Marvin Beckers
Senior Software Engineer at ClickHouse
Nürnberg, Germany
Actions
Marvin is a Senior Software Engineer at ClickHouse, maintainer for the kcp project and CNCF Ambassador. He started out as a Linux sysadmin, and found himself gradually turning into a software engineer while automating Kubernetes cluster operations. He has been working with Kubernetes in various roles since 2018.
Badges
Area of Expertise
Topics
Stateful Workloads at Scale – Extending Kubernetes for Running OLAP Databases as a Service
Stateful workloads, especially databases, have always been framed as problematic on Kubernetes. In this talk, we want to clear up this misconception by showing that Kubernetes is highly extendable and is in fact used to host ClickHouse, an OLAP column-oriented database, at scale for our DBaaS offering.
We discuss a variety of mechanisms and extensions built on top of existing Kubernetes logic that helps us run, update and scale databases for our customers with zero downtime. Throughout this talk, we discuss what we call MultiSTS (the usage of multiple StatefulSets) and MBB (Make-Before-Break) and how those concepts helped us overcome challenges with stock Kubernetes primitives, particularly for our requirement to always provide full capacity to our customers.
In this case study, attendees will gain insights into the challenges and solutions posed by running a successful hosted database service on Kubernetes. They will take away the toolset to extend Kubernetes for database workloads.
When Multitenancy Goes Wrong: A Deep Dive Into kcp’s First CVE
kcp, a CNCF Sandbox project, is a control plane for serving Kubernetes-style APIs built on top of Kubernetes core libraries with a strong focus on multitenancy. But what happens when isolation, a core pillar of multitenancy, begins to crumble?
Meet CVE-2025-29922, initially rated with “Medium” severity, turning into a “High” 9.6 scored beast. We'll explore virtual workspaces, a kcp feature that provides a "single pane of glass" for service providers to see and manage their resources across many different tenants. The flaw in the implementation, however, was that service providers could create and delete resources they had no permissions for.
In this deep dive, we’ll demonstrate how an innocent looking vulnerability, discovered because of a discrepancy between docs and code, can lead to a total takeover of tenants and their data. We’ll show the complete thought process behind discovering this attack vector. At the end, we’ll talk about what measures we took to protect kcp users.
Building Europe's Cloud Future: NeoNephos' Platform Mesh
The open source Platform Mesh project, is part of an open reference architecture for building a multi-provider cloud-edge continuum that should span the European continent. Some of the central questions the project wants to answer are: How can the different service offerings across a wide array of providers be unified? How can they communicate in a common language?
We discuss how a combination of Cloud Native building blocks (kcp and kube-bind, among others) is used to create the foundation for the next generation of cloud platforms. We demonstrate a prototype which meshes together Kubernetes-like APIs that allows us to consume services across multiple control plane instances, instantiating what we call the “Platform Mesh”. Platform Mesh is a project in the newly founded Linux Foundation sub-foundation, NeoNephos, originating from the ApeiroRA initiative.
This talk is for operators of cloud service providers and internal developer platforms (IDPs), giving them an outlook at a technology that unifies both worlds and creates a standard to consume services from (nearly) everywhere.
Dynamic Multi-Cluster Controllers with controller-runtime
controller-runtime is the most popular SDK to write controllers for individual Kubernetes clusters. But the Kubernetes landscape is changing quickly: multi-cluster is becoming ubiquitous (e.g. through Cluster API), with clusters joining and leaving dynamically. controller-runtime has had no direct support, making writing uniform multi-cluster controllers hard and fracturing the emerging ecosystem.
This talk explores how to build controllers that reconcile resources across a dynamic fleet of Kubernetes clusters. A key change is the ability to plug in a dynamic cluster provider that registers new Kubernetes clusters from a specific source. While implementation internals are briefly discussed, focus is on a hands-on walkthrough for writing your own cluster provider, event handlers and reconciler functions.
We discuss a simplistic cluster provider implementation for “kind” clusters as an example and extrapolate from that how more complex providers could look like (e.g. for CAPI or kcp).
Building a Platform Engineering API Layer with kcp
Self-service is a central aspect of platform engineering, and platform engineering teams frequently build on top of Kubernetes to utilise its amazing API design. The kcp project has been accepted into the CNCF Sandbox in 2023 and extends Kubernetes API concepts beyond container orchestration. This talk will discuss how kcp supercharges platform engineering with a global control plane for all internal services.
As a central API layer, kcp enables a SaaS-like experience between internal service providers and developers, transforming internal developer platforms into a service marketplace. All via concepts and tools that developers working with Kubernetes already know and love.
kcp expands the world of platform engineering beyond the limits of single Kubernetes clusters, and therefore transforms the scale at which platform teams and internal service providers can operate. This talk will explore patterns for both service providers and developers and how kcp makes their lives easier.
Ephemeral Containers in Action - Running a Go Debugger in Kubernetes
The modern observability stack has transformed the way you troubleshoot issues in a microservice environment. Some situations however, ask for investigation of a single application pod that seems to be misbehaving. Ephemeral containers provide a way to attach to a seemingly problematic pod without restarting it.This allows developers to observe an issue in a live or staging environment running on top of Kubernetes.
We will discuss the practicality of launching a Go debugger (Delve) within an ephemeral container to remotely debug an application both on the CLI and in VS Code, highlighting the requirements and possible limitations one might encounter when trying to set up a similar troubleshooting routine. As part of that, we will explore the API for ephemeral containers and the current implementation in kubectl.
While the talk will use Go and Delve as an example, the considerations and steps presented are of universal importance to running a debugger for your language stack of choice.
Cloud Native Days Austria 2026 Sessionize Event
ContainerDays Conference 2025 Sessionize Event
KubeCon + CloudNativeCon Europe 2025 Sessionize Event
ContainerDays Conference 2024 Sessionize Event
CNCF-hosted Co-located Events Europe 2024 Sessionize Event
ContainerDays 2023 Sessionize Event
Cloud Native Rejekts EU 2023
Ephemeral Containers in Action - Running a Go Debugger in Kubernetes
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top