Autodesk Fusion 360 Crack + License Key Free

🌍👉 COPY & PASTE LINK 🌎👉 https://up-community.wiki/ds/

Autodesk Fusion (formerly Fusion 360) is a cloud-based 3D CAD, CAM, CAE, and PCB design software platform that integrates various product development tools into one environment.

🌐 COPY THIS LINK INTO BROWSER 🟢==►► https://up-community.wiki/ds/

1. CLOUD NATIVE AACHEN
Aug 21, 2025
ERICSSON, Herzogenrath

2. Benedikt Bongartz
Red Hat
YOUR ORGANIZERS
Clemens Röhl
CANCOM
Faseela K
Ericsson Software
Technology
Marvin Beckers
Kubermatic
Sebastian Rabenhorst
Shopify

3. We strive to create a inclusive community that welcomes everyone. To that end, please follow
the CNCF Code of Conduct, which boils down to:
Let’s be excellent to each other.
If you encounter any situation or person that makes you
uncomfortable or which you believe is not in line with
community standards, please approach the hosts or
email [email protected].
CODE OF CONDUCT

4. We would like to take a few pictures of the event for our social media (LinkedIn &
community.cncf.io) and to share with our sponsors.
If you do not want to see your pictures on the internet (which we perfectly understand),
please approach the organizers or email us at [email protected] (please do so within
the next 24h so we know we shouldn’t upload pictures that include you).
EVENT PICTURES

5. Location, Food & Drinks
SPONSORS AND HOSTS
Georg Kunz
Ericsson

6. Ericsson Security and Safety Rules
Some mandatory announcements:
●Please don't roam the building without supervision by Ericsson staff.
●Please don't take pictures. The organizers will.
●Sign-out at the reception when leaving the building.
●Restrooms are across the hall to the left.
●Emergency exits exist. Please don't make us use them.

7. #cTENcf

8. As a CNCF chapter, we are required to host an event every 90 days. Our next event is
scheduled for October 29th, but details are still being finalized.
If you are interested in presenting a topic, please reach out to any of the organizers (e.g. via
LinkedIn) or email us at [email protected].
Event will be published via community.cncf.io/cloud-native-aachen — meetup.com event will
also be available, but no registration.
NEXT EVENT

9. AGENDA
●7pm: Opening words (you’re listening to them right now!)
●7:15pm: “New Features in Identity & Secrets Management with K8s 1.33+”
by Simon Ostendorf (CANCOM)
●7:45pm: Food & drinks, Ericsson 5G Lab Tour
●8:15pm: “Expanding Kubernetes Networking for Telco CNFs”
by Ingo Meirick (Ericsson)
●8:45pm: Food & drinks, Ericsson 5G Lab Tour

10. New Features in Identity and
Secret Management with K8s
1.33+
Simon Ostendorf

11. New Features in Identity and
Secrets Management in K8s 1.33+
SimonOstendorf|CloudNativeAachenMeetup|21.08.2025

12. Topics
2
•About Me
•Context& Motivation
•Integration ofSecret Stores
•KubeletCredentialProvider
•KEPs
•Wrap-Up & Takeaways

13. About Me
3
•Working StudentContainer Platform@ CANCOM
•Study formastersdegreeComputer Science@ FH-Aachen
•Interestedin Kubernetes, Cloud Native & Open Source
•Member ofMeetup sincedayone
•Contributedtovariousprojects
(cluster-api, cluster-api-provider-openstack, cloud-provider-openstack, …)
•Main focus: (End-to-End) Automation ofCluster lifecycle
and usageSimon Ostendorf

14. UsageofKubernetesSecrets
4
•Storedin etcd(default: unencrypted)
•Usedin manyways
•InjectingEnvironment Variables intoPods
•InjectingFiles intoPods
•StoringCredentialsforControllers
•Image Pull Secrets
•Long LivedService Account Tokens
•…
CONTEXT& MOTIVATION

15. Whatshouldbechanged?
5
CurrentlywithKubernetesSecrets only ExpectedSolution
Manual management(create, update, delete) Automatedsecretmanagement
Mustexistin everycluster
(maybealso in everynamespace)
Single source oftruth
Storedunencryptedin etcd Storedencrypted
NormallyRBAC onlyon namespacelevel
(readall secretsofthatnamespaceornone)
(but possible withresourceName)
Fine permissionmanagement
CONTEXT& MOTIVATION

16. Secret Stores
6
•Cloud Provider SpecificSecret Stores
•AWS Secrets Manager
•Azure Key Vault
•Google Cloud Secret Manager
•…
•HashiCorpVault/ OpenBao
•Open Source Secret Store(s)
•Independent fromspecificCloud Providers
•Alreadyin use@ CANCOM
•Many integrations: different authmethodsand secretengines,
canbeusedwithKubernetes, OpenTofu(Terraform), Web API…
CONTEXT& MOTIVATION
Forthistalk: „Vault“ assynonym forHashiCorpVaultorOpenBao

17. Replacing„Plain Secrets“
7
•Encryption at Rest
•With „hardcoded“ tokens(keyaccessiblefromcontrol-plane host)
•With KMS (keymanagementservice)
•Vaultwithtransitengine(vault-kubernetes-kms)
•Sealed Secrets
•Store secretsin git(nexttoothermanifests), singlesource oftruth
•Syncthemusingnormal GitOpsworkflow
•External Secrets Operator / VaultSecrets Operator
•SyncSecrets intoKubernetesSecrets
•Works withdifferent secretstores
INTEGRATION OFSECRET STORES

18. GetridofKubernetesSecretscompletely
8
•Secret Store CSI Driver
•Mount secretsdirectlyasvolumeintoa pod
•Secret not visible in thecluster, onlymountedat runtime
•VaultAgent Injector
•Directlyinsertsecretsasfilesorenvironmentvariables at podstart(usinginit
container)
•Auth usingpodidentity
•Secret not visible in thecluster, onlymountedat runtime
INTEGRATION OFSECRET STORES

19. ReplacingLong LivedService Account Tokens
9
•Severalproblems(norotations, easy toleak, wider attackwindow…)
•UsingsecretsforlonglivedServiceAccounttokensis„not recommended“
•Mitigateusingshortlivedcredentials
•AlreadyusedforPod ServiceAccounttokenssinceKubernetes1.22
•ProjectedService Account Token
•CreatedusingTokenRequestAPI and mountedusingprojectedvolume
•Reference toa BoundObject(Identity thatthetokenwas createdfor)
•Short livedcredentialsin external components
•canbepainful(generatea tokeneveryX minutes/days, update themwhereneeded)
•KubernetesToken Request API
•VaultKubernetesSecret Engine
•Fine grainedaccessvia Vaultpolicies
INTEGRATION OFSECRET STORES

20. UsingPod Identity forAuth
10
•VaultAuthentication using…
•AppRole(username/passwordforautomatedworkflows)
•Certificate
•JWT
•…
•All methodsrequireadditional secretsorarenot fine-grainedenough
•ProjectedService Account Tokens useBoundObjectReference
•Verifywhothetokenwas createdfor(Identity)
•Can beusedtocheck identityduringauthentication
•VaultKubernetesAuth Method
•Allowspecificserviceaccountnamesornamespaces
•Verifiedvia TokenReviewerAPI
INTEGRATION OFSECRET STORES

21. WhataboutImage Pull Secrets?
11
•Problems:
•Still Secrets
•Havetoexistin everynamespace
•Havetoberotatedeverytime thecredentialsarerotated
•Can I storeimageregistrycredentialsin Vaulttoo?
•SyncSecrets and useimagePullSecrets
•Boring and not complexand cool enough, right?
•Can I getridofSecrets(KubernetesObject)completely?
•KubeletImage CredentialProvider
KUBELET CREDENTIAL PROVIDER

22. CredentialProvider: Just a binary
12
•Plugin forthekubelet
•Binaryon everynode
•Configurationvia CredentialProviderConfig
•apiVersion: kubelet.config.k8s.io/v1
kind: CredentialProviderConfig
providers:
-apiVersion: credentialprovider.kubelet.k8s.io/v1
name: example
matchImages:
-"registry.example.com"
•Standardizedcommunicationbetweenproviderand kubelet
•Communication via stdin/ stdout
•CredentialProviderRequestand CredentialProviderResponse
KUBELET CREDENTIAL PROVIDER

23. (Yourown) CredentialProvider
13
•Public providerforAWS and GCP and someexamplerepos
•But: NoProvider thatI coulduse
•Whynot writeyourown?
•Easy communicationinterface
•Onlya binaryneeded
•Go packagewithall types
•Thoughts
•ShouldinteractwithVault
•Nostaticcredentialson thenodesorin thecluster
KUBELET CREDENTIAL PROVIDER

24. Image Pull Process
14
KUBELET CREDENTIAL PROVIDER
Pod
Scheduling
Kubelet
Image
Check
Check
CredentialProviderConfig
Call
Credential
Provider
Pull Image
using
Credentials
Start Pod
Auth to
Vault
Read
Credentials
fromVault
Return
Credentials
toKubelet
matchImages:
-"registry.example.com"

25. Problem: „AuthenticatetoVault“
15
•Pod shoulduse„own identity“ topull images(PSAT)
•Otherwiseall podson all nodescouldpull images
•„(Projected) Service Account Token forImage Pulls“
•Alpha Feature(Feature Flag) startingwithKubernetes1.33
•Spoiler: Will bebetain Kubernetes1.34 (in 6 days)
•CredentialProvider and Secret Store havetosupport this
•AdjustCredentialProviderConfig
•providers:
-name: example
tokenAttributes:
serviceAccountTokenAudience: "example"
requireServiceAccount: true
•Provider canuseService Account Token forAuth againstVault
KUBELET CREDENTIAL PROVIDER

26. kubelet-credential-provider-vault
16
•Warning: Writtenforshowcase, (currently) not usedin production
•Provider isavailableat github.com/simonostendorf/kubelet-credential-provider-vault
•Open Source, feelfreetouseand contribute
KUBELET CREDENTIAL PROVIDER

27. KEPs: Hownewfeatureslandin Kubernetes
17
•Whatisa KEP?
•KubernetesEnhancement Proposal
•Official design proposalprocess(RFC)
•Explainswhyand howa newfeature will beimplemented
•Includes motivation, design details, apichanges, testingand rolloutplan
•WhyKEP?
•Keep high standardsfornewenhancements
•Keep track ofcurrentstatus: alpha, beta, GA
•Keep track ofall dependencies: docsupdate, code changesin different
repos
KUBERNETES ENHANCEMENT PROPOSALS

28. KEP Lifecycle
18
•Lifecycle
•Discussionoftheideain theSIG (Special Interest Group)
•Write KEP in kubernetes/enhancementsrepo
•Review & ApprovalofKEP
•Implementation: Alpha -> Beta -> GA (takesmultiple releasestocomplete)
•Example
•KEP-2535: EnsureSecret PulledImages
•KEP-4412: Projected service account tokens for Kubelet image credential
providers
KUBERNETES ENHANCEMENT PROPOSALS

29. Wrap-Up & Takeaways
19
•Many optionsforsecretmanagement
•Decideforeachusecasewhattodo
•Secret Store canbea goodoption
•Betterdo somethingthanusingunencryptedsecrets
•Most important: focuson least overheadforusers
•Try tomakeasseamlessaspossible
•(thinkaboutprocessautomation)
•ChangestoKubernetesareintroducedvia KEPs
•Trend: Core Kubernetesshouldonlycontaincorecode, plugablecloudprovider
specificcode
•Allowsnon hyperscalerstointegrate
•Be up-to-date aboutnewKEPs: „Last Week in KubernetesDevelopment“ Blog
(lwkd.info)

30. 20
Thankyou!
Letschataboutthisand
othertopicsin thebreak

31. Enjoy the food & drinks, courtesy of our sponsor
Interested folks can join the Ericsson 5G Lab Tour offered by Maciej Muehleisen
There is a basic post-event survey you will receive via email, if you have any feedback please
share it in the survey!
Don’t forget to also tell your colleagues and friends about our events.
BREAK

32. Expanding Kubernetes Networking for
Telco CNFs
Ingo Meirick

33. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 1of 20
Expanding Kubernetes
Networking for Telco
CNFs

34. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 2of 20
About me
●Studied Electrical Engineering at RWTH Aachen
●Working for Ericsson since 1998
●Working with Cloud Native Applications since
2019, mainly in the networking area
●Personal interests
–Sports in general, Hiking, Chess

35. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 3of 20
Agenda
●Kubernetes Networking recap
●Telco 5G System Architecture and network requirements
●Building blocks for K8s multi-networking
–PodNetworkAPI
–Dynamic Resource Allocation (DRA) and MultusCNI
–Gateway API

36. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 4of 20
Kubernetes Networking -Recap
•Flat, unified network: Each pod gets its own IP
•Pod-to-Pod: Direct communication, no NAT
•Service abstraction: Stable virtual IPs & DNS
What K8s networking provides
•Pods: own network namespace & IP
•CNI plugin:sets up networking (examples are Calico, Flannel, …)
•Kube-proxy: routes to Services
•CoreDNS: service discovery.
Core building blocks

37. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 5of 20
Kubernetes Networking –
External Connectivity
●Service of Type LoadBalancer
–Cloud providers (AWS, Azure, GCP, etc) have their own native load
balancer
–Traffic from the external load balancer is directed to backend Pods
–The cloud provider decides how it is load balanced
–For private clouda load balancer on the cluster can be used (like
MetalLB, Cilium)
–Note: source NAT is performed by default
●Default traffic flow
External client -> LB -> Node 1 (does SNAT) -> Node 2 -> Endpoint

38. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 6of 20
Kubernetes Networking –
Ingress and Gateway API
●Ingress Controller
–Acts as HTTP proxy and provides L7 based
load balancing
–Aware of HTTP information, like URIs,
hostnames, paths, and more
–Multiple applications can be exposed behind
a single Ingress Controller
–Usually terminates external (m)TLS
connections
–Configured by Ingress Resource
–Examples: Nginx, Contour, Kong
●Gateway API
–Next generation of Kubernetes Ingress, Load
Balancing, and Service Mesh APIs
–Role-oriented –composed of API resources
which model organizational roles that use
and configure K8s service networking
–Expressive -Supports core functionality for
things like header-based matching, traffic
weighting, and other capabilities that were
only possible in Ingress through custom
annotations

39. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 7of 20
Kubernetes Networking –
Gateway API use case
●Multiple applications behind a single Gateway
●Cluster operator responsible for setting up the
Gateway resource including allowed domains,
certificates and default policies
●Developer responsible for setting up HTTPRoute
resource to expose their application services

40. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 8of 20
5G System Architecture
●Separate Control Plane and User Plane
●Network Functions (NFs) are defined by 3GPP
standard and consist of smaller unit functions
called NF services
●NFs implemented using cloud-native design
principles are called Cloud-native NFs (CNFs)
●Different NFs connect to each other via uniform
interface, called service-based interface (SBI),
HTTP2/API based
AUSF Authentication Server Function
AMF Access and Mobility Management Function
AF Application Function
DN Data Networks
SMF Session Management Function
UDM Unified Data Management
NEF Network Exposure Function
NSSF Network Slice Selection Function
NRF Network Repository Function
PCF Policy Control Function
UPF User Plane Function
(R)AN (Radio) Access Network
A Network
Function (NF)
Service based
interfaces
User Equipment
e.g. devices
Radio
Network
Non-service
based interfaces
Reference: 3GPP TS 123 501 V15.3.0
SBI: HTTP2/
API based

41. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 9 of 20
Network Requirements from Telco CNFs
●Support for multiple networks and interfaces
●Enable traffic separation
●Support traffic without NAT (ingress & egress)
●Support VIPs (ingress & egress)
●Support multi-homed SCTP load-balancing
●Provide connectivity through acceleration HW
(SR-IOV, DPDK)

42. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 10 of 20
Building blocks for multi-network
●PodNetwork API to provide a standardized API for managing pod-level
networking
●Introduction of DRA (Dynamic Resource Allocation) to support dynamic
allocation of additional network interfaces in a K8s native way
●Extension of Gateway API to support configuration of secondary networks
and routing to target applications in the K8s cluster

43. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 11 of 20
PodNetwork API
●SIG Network community is working on defining
PodNetwork API as part of multi-network
activity
●It is required to have an object to integrate core
networking concept (services, policies) to
secondary network
●Initially the proposal was to add it to the pod
spec, but that was rejected as core APIs should
not be changed
●Latest design proposal is to use Dynamic
Resource Allocation (DRA) instead and add
PodNetwork through ResourceClaims
apiVersion: v1
kind: PodNetwork
metadata:
name: dataplane
spec:
enabled: true
provider: "example.dra.x-k8s.io/network"
parameters:
master: "eth0"
mode: "bridge"
ipam:
type: "host-local"
subnet: "192.168.1.0/24"
rangeStart: "192.168.1.200"
rangeEnd: "192.168.1.216"
routes:
- dst: "0.0.0.0/0"
gateway: "192.168.1.1"
status:
conditions:
- lastProbeTime: null
lastTransitionTime: "2022-11-17T18:38:01Z"
status: "True"
type: Ready

44. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 12 of 20
DRA for network interfaces
●“DRA is a Kubernetes feature that lets you
request and share resources among Pods. These
resources are often attached devices like
hardware accelerators” – see K8s
documentation
●Beta feature in K8s v1.33 that needs to be
enabled, in addition a resource driver must be
installed, will be GA in K8s v1.34
●Network DRA drivers (under development)
–kubernetes-sigs/CNI-DRA-Driver
–google/dranet
–nvidia/k8s-GPU-DRA-Driver

45. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 13 of 20
Multus CNI plugin
●Takes Place as Primary CNI
–Calls the previous Primary CNI to keep
seamless Pod Network Configuration
–Supports adding multiple interfaces to a pod
●Based on the CNI Hook
●Pod Network Attachment
–API in Pod Annotations (JSON)
●Request + Result (MAC, IPs…)
–CNI Config in NAD CRD
–Not a standard K8s API
–No K8s Validation and Scheduling support
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
name: macvlan-nad
spec:
config: '{"cniVersion":"1.0.0", "type":"macvlan", "master":"eth0"}'
---
apiVersion: v1
kind: Pod
metadata:
name: my-pod
annotations:
k8s.v1.cni.cncf.io/networks: '[{"name": "macvlan-nad", "interface": "net1"}]’
k8s.v1.cni.cncf.io/network-status:'[{"name":"macvlan-
nad","interface":"net1","ips" :["172.168.1.10"],"mac":"00:01:ec:32:ec:f2"}]'

46. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 14 of 20
Comparison – Config (see KubeCon NA 2024 presentation)

47. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 15 of 20
Comparison – Status (see KubeCon NA 2024 presentation)

48. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 16 of 20
Gateway API Extension
●Gateway API is a family of API kinds that provide
dynamic infrastructure provisioning and advanced
traffic routing
●Gateway API is the successor of Ingress API and its
focus is on exposing HTTP based network services
●Extensions required to support multi-network
–EndpointSelector (GEP-3539) to support selecting
of secondary network IPs as this is not supported
by standard K8s Service
–L34Route object to support routing based on 5-
tuple (SRC/DST IP and Port plus Protocol)
●Implementation of ‘multi-network Gateway’
consisting of a Controller, Stateless-Load-Balancer
and Router (see Meridio 2.x documentation)

49. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 17 of 20
Example Network Setup from Meridio 2.x

50. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 18 of 20
Example configuration from Meridio 2.x
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
name: sllb-a
spec:
gatewayClassName: meridio-experiment/stateless-load-balancer
listeners: # This is to be ignored
- name: all
port: 4000
protocol: TCP
infrastructure:
annotations:
k8s.v1.cni.cncf.io/networks: '[{"name":"vlan-100","interface":"vlan-
100"},{"name":"macvlan-nad-1","interface":"net1"}]' # Networks attached to the
gateway workloads
meridio-experiment/networks: '[{"name":"macvlan-nad-1","interface":"net1"}]' #
Networks towards the service selected pods
meridio-experiment/network-subnets: '["169.111.100.0/24"]’
apiVersion: meridio.experiment.gateway.api.poc/v1alpha1
kind: GatewayRouter
metadata:
name: gateway-a-v4
labels:
service.kubernetes.io/service-proxy-name: sllb-a
spec:
address: 169.254.100.150
interface: vlan-100
bgp:
localASN: 8103
remoteASN: 4248829953
holdTime: 24s
localPort: 10179
remotePort: 10179
bfd:
switch: true
minTx: 300ms
minRx: 300ms
multiplier: 5
apiVersion: meridio.experiment.gateway.api.poc/v1alpha1
kind: L34Route
metadata:
name: vip-20-0-0-1-multi-ports-a
spec:
parentRefs:
- name: sllb-a
backendRefs:
- name: service-a
port: 1 # This must be set but is being ignored.
priority: 10
destinationCIDRs:
- 20.0.0.1/32
sourceCIDRs:
- 0.0.0.0/0
sourcePorts:
- 0-65535
destinationPorts:
- "4000"
- "4001"
protocols:
- TCP
apiVersion: v1
kind: Service
metadata:
name: service-a
labels:
service.kubernetes.io/service-proxy-name: sllb-a
spec:
clusterIP: None
selector:
app: example-target-application-multi
meridio-experiment/dummy-service-selector: "true"

51. | EEDIME Ingo Meirick | 2025-07-03 | Open | Page 19 of 20
Kubecon and K8s Community activities
●Kubecon Japan 2025, Reimagining Cloud
Native Networks: The Critical Role of DRA
–Lionel Jouin and Sunyanan Choochotkaew
●Kubecon EU 2025, Uncharted Waters: Dynamic
Resource Allocation for Networking
–Lionel Jouin and Miguel Duarte Barroso
●Kubernetes Contributor Summit NA 2024,
Multi-networking: Challenges, progress and
what's next
–Lionel Jouin and Doug Smith
●Kubecon NA 2024, CNI Updates and Direction!
–Lionel Jouin and Michael Zappa
●CNI
–Weekly Meeting (Monday)
●WG Device Management
–Every Week (Tuesday / Wednesday)
●Multi-Network
–Every Week (Wednesday)
●K8S Network Plumbing WG
–Every Two Weeks (Thursday)

53. Thank you for coming!
Enjoy the remaining food and drinks with us to wrap up the evening.
Please don’t forget to turn in your visitor pass when you leave.
Interested folks can join another Ericsson 5G Lab Tour offered by Maciej Muehleisen