Arthur Oliveira
Red Hat, Senior Partner Technical Account Manager
Vila Nova de Gaia, Portugal
Actions
With 22+ years of experience in systems, infrastructure, automation, and security, Arthur is a Senior PTAM at Red Hat. A Linux enthusiast since the early 2000s, he currently supports partners who embed their solutions with Red Hat OpenShift, OpenShift Data Foundation, and Red Hat Device Edge. He is passionate about distributed systems, open source, containers, troubleshooting, and agile culture.
Links
Area of Expertise
Topics
Zero-Trust Edge Diagnostics: Capturing .NET Core Dumps in Read-Only Filesystems
AI Writes the Code, but How Do We Debug the Memory Leaks in Hardened Containers?
When deploying containerized workloads to highly secured edge nodes (such as those running MicroShift or other Lightweight Kubernetes distros), administrators face an operational paradox: security policies mandate strict hardening (e.g., dropping all Linux capabilities, enforcing runAsNonRoot, and mounting the root filesystem as read-only), but standard diagnostic tools assume a writable, interactive environment. When a .NET application experiences an Out-of-Memory (OOM) crash or a memory leak under these constraints, standard debugging avenues like kubectl exec are blocked, and critical diagnostic data disappears with the container.
In this session, Arthur Oliveira, Senior Partner Technical Account Manager at Red Hat, breaks down the technical hurdles of debugging locked-down edge containers. He details the underlying mount and process (PID) namespace conflicts that cause standard kubectl debug sessions to fail for .NET runtimes—such as socket path truncation caused by long, highly nested TMPDIR paths. He then demonstrates a secure, production-viable solution to capture crash dumps natively to Persistent Volumes using runtime environmental variables (COMPlus_DbgEnableElfDumpOnCrash and COMPlus_DbgCrashDumpType), alongside a shell-less debug container leveraging a Go-based entrypoint utility (pid-finder) to find and dump target processes without launching insecure interactive shells.
Edge AI on Immutable Infrastructure: Integrating NVIDIA GPUs with Bootc and MicroShift
Deploying low-latency AI inference workloads onto resource-constrained edge appliances requires combining lightweight Kubernetes with immutable, container-native operating systems.
However, integrating hardware acceleration drivers into image-mode Linux while maintaining zero-downtime transactional OS updates presents significant technical hurdles.
This session explores a field-tested architecture for running GPU-accelerated workloads on single-node edge appliances using OCI image-mode Linux (bootc) and MicroShift.
Based on practical lab implementations and edge AI testing, the speaker demonstrates how to package kernel driver modules into containerized build layers, manage Secure Boot Machine Owner Key (MOK) enrollment workflows, and configure CUDA time-slicing without inducing container crash loops.
The presentation details how transactional host OS updates interact with containerized driver layers to ensure seamless, rollback-safe edge AI deployments.
Debugging in the Dark: Zero-Trust Diagnostic Sanitization for Sovereign Cloud Kubernetes
In sovereign clouds and regulated environments, zero-trust security mandates often freeze diagnostic sharing.
Standard Kubernetes diagnostic bundles capture sensitive assets (i.e. secrets, VPC topologies, and tenant metadata), creating compliance roadblocks during incident triage.
This session presents a zero-trust, privacy-preserving diagnostic architecture for sovereign Kubernetes clusters. The speaker examines a multi-stage sanitization pipeline:
1 - Automated Pre-Pass Processing: Shell utilities stream-filter binary archives (.tar.xz) before sanitization, reducing 40GB+ dumps by 60% in minutes.
2 - Regex & AST Redaction: Using must-gather-clean with custom rules to scrub credentials, IPs, and tenant IDs at the source.
3 - Non-Privileged Pipelines: Deploying Vector and OpenTelemetry collectors with restricted SecurityContexts to stream audit logs to Loki without root access.
4 - Manifests-Only Reduction: Distilling heavy archives into audited YAML specifications.
Surviving the Split-Brain: Solving the 2-Node Kubernetes Quorum Problem with GitOps at the Edge
In traditional cloud data centers, ensuring Kubernetes High Availability (HA) relies on a strict majority to maintain etcd quorum. But what happens at the far edge, where physical space, cooling, and hardware constraints restrict organizations to deploying just two nodes per site?
In a standard 2-node Kubernetes topology, a network partition (a "split-brain") causes an immediate loss of quorum. The API server becomes unresponsive, new pods cannot be scheduled, and operators are effectively blinded. While standard enterprise solutions rely on "Fence and Recover" strategies that forcefully reboot isolated nodes to protect data consistency, this approach is often a dealbreaker for mission-critical industrial environments that require continuous, "Active-Active" local availability.
In this talk, I will share a real-world architectural case study on how to build a resilient, 2-node edge appliance that survives its own network failures. We will explore:
- The fundamental conflict between the Raft consensus algorithm and industrial edge uptime requirements.
- Why attempting to run an unfenced, clustered etcd across two nodes carries severe supportability and data corruption risks.
- How to break the traditional cluster paradigm by deploying a "1+1 Redundant Architecture" using independent, lightweight nodes (such as Red Hat Device Edge / MicroShift).
- How to seamlessly tie these independent nodes together using VRRP (Keepalived) for fast, 3-second traffic failover, and a declarative GitOps agent (ArgoCD) to guarantee configuration consistency without a shared database.
Attendees will leave with a practical blueprint for shifting from centralized control planes to a "Shared Nothing" architecture, leveraging GitOps to guarantee continuous local availability and automated recovery at the far edge.
Solving the Air-Gapped Edge Paradox with Bootable Containers
In maritime and industrial logistics—whether a cargo ship in the Atlantic or a mining drill underground—"Cloud Native" hits a hard physical wall: connectivity. Pushing standard 10GB containerized updates to disconnected devices is practically impossible. Yet, the need for secure, reliable updates remains critical.
This session explores moving from package-based OS management to Image Mode for Linux (bootc), solving the paradox of maintaining immutable systems at the extreme edge.
We will demonstrate building "physically bound" appliances where the OS and orchestrator (MicroShift) ship as a single container image. We'll show how to embed application workloads directly into the bootable OS to bypass runtime registry dependencies entirely.
Attendees will learn how to leverage standard OCI registries and A/B partition schemas to guarantee atomic updates and instant rollbacks, ensuring absolute reliability in environments where "calling support" simply isn't an option.
The Anatomy of an Edge Collapse: Protecting Your Kubernetes Control Plane from Runaway Workloads
In traditional cloud data centers, elasticity is your safety net. If a runaway application leaks memory or spikes CPU usage to 100%, the worst-case scenario is usually isolated... the scheduler evicts the pod, a worker node might crash, but the control plane remains safely insulated on dedicated hardware.
At the far edge, operating under strict physical and hardware constraints, this paradigm completely collapses. When running Kubernetes on single-node industrial appliances, the node is the cluster. Your application workloads share the exact same finite compute, memory, and storage pool as the Kubernetes control plane, the container runtime, and the software-defined network.
Drawing from real-world field escalations in mission-critical environments, this talk dissects the "Anatomy of an Edge Collapse": a timeline where a simple application memory leak at T+0s leads to control plane starvation at T+120s, culminating in a catastrophic etcd timeout and total system failure by T+180s.
To prevent this, platform engineers must build edge appliances that can survive their own applications. Attendees will learn a practitioner’s "Layered Defense Blueprint"
to guarantee edge resilience, including:
- OS & Kernel Hardening: Moving away from dangerous systemd sandboxing and instead using native kernel tuning (CPUAffinity, kubelet.reservedSystemCPUs) to physically partition workloads.
- Configuring Orchestrator Tripwires: Defining hard evictionHard thresholds for memory and disk (nodefs.available) to force the platform to kill greedy pods before the kernel panics.
- Namespace Fencing: Using LimitRanges and ResourceQuotas to ensure malicious or leaky pods are instantly OOMKilled within their own boundaries, leaving the adjacent control plane untouched.
Arthur Oliveira
Red Hat, Senior Partner Technical Account Manager
Vila Nova de Gaia, Portugal
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top