Download to read offline
![The Route directs to the Service application0
➜ ~ oc export routes application0
apiVersion: v1
kind: Route
[...]
spec:
host: application0-presentation...
to:
kind: Service
name: application0
weight: 100
[...]
@barkerd427](https://image.slidesharecdn.com/architectingthefuture-bsideskc-170520181325/85/Architecting-the-Future-Abstractions-and-Metadata-BSidesKC-20-320.jpg)
![The Pod has many labels.
➜ ~ oc export -o yaml po/application0-1-ao16l
apiVersion: v1
kind: Pod
metadata:
labels:
app: application0
deploymentconfig: application0
environment: dev
partition: customerA
release: stable
tier: frontend
[...]
@barkerd427](https://image.slidesharecdn.com/architectingthefuture-bsideskc-170520181325/85/Architecting-the-Future-Abstractions-and-Metadata-BSidesKC-22-320.jpg)
![The Pod has many labels.
➜ ~ oc export -o yaml po/application0-beta-1-ao16l
apiVersion: v1
kind: Pod
metadata:
labels:
app: application0-beta
deploymentconfig: application0-beta
environment: dev
partition: customerA
release: stable
tier: frontend
[...]
@barkerd427](https://image.slidesharecdn.com/architectingthefuture-bsideskc-170520181325/85/Architecting-the-Future-Abstractions-and-Metadata-BSidesKC-26-320.jpg)
Uploaded byDaniel Barker
Architecting the Future: Abstractions and Metadata - BSidesKC
The document is a presentation by Dan Barker at BSidesKC 2017 discussing improvements in data center architecture and application deployment using technologies like Docker, Kubernetes, and OpenShift. It covers key concepts such as microservices, pipeline configurations, and security measures, highlighting the benefits of modern orchestrations and abstractions in software deployment and management. The talk emphasizes the importance of services, imagestreams, and automated processes to enhance developer experience and application security.
More Related Content
![[ApacheCon 2016] Advanced Apache Cordova](https://cdn.slidesharecdn.com/ss_thumbnails/apachecon2016advancedapachecordova-160512193548-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Architecting the Future: Abstractions and Metadata - BSidesKC
![[WSO2Con Asia 2018] Deploying Applications in K8S and Docker](https://cdn.slidesharecdn.com/ss_thumbnails/deployingapplicationsink8sanddocker-wso2conasia2018-sanjaya-180810103523-thumbnail.jpg?width=640&height=640&fit=bounds)
![Getting Started with Apache Spark: Big Data Made Simple [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/apachesparkgettingstarted-260203175547-8361bcc3-thumbnail.jpg?width=640&height=640&fit=bounds)
Architecting the Future: Abstractions and Metadata - BSidesKC
- 1. Thank you toour BSidesKC 2017 sponsors!
- 2. Architecting the Future Abstractionsand Metadata Dan Barker @barkerd427 danbarker.codes
- 4. The current datacenter is...challenging... RHEL 6.9 Dev RHEL 6.8 Test RHEL 6.6 Prod Dev Test Prod RHEL 6.7 Prod Admin Admin Admin Admin Admin Admin Dev RHEL 6.7 Dev RHEL 6.4 Dev RHEL 6.8 Dev Ubuntu Trusty RHEL 6.9 Dev RHEL 6.6 Dev Ubuntu Trusty RHEL 6.7 Dev RHEL 6.4 Dev RHEL 6.8 Dev Ubuntu Trusty RHEL 6.9 Dev RHEL 6.6 Dev RHEL 6.7 Dev RHEL 6.4 Dev RHEL 6.8 Dev Ubuntu Trusty RHEL 6.9 Dev RHEL 6.6 Dev @barkerd427
- 5. The new datacenter is understandable and usable. Developer Access Production Controlled Network Storage Compute Platform Deployment Pipeline RHEL 6.9 App1 RHEL 6.9 App1 RHEL 6.9 App1 RHEL 6.9 App1 RHEL 6.9 App1 RHEL 6.9 App1 RHEL 6.9 App2 RHEL 6.9 App2 RHEL 6.9 App2 RHEL 6.9 App2 RHEL 6.9 App2 RHEL 6.9 App2 @barkerd427
- 6. Docker - theearly ● Docker is an abstraction ○ cgroups ○ Namespaces @barkerd427 ● Not Included ○ Metadata ○ Volumes ○ Secrets ○ Services ○ Network
- 7. Docker - thelatter ● Volumes ● Secrets ● Networks @barkerd427 ● Plugins ● Services ● Labels
- 8.
- 9.
- 10. Kubernetes (k8s) ● Secrets ●PersistentVolumes ● Services ● Pods @barkerd427 ● Ingress ● DaemonSets ● ReplicaSets ● Deployments
- 11.
- 12. OpenShift ● Routes >Ingress ● DeploymentConfig > Deployments @barkerd427 ● ImageStream ● BuildConfig
- 13.
- 14. Security Linux Kernel Capabilities ●Specific privs ● Restricted defaults ● Not granular enough ● Still an improvement Seccomp Security Profiles ● Syscall granularity ● Sane defaults ● Least privilege ● Big improvement @barkerd427
- 16. Services will change yourlife @barkerd427
- 17. Services ● Identifies podsusing label selectors ○ Any label ○ Specific to avoid errant selections ● Passes requests to pods internally ○ Routes and Services are different ● Abstraction for a Route to pass traffic @barkerd427
- 18.
- 19. One Route, OneService, One Application Route Service Pod @barkerd427
- 20. The Route directsto the Service application0 ➜ ~ oc export routes application0 apiVersion: v1 kind: Route [...] spec: host: application0-presentation... to: kind: Service name: application0 weight: 100 [...] @barkerd427
- 21. The Service matcheson the label “deploymentconfig” with the value “application0”. ➜ ~ oc export svc application0 apiVersion: v1 kind: Service spec: selector: deploymentconfig: application0 @barkerd427
- 22. The Pod hasmany labels. ➜ ~ oc export -o yaml po/application0-1-ao16l apiVersion: v1 kind: Pod metadata: labels: app: application0 deploymentconfig: application0 environment: dev partition: customerA release: stable tier: frontend [...] @barkerd427
- 23. The Service nowmatches on the label “tier” with the value “frontend”. ➜ ~ oc export svc application0 apiVersion: v1 kind: Service spec: selector: tier: frontend @barkerd427
- 24. One Route, OneService, Two Applications Route Application Application Service Service @barkerd427
- 25. Curling the sameRoute results in two different applications responding. @barkerd427
- 26. The Pod hasmany labels. ➜ ~ oc export -o yaml po/application0-beta-1-ao16l apiVersion: v1 kind: Pod metadata: labels: app: application0-beta deploymentconfig: application0-beta environment: dev partition: customerA release: stable tier: frontend [...] @barkerd427
- 27. We’ve deleted application1and added application0-beta. @barkerd427
- 28.
- 29. ImageStreams ● Contains imagesfrom: ○ Integrated registry ○ Other ImageStreams ○ External registries ● Automatic event triggers http://blog.openshift.com @barkerd427
- 30. ImageStreams - Metadata ●Commands ● Entrypoint ● EnvVars @barkerd427 ● Layers ● Labels ● Ports
- 31.
- 33.
- 34.
- 35.
- 36. Operators ● Represents human operationalknowledge in software ● Uses 3rd-party resources ○ Controller of controllers and resources @barkerd427 ● Identical model to k8s controllers ○ OODA Loop ● Not supported in OpenShift
- 37. Operators ● Deployed intok8s cluster ● Interactions through new controller ○ kubectl get prometheuses ○ kubectl get alertmanagers @barkerd427 ● Abstraction around k8s primitives ○ Users just want to use a MySQL cluster. ● Complex tasks that can be performed ○ Rotating credentials, certs, versions, backups
- 40.
- 41. Pipelines ● Stages ● Steps ●Application @barkerd427 ● PipelineTemplate ● PipelineConfig
- 42. An Application includesa Pipeline, based on an opinionated PipelineTemplate. These combine as a PipelineConfig. apiVersion: v1 kind: Application name: app1 cap: template: name: approvedTemplates/Tomcat8.yaml pipeline: notifications: mattermost: team: cloud channel: general on_success: never on_failure: always dependencies: - name: authn dnsName: authn - name: key-management username: reference_to_username password: reference_to_password stages: - name: build steps: - action: build baseImage: version: 8.0.41 - name: dev approvers: - role: app1-dev steps: - action: deploy params: environment: dev apiVersion: v1 kind: PipelineTemplate name: Tomcat8 labels: type: application build: manager: maven version: latest builderImage: java8-builder version: latest baseImage: tomcat8 version: latest deploy: deploymentType: canary maxUnavailable: 10% maxSurge: 20% apiVersion: v1 kind: PipelineConfig name: app1-pipeline labels: type: application pipeline: notifications: mattermost: team: cloud channel: general on_success: never on_failure: always dependencies: - name: authn dnsName: authn - name: key-management username: reference_to_username password: reference_to_password stages: - name: build steps: - action: build manager: maven builderImage: java8-builder baseImage: tomcat8 version: 8.0.41 - name: dev approvers: - role: app1-dev steps: - action: deploy params: environment: dev @barkerd427
- 43. An Application andPipelineTemplate also combine to create a DeploymentConfig. apiVersion: v1 kind: Application name: app1 cap: template: name: approvedTemplates/Tomcat8.yaml pipeline: notifications: mattermost: team: cloud channel: general on_success: never on_failure: always dependencies: - name: authn dnsName: authn - name: key-management username: reference_to_username password: reference_to_password stages: - name: build steps: - action: build baseImage: version: 8.0.41 - name: dev approvers: - role: app1-dev steps: - action: deploy params: environment: dev apiVersion: v1 kind: PipelineTemplate name: Tomcat8 labels: type: application build: manager: maven version: latest builderImage: java8-builder version: latest baseImage: tomcat8 version: latest deploy: deploymentType: canary maxUnavailable: 10% maxSurge: 20% apiVersion: v1 kind: DeploymentConfig metadata: name: app1-pipeline type: application spec: replicas: 2 selector: name: frontend template: { ... } triggers: - type: ConfigChange - imageChangeParams: automatic: true containerNames: - helloworld from: kind: ImageStreamTag name: hello-openshift:latest type: ImageChange strategy: type: Rolling @barkerd427
- 44. The value ofPipelines ● Abstract audit and compliance ○ Approvals added dynamically ● Trivialities eliminated ○ Tabs vs. spaces ○ Semicolons or not ● Security checks occur early and often ○ Feedback is important @barkerd427
- 45. The value ofPipelines ● Test all the things! ● Nimble security ● Common artifact repositories ○ Restrict dependencies ○ Automated security vulnerability notification ● Standardized/Centralized approval system ● Applications will become secure by default @barkerd427
- 46.
- 47. Help us getbetter! my talk http://bit.ly/BSidesKCTal kEval the conference http://bit.ly/BSidesKCEv entEval anything else http://bit.ly/IqT6zt Please provide feedback on…
Editor's Notes
- #4 Start with one admin and one dev. The dev needs prod access, so we’ll just stand up a new node. Decide to add another app. Then another environment. Need a 6.8 to match test. Where did 6.4 come from. 6.7 matches the dev/prod host Ubuntu!!! And a 6.6 to match prod after experiencing additional problems when migrating. Scale admins!!! Need another. Then another. Then dev is duplicated in test and prod, because requirements...revenue...clients...whatever it takes to get it into prod Where did 6.6 go. Ubuntu!!!
- #5 The new platform will bring consistency to the developer.
- #6 These were dark days. I began working with Docker in late 2013.
- #7 Docker slowly expanded their feature set with additional abstractions metadata via labels
- #10 Not all were around at the beginning, but most were. We’ll only discuss a couple.
- #12 Not all were around at the beginning, but most were. We’ll only discuss a couple.
- #23 Change to match on tier.
- #25 Labels can be dangerous if not used correctly. Notice that the Service is the same, but the DeploymentConfig is different.
- #26 Applications that are truly different could wreak havok with requestors. I can actually create a service that uses two separate sites as the backend.
- #27 Change to match on tier.
- #28 This is one way to do an A/B test, but there are much better solutions built into OpenShift.
- #36 The time of secret potions and illusions is over.
- #37 It’s time we codify our knowledge to be leveraged by others