Kubernetes as the Platform Foundation

▶ Watch (0:03)

Nearly all large EKS customers run a Kubernetes-based platform to abstract cloud complexity and give developers safe delivery velocity. They build on CNCF open standards, but everyone ends up solving the same operational problems. The effort is in tying it together and keeping it compliant at scale. Butler’s position: complexity doesn’t disappear when you add abstractions. It moves down into the system, which is where it belongs.

Karpenter: Just-in-Time Node Provisioning

▶ Watch (2:17)

Karpenter is a SIG Autoscaling subproject and node lifecycle manager for Kubernetes. Instead of pre-configuring node groups and scaling them up and down, it provisions the optimal instance in real time from whatever is available. You define performance and disruption constraints; workloads drive the data plane on demand. The shift is from humans predicting what they might need to the system provisioning what it actually needs.

Kru: Composing Resources Without Operator Sprawl

▶ Watch (2:59)

Platform teams often create dozens of custom operators to compose cloud resources so developer teams can consume things like a dev cluster or an app stack. Operating dozens of controllers to glue resources together accumulates as tech debt. Kru abstracts the operator pattern. It automatically creates CRDs and manages the resources inside them, with no additional operators or webhooks. The project started at AWS, converged with parallel work at Google Cloud and Azure, and is now a SIG Cloud Provider subproject closing in on 1.0.

Conditional Authorization: One Policy for Both RBAC and Admission

▶ Watch (4:25)

RBAC defines who can do what in Kubernetes, but not who can do what with a specific object. Today that requires two systems: an RBAC role for permissions, then an admission policy to override based on object attributes. Lucas at Upbound and Micah at AWS are working on a KEP that adds conditional authorization. A single policy can now say “yes, if” based on object attributes, handling both authorization and admission in one place. Cedar is the first authorizer to implement it.

Notable Quotes

Kru lets you refinance. Jesse Butler · ▶ 3:22

No additional operators or webhooks, Jesse Butler · ▶ 3:33

RBAC tells Kubernetes who can do what, Jesse Butler · ▶ 4:29

Key Takeaways

  • Karpenter provisions optimal nodes in real time, replacing static node group configuration with demand-driven scaling.
  • Kru abstracts the Kubernetes operator pattern, automatically creating CRDs and reducing custom operator sprawl.
  • A KEP from AWS and Upbound merges RBAC and admission control into a single conditional policy.

About the Speaker(s)

Jesse Butler is a Principal Product Manager and Technologist at Amazon Web Services, focused on Amazon Elastic Kubernetes Service (EKS). He works on features that help customers build and scale with Kubernetes, transforming workflows and removing friction.