Stop Calling Knative Serverless!
Outlines stop Calling Knative Serverless and evaluates key implications for security practitioners.
Summary
### Overview In this talk, Doug Davis, offering manager for Knative Public at IBM Cloud, explains why viewing cloud computing choices as a strict division between Platform as a Service (PaaS), Containers as a Service (CaaS), and Functions as a Service (FaaS) / serverless presents a false choice. Davis argues that while developers want to focus on writing application code rather than managing complex infrastructure, modern container orchestrators like Kubernetes expose extensive operational complexity. Knative is presented as an opinionated, simplified platform on top of Kubernetes that provides developer-friendly abstractions—such as automated networking, scaling to zero, revision management, and eventing—while still retaining full access to underlying Kubernetes capabilities.
### Key Topics - **Evolution of Cloud Abstractions**: Tracing how the industry shifted from bare metal and virtual machines to containers and serverless, and evaluating the trade-offs across PaaS (e.g., Cloud Foundry), CaaS (e.g., Kubernetes), and FaaS (e.g., OpenWhisk, OpenFaaS). - **The Complexity of Kubernetes**: How Kubernetes shifted developers back into managing low-level IT primitives (pods, replica sets, deployments, services, endpoints, ingress/Istio, complex YAML) instead of focusing strictly on code. - **Knative Serving**: How Knative simplifies application deployment, automatically manages HTTP endpoints, handles zero-downtime rolling upgrades across revisions, enables traffic splitting, and autoscales workloads from zero up to high concurrency. - **Knative Eventing & CloudEvents**: The core building blocks for event-driven orchestration, including event sources, adapters, brokers, triggers, sequences, and conditional choices, utilizing standardized CloudEvents metadata for filtering.
### Technical Details - **Serving Architecture & Routing**: Applications in Knative Serving are deployed as services consisting of immutable revisions created on configuration or image changes. Knative provisions networking and routing endpoints immediately. Services expect an HTTP server listening by default on port 8080. It supports configurable concurrency (`containerConcurrency`), allowing multi-threaded or strictly single-threaded execution per pod. - **Traffic Management**: Serving supports granular traffic splitting (e.g., 50/50 Canary deployments) and named tag routing. By assigning a dedicated tag (e.g., `test`), Knative generates an isolated endpoint (e.g., `test-echo`) that bypasses public load balancing, allowing internal verification before reallocating production traffic. - **Scaling Controls**: Knative autoscaling reacts to request concurrency or CPU utilization. While it supports scale-to-zero, operators can also configure `minScale` and `maxScale` (e.g., setting both to 1 to run fixed singletons that behave like traditional Kubernetes pods without serverless scaling). - **Eventing Pipelines**: An event source sets up subscriptions against external event producers (demonstrated with a GitHub push event source). Events are normalized into CloudEvents (adding standardized metadata for routing and filtering at `cloudevents.io`) and delivered via adapters and brokers to target sinks or build services. - **Compatibility & Under-the-Hood Infrastructure**: Knative utilizes standard Kubernetes primitives (deployments, replica sets, pods) and networking meshes such as Istio. Scaling limits in native Kubernetes directly apply to Knative, as it introduces a simpler API model rather than an alternative execution engine. Supported Kubernetes versions cited range from 1.11 to 1.15 (with 1.13+ recommended).
### Takeaways - Knative bridges the gap between the simplicity of PaaS/FaaS and the deep operational flexibility of Kubernetes, targeting 80% to 90% of standard application use cases natively. - Developers do not have to compromise between full serverless ephemeral functions and long-running services, as Knative can host both singletons and auto-scaling workloads. - Because Knative runs directly on Kubernetes, teams do not operate in an isolated silo; Knative services seamlessly integrate with standard Kubernetes workloads while reducing configuration overhead.
Related talks
The Linux Foundation·30 min
Serverless for Open-Source Maintainers: Automating the Boring, S... Hemant Bharadwaj & Antra Purohit
Evaluates serverless for Open-Source Maintainers: Automating the Boring, S... Hemant Bharadwaj & Antra Purohit and evaluates key implications for security practitioners.
The Linux Foundation·35 min
The Future of Green Cloud: Serverless WebAssembly on Arm64 Archi... Kate Goldenring & Aaron Williams
Details the Future of Green Cloud: Serverless WebAssembly on Arm64 Archi... Kate Goldenring & Aaron Williams and evaluates key implications for security practitioners.
The Linux Foundation·42 min
Ritesh Rai · Vamsi Sangavarapu
Presents elevating Serverless Platforms with Wasm Components and evaluates key implications for security practitioners.


