KubeCon + CloudNativeCon Japan 2025

As Generative AI reshapes the tech landscape, its tools and solutions often feel overwhelming and disconnected - like scattered elements waiting to be forged into something greater. What does a complete GenAI platform look like? And how does it differ from application-focused platforms many organizations already run?

We’ll guide you through a practical transmutation of your platforms to add GenAI features. We’ll first define the base elements needed to deploy LLM inference on Kubernetes. We’ll then blend key elements into the MVP stage, adding core enterprise AI components like an AI Gateway, shared interfaces via Dapr, and KServe-based deployment strategies. Finally, we’ll tackle advanced features - intelligent load balancing for LLMs, observability patterns, and cost optimizations.

More than a tools showcase, this session is packed with real lessons from enterprise GenAI platform engineers, to help transmute your platform into the philosopher’s stone for AI innovation.

Traditional service meshes often rely on sidecars, which can introduce added complexity and require application restarts. But things are changing. Modern service mesh is evolving into what we now call a service network—where the mesh dissolves into the infrastructure itself, becoming part of the infrastructure.

In this live demo, Lin will showcase how today's service mesh can be completely transparent to applications. She'll demonstrate how you can use gateways to implement Layer 7 traffic management and security policy enforcement, all while running her AI application that engages with and analyzes the audience's mood.

Our hero, a running app in a K8s prod environment, knows they are destined for greater things! They’re serving end users, but the value of the cloud is not realized. Hero’s devs toil on custom integrations, deployment is brittle and slow, and security and governance are HARD. Hero longs for a developer platform with consistent and repeatable system building blocks.

It is up to you, the audience, to guide our hero’s transformation from a lost and confused app to one built on a solid foundation that abstracts away complexity and promotes innovation. In their fifth KubeCon ‘Choose Your Own Adventure’-style talk, Whitney and Viktor will present choices that an anthropomorphized app must make as they build an Internal Developer Platform, enabling the devs to have self-service access to widely used system capabilities. Throughout the presentation, the audience (YOU!) will vote to decide our hero's path! Can we navigate CNCF projects and build a platform before the session time elapses?

Open source communities are a celebration of our different cultures. The single reason open source communities are able to build and ship software like Kubernetes, which is used so widely, is because of the collaboration of people from all around the globe.

This also means a lot of challenges when people are working together, like language barriers, cultural differences and timezones. In this talk I'll be sharing some lessons I've learnt about fostering open source communities amidst the differences. In the last two years, serving in the K8s release team and as the SIG Docs New Contributor Ambassador, I've experienced first hand how challenges like language barriers can hinder enthusiastic contributors. This talk is about these different challenges and how we can overcome them.

In an effort to inspire everyone in the open source community to embrace our differences and welcome everyone as we work together, I'm learning Nihongo to attempt giving this talk in the Japanese language.

As Generative AI adoption increases, organizations face accelerating challenges in deploying, scaling, and managing access to diverse AI models across cloud and on-prem environments. Envoy AI Gateway utilizes Envoy Proxy’s powerful filter architecture and extensibility through ext-proc to deliver key features such as centralized credential management, intelligent model routing, and LLM token usage control.
As the first CNCF-backed open source AI gateway, Envoy AI Gateway is built on top of a robust, high performance Envoy Gateway to help democratize AI infrastructure for organizations of all sizes.

In this talk, we will dive into the architecture of Envoy AI Gateway to learn how it extends Envoy’s capabilities to efficiently manage AI-driven workloads for enterprise needs, while providing robustness, scalability, and adaptability in the rapidly-changing generative AI landscape. We will also showcase a demo of an AI agent seamlessly accessing models anywhere through a unified API.

When using container image vulnerability scanners like Trivy, a large number of vulnerabilities may be detected. However, not all of them necessarily require an action. This is because not all libraries or command-line tools included in the container image are actually utilized.

For example, the `python:3.12.4` image includes a `git` binary with the vulnerability CVE-2024-32002. This vulnerability does not need an immediate action if it is known that the Python application being run does not execute `git` commands.

VEX (Vulnerability-Exploitability eXchange) formats such as OpenVEX can be used to suppress such false alarms.
However, VEX is still not widely adopted due to the difficulty of manual analysis and classification of vulnerabilities.

This presentation introduces VexLLM, a tool that helps writing VEX by leveraging LLMs. VexLLM is available as a plugin for Trivy.

GitHub: https://github.com/AkihiroSuda/vexllm

Everyone is talking about platform engineering. You see smooth demos of golden paths and self-service platforms. However, there’s a significant area of challenges that is less talked about and thus often neglected when designing developer platforms.

In this talk, we’ll explore the often-overlooked day 2 challenges that platform teams face. We’ll dissect the area of day 2 into the many sub-areas and challenges they pose. Drawing on real-world experiences, including notable migrations that many in this community have faced, we'll shed light on the pain behind developer platforms and discuss solutions to these issues. Among others, we’ll delve into practical strategies for managing versioning and rollouts, and highlight the significant hurdles encountered, such as dependencies on end user teams or GitOps.

Join us for insights, strategies, and stories from the trenches that will help you navigate the complexities of service iteration in developer platforms.

High availability in Kubernetes typically requires a 3-node setup to support etcd's Raft algorithm. But what if you could achieve HA with only 2 nodes, slashing infrastructure costs by over 30% without sacrificing reliability? This is a game-changer, especially for deployments in retail and manufacturing scaling across hundreds or thousands of locations.
Join us to explore a groundbreaking 2-node HA Kubernetes solution, built by evolving the Raft algorithm for etcd. Unlike alternatives that compromise on compatibility, our approach delivers etcd-based HA, which can tolerate both node failures and network partitioning like a traditional 3-node cluster. You can seamlessly transit between 3-node and 2-node cluster utilizing standard tools like kubeadm or CAPI. This approach requires only a simple shared storage witness.
In this session, we will unpack the mechanics of this innovation, demonstrate 2-node cluster provisioning, and showcase its resilience under real-world failure scenarios.

Sustainable growth of open-source projects requires both technological advancement and collaborative growth within a diverse community. How to create a community with vendor diversity that can collectively drive technological progress is a hot topic of concern today. It is increasingly clear that establishing the right governance structure and technical roadmap is critical during a project’s evolution.

KubeEdge, the industry’s first cloud-native edge computing open-source project, has grown from its launch in 2018 to achieving CNCF graduation this year. Over the past few years, KubeEdge has worked alongside multi-partners to implement practical applications in various fields, including satellite and smart vehicles, while fostering the robust development of multiple SIGs.

In this session, we will discuss the KubeEdge graduation journey, focusing on technical roadmap, community governance, and project maintenance. We will explore how to unite a diverse array of vendors within the community to advance our technological initiatives. Additionally, we will highlight the latest developments of KubeEdge in the fields of AI and robotics, aligning with current trends. Join us to explore how to build a mature, diverse, and technologically leading open-source community.

“Wa” is a traditional way of behavior embedded in most of Japanese, meaning harmony, behaving for others etc. Under the spirit of “Wa”, Let’s see project maintainer, local community leader, enterprise developer and business strategist in Japan and hear their opinions to facilitate collaboration with global community and increase contributions from Japan.

This panel, featuring instructors from Kubernetes Upstream Training Japan, explores how this initiative has accelerated open-source involvement across the country since 2019. Our panelists will share personal stories, highlighting how the training lowers barriers, boosts motivation, and drives long-term community engagement. We’ll examine the current status of Japanese contributions to Kubernetes, discuss lessons learned from past participants, and propose strategies to strengthen future growth. Attendees can expect a candid conversation about nurturing collaboration, overcoming cultural and linguistic challenges, and fostering a thriving ecosystem. Whether you’re an aspiring contributor or a seasoned leader, join us to gain practical insights into cross-cultural community-building and discover the next chapter for cloud-native innovation in Japan.

Join us on an anime-powered journey to explore the power of eBPF in cloud native. Inspired by Sailor Moon and Dragon Ball GT, this talk breaks down how eBPF enhances observability, networking, and security, using the Sailor Guardians and Gohan to make eBPF approachable. We’ll break down topics like real-time observability by comparing it to psychic flames.
And just as unchecked power in anime can lead to chaos, eBPF’s immense capabilities need to be used wisely. Drawing from Dragon Ball GT's arc where the Dragon Balls become a threat, we’ll examine best practices for safe deployment of eBPF (e.g., LSM, verifier constraints, Linux Capability restrictions). Spoiler alert: our Sailor Guardians and Gohan will come out victorious, worry not!

By the end, you’ll gain a clear understanding of how to wield eBPF safely and effectively in cloud native environments, no Super Saiyan transformation required!

SBOMs (Software Bills of Material) are essential for improving visibility and security in the software supply chain. As open-source code drives modern development, organizations face growing security risks due to limited transparency in software dependencies. Attacks like SolarWinds (2020) and Kaseya (2021) highlight the urgent need for stronger software supply chain security.
However, SBOMs are often inaccurate. This talk explores why these inaccuracies occur, how attackers exploit them, and how to address these issues. A key challenge is dependency management file analysis (e.g., cargo.toml for Rust), which struggles to track components effectively.
Enter SBOMit, an OpenSSF sandbox project leveraging in-toto attestations to create cryptographically verifiable SBOMs. By capturing supply chain steps as they occur, SBOMit enhances accuracy, mitigates tampering risks, and strengthens security. This talk examines SBOMit’s role in improving SBOM reliability across the CNCF ecosystem.