KubeCon + CloudNativeCon India 2025

Multi cloud deployments and shared infrastructure enhance data privacy and security issues, with containerized workloads becoming mainstream in Kubernetes, there is a need to host containers securely in addition to virtual machines (VMs) to safeguard hardware-level workloads.
KubeVirt is a cloud native virtualization platform that comes with Confidential Virtual Machines for the most sensitive use cases. They take advantage of Trusted Execution Environments such as AMD SEV, Intel TDX, and IBM Secure Execution to provide data-in-motion encryption for their workloads and defend against subverted host admins as well as against system attacks.
In this session, we will cover KubeVirt methodology for Confidential VMs, including the design of the architecture, challenges of implementation, and deployments. We will examine how the VMs protect sensitive workloads using memory encryption, workload isolation while being placed within Kubernetes orchestration and automation.

Runtime security for cloud workloads involves continuously monitoring workload behavior and preventing deviations from normal activity.

The ideal approach is to enforce application-specific zero-trust policies that establish a baseline and prevent unexpected behavior. While, implementing zero trust requires ongoing tuning and is more of a Day 2 operation. In addition, Hardening policies can be established by translating compliance frameworks' prescriptive guidance into enforceable runtime security policies. By adopting a layered runtime security approach, the attack surface can be significantly reduced.

In this talk, we’ll demonstrate how to enhance runtime security using policies influenced by compliance frameworks like CIS and MITRE, etc. We’ll showcase real-world examples and enforce these policies using KubeArmor.

As organizations shift workloads away from centralized clouds, they need solutions that are both lightweight and scalable. In this lightning talk, we’ll see how k0s - a single binary Kubernetes distribution, bridges this gap by making edge deployments simple and efficient.

We’ll walk through a short demo on Raspberry Pi 5, showing how to set up a worker node using a Pi device and deploy containerized applications closer to where data is generated. By the end, we’ll understand how this minimal approach can power IoT, AI/ML.

Kubernetes has become the de facto standard for container orchestration, yet managing complex workloads—particularly stateful applications and large-scale deployments—often requires extensions beyond its native capabilities. OpenKruise, addresses these gaps by introducing powerful and enhancements to streamline application lifecycle management.

This presentation explores how OpenKruise augments Kubernetes with features like in-place pod updates (reducing downtime by updating containers without restarting pods), advanced workload controllers (CloneSet, Advanced StatefulSet). These innovations enable DevOps teams to optimize deployments, minimize operational overhead, and scale stateful applications seamlessly.

We’ll delve into real-world use cases from our experiences, plus, how OpenKruise can be plugged to any complex systems/apps.

Attendees will leave with actionable insights into leveraging OpenKruise to enhance deployment strategies and achieve zero-downtime operations.

Kubernetes workloads rely on public IP addresses for egress traffic via SNAT connections. By default, Kubernetes nodes provide a limited number of SNAT ports (1024 per node), often insufficient for workloads requiring extensive outbound connectivity. Allocating additional IP addresses statically for SNAT purposes in large clusters can lead to significant inefficiencies and wastage of limited public IPv4 resources. This session introduces an innovative SNAT port and IP address management solution developed for AKS multi-cluster, multi-tenant platforms, demonstrating how optimized IP allocation significantly reduces IP address wastage and associated costs.

Managing a multi-region Kubernetes deployment comes with significant challenges, especially around container image distribution. In our setup, we had a central container registry in a public cloud, but as the number of clusters grew across regions, our NAT transfer costs skyrocketed— a staggering 10x increase

A major contributor to this cost was cross-region image pulls, which also impacted pod startup times. We explored multiple solutions and found Zot (a CNCF sandbox project) to be an ideal fit due to its lightweight architecture and pull-through cache capabilities

By configuring Zot as a regional caching layer, we:

Reduced NAT data transfer costs significantly by keeping frequently pulled images closer to the clusters.
Improved pod startup times by eliminating long fetch delays from a central registry.
Simplified registry management without adding unnecessary complexity.

Jumping into a massive infrastructure codebase as an intern can be intimidating. But here’s what made onboarding smoother: unit testing with Kubernetes APIs and fake clients.
This talk shares my experience of working on unit tests for an infra plumbing component of a data lakehouse.

The journey from being overwhelmed by Go and Kubernetes to realizing that unit testing is the best entry point to understanding large-scale cloud-native systems will be explored.

The session highlights why Kubernetes APIs make testing easier, introduces informers, controllers, and API behaviors and how they help in testing, how fake clients eliminate the need for a real cluster, and why this is a great starting point for interns and students working on their first cloud-based project.

Attendees will gain insights into the advantages of Kubernetes API interactions and testing, including speed, reliability, comprehensive coverage, and improved developer experience.

The rise of WebAssembly (WASM) has sparked comparisons with Docker which often leads to questions and confusion: Are WASM and Docker competing technologies?

In this talk, we will see how this is far from the truth. On one side, Docker revolutionised how we bundle and deploy applications, offering unparalleled portability and simplifying workflows across environments. On the other hand, WASM brings speed, security, and efficiency, enabling the execution of code written in languages like C, C++, and Rust almost at native speed, performance, and rapid startup time even in the browser.

We will explore how these two technologies bring the best of both worlds and help developers achieve portability, efficiency, security, and flexibility. We will also look at how Docker is actively working to make WASM mainstream by allowing WASM container images to be hosted on DockerHub and run WASM containers alongside traditional Linux and Windows containers.

This session focuses on enhancing Kubernetes autoscaling by integrating **KEDA** (Kubernetes Event-Driven Autoscaling) with **Prophet**, a time-series forecasting tool. Traditional Kubernetes autoscaling reacts to current resource metrics like CPU and memory, while predictive autoscaling anticipates future workload demands using historical data. By combining Prophet with KEDA, Kubernetes can proactively scale resources before traffic spikes, ensuring better performance and optimized resource usage.

Attendees will learn how to implement predictive autoscaling with KEDA and Prophet to improve efficiency, reduce latency, and manage resources proactively. This approach helps handle fluctuating workloads, enhancing system reliability and providing a seamless user experience.

Ideal for cloud architects, Kubernetes admins, and DevOps professionals, this session provides actionable insights to automate scaling strategies and improve cost efficiency in cloud-native environments.

Imagine presenting to your dream clients when your primary region decides to take a coffee break. That's exactly what happened to us - 25 minutes of unexpected manual failover, and watching hope drain from our team's & audience's faces. Our multi-region setup was more "disaster" than "recovery".

Join this talk as Prerit walk us over how they build an intelligent feature flag orchestration platform using OpenFeature which now processes 1k flag evaluations/second across 3 global regions, reduced infrastructure incident risk by 90% & DR time from 25 minutes to 125 seconds and has successfully handled 15 regional incidents without a single lost transaction.

We will also see they built the "infrastructure gates" to control traffic shifting with millisecond precision, feature state synchronization, and WARM-HOT-COLD DR strategies with just a toggle.