In the run-up to Open Source Summit NA in Vancouver next week, I wanted to reflect on what happened a week ago in Amsterdam.

A sold-out event with more than 10,500 people showed up in real life at KubeCon + CloudNativeCon EU in the Netherlands. Of those, 58% had never been to a KubeCon themselves, including me. There are now more than 1,300 maintainers that look after 200,000-plus contributors. Of those contributors, around 25% of them come from end-user companies, meaning they are not Kubernetes or k8s slingers. All of this is very interesting.

One conversation that came to mind with another attendee was what the churn was for people attending Kubecon. For me, this is especially interesting to understand that as KubeCon gets bigger, how many end users return for a second or more shows? The data wasn’t clear, but it would seem that the churn is real and that repeat visits year after year is a problem for the Cloud Native Computing Foundation. This might lead to the need for more content. But this is a good problem for the CNCF to have. It means that it’s successful in the core mission with cloud-native open source, attracting new users and contributors. And by all accounts, KubeCon + CloudNativeCon was a huge success.

But the challenge is great enough that CNCF spent a good portion of the second day’s keynote recruiting individuals to get involved in one of more than 150 projects. It’s good to have a lot of interesting projects, but also hard to keep them all healthy and moving forward. Also, it is a management nightmare for the CNCF board to be able to talk to all of those project leads to help them make progress. This is why the CNCF built a “pathway” guide for leaders of projects on how to get to the next place, from sandbox to incubation to graduation.

It still seems interesting what projects are still in incubation, such as ITSIO, but are also standard pieces in production k8s deployments. As of April 1, there were only 20 graduated projects in the ecosystem. But there are a promising 37 projects in incubating, which is good to see. As Emily Fox, an engineer at Apple Inc. and Technical Oversight Committee member, discussed, those projects still need to “cross the chasm” to graduate. Navigating across the chasm is where the guideposts will come in. Most of the CNCF TOC due diligence will be done at this point during the incubation stage.

That makes sense because there are only a limited number of members of the TOC, and talking to all 37 incubating project leads to help and guide them can take much time for each member, besides their day jobs. We had a great discussion with a member of the TOC, Richard Hartman, director of community at Grafana Labs, during the conference on the legal aspects of AI-based code generation, as this will be an interesting “code pollution” problem that will be dealt with inside and outside the open-source community.

It was a great week where I got to co-host a talk with many folks. From Red Hat it was David Eads, Maciej Szulik, Natale Vinto, Kevin Dubois, Fabian Deutsch, Andrew Burden, Harriet Lawrence and Christian Hernandez. From IBM, Pete Brey told us what he was up to with Fusion. Folks from Portworx by Pure Storage Inc. stopped by, including Murli Thirumale and Venkat Ramakrishnan, and their partner/customer Jelle Wolthuizen with DXC Technology. Deepak Goel from D2iQ also stopped by, and so did longtime friend Brad Maltz, leading Dell Technologies Inc.’s DevOps portfolio and DevRel.

Beyond the CNCF programming and my duties hosting on The Cube, I spent time talking to builders of cloud-native applications and to other vendors that I wanted to know more about.

One company that I hadn’t talked to in some time was Canonical Ltd. Everyone knows Ubuntu, but I wanted to see what else was happening. I caught up with Cédric Gégout, vice president of product management, to go over what Canonical is doing with k8s. One thing Cédric explained was about the two different k8s distributions, MicroK8s and Charmed Kubernetes.

MicroK8s, notwithstanding the micro in the name, is a full-blown, more simplistic k8s deployment that has been curated with popular add-ons. It can be used in resource-constrained environments, but it is more focused on “platform engineering,” looking for a simplistic deployment methodology of Kubernetes that gets devs up and running quickly on CNCF conformant platform. For those looking to start with core k8s and add their own packages, they would opt for Charmed Kubernetes. 

That brought me back to almost a decade ago when my product team built a Juju Charm for a virtual storage appliance to run on Canonical KVM. It was ahead of its time from an app store or marketplace concept back then. Charmed Kubernetes gives you all of the flexibility you would expect if you were deploying it yourself but with the advantage of having the charm deployment automation to help build out the environment. It was good to catch up with a company that doesn’t make big press but is doing a lot.

Another company I talked to over in the startup pavilion section was Slim AI Inc. I talked to Chief Customer Officer Ian Riopel, on how Slim.ai is helping developers reduce the attack surface of containers that are built and deployed into production. Although discussion of software bill of materials, or SBOM, was all the rage, this is a different take. Slim.ai is focused on stopping deployments of “at risk” containers by limiting what is in the container. Although it creates an SBOM, it’s focused on keeping it a clean SBOM by keeping the boat out of the package. Slim.ai uses the SBOM it creates with multiple vulnerability scanners to look at the different layers of the container.

This is definitely the concept of shift-left security that can actually harden the container by removing files and libraries. And it can do this selectively on parts of the container that are more common, not necessarily all layers and custom code. Several companies are aiming at this space, and I expect it to heat up significantly as companies look to have a better security stance and a more leveraged developer group. One very interesting piece is the role AI will play in this. Private large language models will have a strong play, bringing better results to companies as it learns from their container SBOMs.

As I talked about service mesh and Istio, this control plane project, above being incubated from a project perspective, is already being used widely to solve components, usually microservices, to talk to each other over a network using an Envoy proxy, another project. I had a discussion with Tetrate Inc. about Tetrate Service Express to help organizations looking to use Istio and Envoy with Amazon EKS, the Amazon Web Services Kubernetes service. Erik Frieberg, the chief operating officer of Tetrate, and I discussed the different approaches for commercial service mesh deployments, as Tetrate contributes to and supports many of the underlying open-source projects. The Tetrate approach embraces Istio and Envoy by providing the management plane on top of the Istio control plane and the Envoy data plane.

This approach of supporting the core projects and filling in the space around or above them is key to the commercialization and health long-term of the projects. Networking in general in the cloud is difficult, I know from experience. Building out a mesh of microservices is not only difficult but very complicated, even just trying to wrap your head around conceptually — even in cloud providers, as can be seen by the partnership between Tetrate and AWS.

Two overarching themes I kept returning to were that platform engineering is subsuming traditional IT and transitioning workloads from virtual machines to Kubernetes can be very complicated. Much of what I have discussed above fit into the “how to make platform engineering easier.” But with nearly 60% of the attendees looking to find a starting place with Kubernetes, getting that first application on to it was still a big lift.

One very interesting conversation I had was with Rajith Muditha Attapattu and Casey Tjokrohardjo from Randoli Inc. It’s taking the platform engineering challenge head-on. Its App Director product is focused on reducing the effort to get to the cloud and, in particular, getting to Kubernetes. It’s partnered with Red Hat, AWS,and Microsoft and is a member of the CNCF. One thing I would highlight it the ability to have “Golden Paths.” This is the key to a product in this space.

To wrap this up, three main themes came out of KubeCon. First was that platform engineering is real and is funded both at the startup company level and in organizations by the chief information officer. Second was that AI will be in every phase, and though the hype is big now, the promise is undeniable. Third was that we are past the early minority, and Kubernetes has reached the late majority with its popularity and will have to solve day two issues.

Rob Strechay is the founder and principal of Smuget Consulting, advising companies on product strategy and go-to-market activities. He’s also a guest host on SiliconANGLE Media’s video studio theCUBE. Before founding Smuget Consulting, Rob held executive positions at multiple startups and Fortune 500 companies. He wrote this article for SiliconANGLE.

Image: KubeCon