Zack Butcher, Tetrate | KubeCon + CloudNativeCon Europe 2023

This is texturing TV. Hey everyone. We're back here live in kubecon Amsterdam.

My next guest is Zach butcher from tetrate and Zach welcome. How are you that I'm doing really well. So Zach share with the audience.

Give us a little bit of your background here. Yeah. So I was one of the original Engineers on the istio project at Google very core.

Then I worked on a whole bunch of different stuff in Google Cloud. If you ever made a project in Google Cloud, that was my baby for quite a while and then I moved over to start to work on on istio and they're you know the project caught fire when we release it in 2017 and I worked very closely with the original product manager there to go meet with a bunch of users and and try and get issue the initial istio adoption. Right?

Yeah and out of that we heard a bunch of really compelling case studies and and a bunch of compelling use cases that prompted us to go and and start touch rates to try and bring you know, the goodness that istio does up to Enterprise. Right sure because there's a big Delta between you know, an open source project and what you need to be successful and you know heavily regulated Enterprise and you know, and and that's usually the spot where commercial ended he comes in and fills the Gap, correct, correct? So You know, we've been hearing about service Smash and we and istio is you know, they're probably the leading one man before covid.

going back to San Diego and Seattle before that but it seems like at this show service mesh has been a maturity level. That I think makes it more critical mass acceptable 100% that's been exactly my impression here on the floor as well. It's super exciting for me because it's you know, I I started working on SEO in the middle of 2016 really so it's been it's been a minute.

Yeah. This really has been the first coupon where I go around and almost everybody I'm talking with those. Yeah.

We've you know, we've been messing with this, you know, we have it already. Yeah, we're using on boy and so it's been incredibly incredibly exciting to see very good. Congratulations.

Let's talk a little bit about Tetra right so you I'm assuming it's a commercial Enterprise grade. istio product but What makes it different than the open source? What makes it Enterprise?

Yeah, so though the analogy I like to explain again. I work for Google clouds by bubble. But to these management planes, you know, if you think about what AWS console is to the AWS services.

That is what we are to istio. By that I mean, you know user login user management permissioning who can do what where with the system the feedback the metrics the global view of of what's happening in the system all that stuff to really operationalize a service mesh in an Enterprise. So that app devs can go in and push config and and roll out apps as fast as I can the platform team can make sure that there's a consistent Baseline of networking behavior of resiliency and of security there for them and really bringing in a way that enables the multi-tenancy that we see large Enterprises doing and helps Bridge the heterogeneous environments that they're in right we regularly work with folks that are in Azure and Google and on-prem and they're an open shift and k3s and everything under the sun.

And we come in and help give them a single coherent place to control application security traffic and observability across all of that. I love it. I love it.

That's great. I want to jump to some new stuff. But before we do people who want to get more information on test straight where they go test straight, where do they go?

io is the best place to go, you know, you can find us on all the social media as well under the test rate or tenthright IO handle, but go check that out. And that's where we are. Fantastic, so now let's let's take a right.

Turn. Yeah, you do some work with Nest, correct? Yeah, that's one of the other big hats that I wear.

So in addition to working here at tetrates along with tetrate. I go work with the secure Computing and information systems group at nest and I help write a bunch of special Publications there historically. I've been writing What's called the sp800 204 series that's the set of guidelines for the US federal government for secure microservices and multi-cloud.

I love about what we're super excited about and I didn't even know what's happening today, but I found out about three am this morning Amsterdam time the next SP that I've been collaborating with this on 207 a which is the next installment in zero trust. So zero trust is the big thing in Vogue missed SP 800 207 defines zero trust. We have just released for public comments as the 800 207a and so this is that next installment in the zero trust series and really my goal with this was to try and make it concrete.

I'm tired of there's a bunch of there's you know, there's there's much of interfud around what is zero trust or not. There's a lot of wishy washy stuff. I tried to really make it very clear and I gave five runtime checks and we argue that if you do these five runtime checks at minimum, then you are implementing a zero trust runtime and those five years.

You know, I'm gonna go check this out now. Yeah, please zero trust was was determined the yard say conference right here, correct. I expected.

It'll be pretty heavy this year as well. Only more Yep. So, you know so nisters put this out.

It kind of has the blessing of this whole White House. Push for zero just buried out. So the existing White House push for cybersecurity predates this one but I we do expect it's pretty likely that this one will be rolled into the next set of White House guidance.

That'll come out shortly. Actually where can people get information on that man. Yeah.

gov website there and please you know, my call to action would be give us feedback. It's the current open review period and so now is the time to give your input on that standard and you know, tell us where we got it wrong tell us where we got it right tell us tell us how to make it better so that it can help as broad as well to the industry as possible. Hey Zach, there are folks watching this out there right now Engineers who say, you know, I'd like to work with this and some of these organizations to do what Zacks do it.

Yeah. What advice would you give them? Yeah start to get involved in some of the working groups and things like that.

So in this holds a variety of different ways to kind of start to comment and get involved. One of those is something like research groups. So for example, we currently have a research group that is running on zero trust in multi-cloud and specifically focusing on identity and multi-cloud.

And I hope lead that group there and we've been meeting weekly for quite a while now. With representatives from different Cloud providers representatives from different ends users talking about the problems that they have around multi-cloud and security. The outcome of that then is research.

That we use to form the next set of standards and so for folks that want to get involved in this start with those groups and that gives you that input in and then often the people that write those SPS are folks that are in that groups that do those research you get it. I love it man. Hey less topic.

I'm gonna bring up with you. So we're two days in here. We're two days in you keep on three for some of us who were here early.

Yeah, same, you know, istio service smashes real any other kind of observations you want to Share with the audience. Um, no, my biggest one is you know, I personally have been really really energized and excited about this kubecon. You know, I don't know have you felt about the last couple ones but it felt kind of like vendor con for a while there.

Right? Well, the one in La was for sure that was and you know, I don't know about you but for me, at least the energy feels like the old. Oh no way back like I feel like we're back and you know for me that's super exciting because that's what it's all about.

I I don't want to hear a bunch of vendors talking about their stuff. Even if it's cool. Sorry.

I'm a vendor talking about myself. Yeah. I want to hear users.

I want to hear people that are in the trenches doing this stuff and and how they're doing it, right and that feedback and that's what makes it important exactly. I feel like we're finally back in that. I hope I hope it stays there.

I'm gonna be at RSA next week. I'm hoping to see a similar thing there. Zach thank you for coming on today and I think we hit it.

I appreciate it. Go check out. It's tetrade.

Taught IO. Yep. That's e r a r a t e that I got it if you misspelled it measure when I would I know right?

All right, we're taking a break we're live. Is there playing some announcements here? We're gonna be back.

We're live in kubecon. Stay tuned.