to uh run as root as one of the **[64:53]** policies. So, so yeah, so you get to know all the resources now. You can even ask it. Okay. So I know now okay which resources which of my deployment or pod is basically not following the policy. Now how should I fix it? And as you said, it's good to also like cubectl is is can be complicated at the beginning or just kubernetes like understanding like all the pieces and and and like most of the time I was trying to get information from the **[65:23]** common line and I was not even in the right cluster or like I forgot about the namespace because like namespace is a thing that you have to live with community world but at the beginning you always like never think about having like dash n and it's always the default and usually you don't have a lot of things there because you create like other name spaces. So having a tool like that will help you to navigate that uh more easily. Yeah. >> Yeah. Because the this command that I just typed I think uh even though I have been using proper Kubernetes for past **[65:54]** three years almost I mean uh writing this in one go would be difficult for me also. So yeah, even I I can try make an effort to explain to our readers the to our viewers that you know in this here we are getting the deployments we we have it in J we'll get the JSON format a means you get all the deployments [snorts] >> yeah and then uh the pipe so it's a bash uh thing where the output of this will be considered as an input for this and then you use jq to basically parse **[66:26]** through the through the JSON and get this particular ular index where the G this particular run as root is not set as true and then yeah again the output of this is going to work as an input for this and then you can filter this particular thing >> jQ is is one of the two like if you do a lot of JSONs uh even if you're not a terminal person jq is is your best friend >> exactly I think one a few of them g jq v grep the those are some things that that **[66:57]** are very again reminder of my system admin you cannot live without pipe jq prep they help you find command so command a good learning of uh command line I I think is needed that should be part of even college education I feel like sometimes >> because at the end of the day you need to figure out uh uh command lines and then commands like this so yeah so getting back to the demo so [snorts] uh this is the resource and when I asked uh the clot to how to fix that particular **[67:30]** resource. It's it's telling me the whole uh detail. So what policy it was violating run as root, right? So now it has given me the manifest which is now updated with port level security context where run as root is now set as true. Okay. So uh and it's passing all the different other uh parameters. So container level security it is implementing. So this is giving all the examples that one needs to uh update and it's even giving the direct command to **[68:02]** patch it. So you don't have to go ahead and uh you know open your manifest or if you're using VS code you have to go ahead update that file and then you know apply that file again. It will give you one cube cuttle command directly where you can patch the deployment and uh it's giving all the information that's needed. So it's it's making the job easier. It's when we uh when we uh say we should focus on shift left when it comes to security sorry uh when it comes to security this is actually shift lift uh which is going to uh save the **[68:34]** developers time or that the devops engineers time to let them focus on the essential stuff and these are the basic stuff that can get covered in the process. Yeah. >> Yeah. No, makes sense and because he has access to your cube config because you could probably try to replicate that by copy pasting YAML file to like and they give you answer and you have to do a lot of manual things but now you give them access directly to your cluster and uh it's it's so much more straightforward and and you don't have to look about **[69:05]** what you're looking for because if you don't know what you're looking for like it's it's just like the the the number of YAML files and and type of resources in a cluster >> one or two cluster resources there are like hundreds of them so definitely uh when one has to scale this is a big problem I understand that and that's why Kerno has come up with something because they want to strengthen the devops engineers they want to provide them with the with such type of tools uh uh that can help them **[69:37]** enhance the security on their cluster and they don't have to spend more time in figuring out you know which resources is uh uh which resource is not adhering to this policy or uh which resource uh uh if they are writing a news resource then in that scenario what policies they have to make sure that are being adherred to. So all these type of things are definitely going to help. Yeah. >> Awesome. >> Short but yeah I hope I was able to cover it in the time. >> Yeah. No no no that's pretty good. Um as **[70:07]** I tell people the length or my guest the length of the show depend on the guest. So, um I mean sometimes it's shorter, sometimes longer. As long as you're having fun talking about the topic, uh I'm good and I think you had fun and I had fun and hopefully the people listening to us are watching the recording. Uh we'll learn some new stuff. I didn't know about uh the I know about Kerno. I didn't know about the the MCP, the the newish project that had. So, uh it was pretty interesting. Thanks for sharing that with us. And on that **[70:38]** note, I think I'm going to let you go because it's close to 3:00 a.m. for you. But uh seriously, thanks a lot for your time. Thanks, uh for being on the show. Uh that was a pleasure to have you and uh hopefully the construction is going well uh for your report and it's not uh disrupting the sleep of uh of your people with the big noise. Yeah, if you can cut that part because it's for a second I felt like then that there is some terror attack **[71:08]** happening but then I suddenly remembered that there's an airport construction. It's almost 2 km from here but yeah it's happened. >> Yeah know it felt like it was uh like an attack or something. I was like oh I hope I be safe but uh it was the case. So um thanks again for being my guest. It was a real pleasure for having you. Thanks for uh being the guest on the last show of 2025. Do not worry folks uh we will be back in 2026 the second week if I'm not wrong of January. Uh so I **[71:39]** will be back and thanks for the people who are live. Uh you are a little bit silent today. Always feel free to ask questions or at least uh leave comments or just say hi. It's always appreciated. And also thanks for the people watching the recording. And I know I'm really hurly about that, but uh because that's the last show of the year, I wish you uh you know a good holiday season uh either you're uh like celebrating Christmas or NA or whatever you're celebrating. I wish you a good time hopefully with a **[72:10]** lot of love and friends and family. Uh if it's your thing, if you prefer to stay alone, hopefully you're going to be able to stay alone if it's your thing. But uh see you in uh next year for next episode of the Devil Show. >> Yeah. >> Bye everyone.