Building Kubernetes images at scale with Tanzu Build Service

Confidential │ ©2020 VMware, Inc.
Building Kubernetes
images at scale
With Tanzu Build Service
May 2020
Alexandre Roman
Solution Engineer, VMware Tanzu

Confidential │ ©2020 VMware, Inc. @Alexandre_Roman 2
Alexandre Roman
Solution Engineer, VMware Tanzu
@Alexandre_Roman
/alexandreroman

Confidential │ ©2020 VMware, Inc. @Alexandre_Roman
Agenda
3
Building a secure software supply chain
Leveraging Tanzu Build Service
How Build Service fits in the Tanzu portfolio
Modernize your applications
Live demos
Look ma: no Dockerfile!

4Confidential │ ©2020 VMware, Inc.
Building a secure software
supply chain
Leveraging Tanzu Build Service

Building secure
Docker images is hard

Keep Docker images
secure is even harder

Case study:
OpenSSL CVE-2016-6304

Base OS image
FROM alpine
RUN apk add --update openssl
...
App
FROM nodejs
COPY myapp .
RUN npm install
...
NodeJS
FROM baseimage
RUN apt-get install nodejs
...
Built with a custom base image
Typical NodeJS app: everything works just fine

Base OS image
NodeJS
App
FROM baseimage
RUN apt-get install nodejs
...
FROM alpine
RUN apk add --update openssl
...
FROM nodejs
COPY myapp .
RUN npm install
...
A new critical CVE is made public
Until that day...
!Base OS image

How long does it take to fix all these containers?
What if you had to update 200+ containers at once?

Individually managed
Dockerfiles: done wrong
App #1
Custom NodeJS
Ubuntu Trusty
App #2
NodeJS RPM
CentOS
App #3
Oﬃcial NodeJS
Alpine
App #4
Patched NodeJS
abc768c
ETA to mitigation:
months, years…?

Operator managed
Dockerfiles: done right
App #1
Corp NodeJS
Ubuntu Trusty
App #2
Corp NodeJS
Ubuntu Trusty
App #3
Corp NodeJS
Ubuntu Trusty
App #4
Corp NodeJS
Ubuntu Trusty
ETA to mitigation:
time to re-build, re-test, re-deploy these apps

We can do better

Introducing Cloud Native Buildpacks
An API for creating pluggable, modular tools that
translate source code into OCI images
Goals
❏ Portability via the OCI standard
❏ Greater modularity
❏ Faster builds
❏ Reproducible image builds
❏ Unprivileged containers
❏ Widely adopted standard
An easy way to build Docker images

2011 2013 2015 2018 2020

They use Cloud Native Buildpacks

What happens when you build a container with buildpacks
detect
restore
analyze
build
export
cache
Lifecycle

detect
restore
analyze
build
export
cache
➔ Tests groups of buildpacks against source, in order
(via each buildpack’s detect binary)
➔ First group that passes is selected
NPM CNBNode CNB
Yarn CNBNode CNBsrc/
package.json
yarn.lock
...
Lifecycle: Detect

detect
restore
analyze
build
export
cache
analyze
➔ metadata about OCI layers generated during a
previous build are made available to buildpacks
Lifecycle: Restore & Analyze

detect
restore
analyze
build
export
cache
➔ For previously-selected group, executes each
buildpack’s build executable in order
src/
package.json
yarn.lock
...
Lifecycle: Build

detect
restore
analyze
build
export
cache
➔ Assembles ﬁnal layers into image
➔ Combines information from analyze phase to ensure
only changed layers are updated
cache
Lifecycle: Export & Cache

+ = Build Service

Take control of your container image supply chain
Introducing Tanzu Build Service
Tanzu Build
Service
OCI Runtime
Platforms
Image
Repositories
Security
Scanning
CI/CD
Pipelines
Enterprise Delivery
Toolchain
Stack
Base Image
Regularly patched
Buildpacks
Provide middleware
Modular
Dictates image layers
Your Application
Broad language support
Build from source

Tanzu Build Service is a kpack distribution tailored for enterprise needs
Leveraging open-source components
kpack
Build Service
powered by Tanzu buildpacks

Declarative Conﬁguration Model:
➔ Tell Build Service what you want your app to
look like by creating an image conﬁguration,
and Build Service will build against it and keep
it up to date when new dependencies are
available.
Hello Tanzu Build Service
source:
git:
url:
https://github.com/alexandreroman/myapp.git
revision: master
build:
env:
- name: BP_JAVA_VERSION
value: 11.*
image:
tag: harbor.withtanzu.com/alexandreroman/myapp
What you need to do to build an image
$ pb image apply -f myapp-image.yml

Build Service nicely fits in your existing pipeline
Add Tanzu Build Service to your CI/CD workflow
Compile and run tests with your existing tool:
Jenkins / GitLab / Concourse / etc

VMware Tanzu + Pivotal Labs
Comprehensive stack to modernize your applications
Dev Framework
Spring
Tanzu Application
Service
Tanzu Build Service
Tanzu Application
Catalog
powered by Bitnami
VCF VMC Public Cloud Edge
Tanzu Kubernetes Grid | PKS
TanzuMissionControl
Wavefront
PivotalLabsservices
BUILD
RUN
Application
Runtime
Modern
Infrastructure
MANAGE

Resources
It’s dangerous to go alone: take this!
Source code:
➔ github.com/alexandreroman/cnb-springboot
➔ github.com/alexandreroman/cnb-nodejs
➔ github.com/alexandreroman/cnb-javawar
➔ github.com/alexandreroman/cnb-php
➔ github.com/alexandreroman/kpack-at-scale-demo
Let’s keep in touch!
Sources:
➔ The Heartbleed Bug
➔ NSA Said to Have Used Heartbleed Bug, Exposing Consumers
➔ Oracle JRE : Security Vulnerabilities Published In 2019
➔ Top ten Docker images contain over 8000 vulnerable paths
Evaluate kpack / Tanzu Build Service:
➔ github.com/pivotal/kpack
➔ tanzu.vmware.com/build-service
@Alexandre_Roman
/alexandreroman

Want more?
I’ve got you covered
Using Tanzu Kubernetes Grid to
Deploy Kubernetes with Ease
May 13th
Tanzu Observability for Spring
Boot Applications
May 19th
Reactive Spring Virtual
Workshop
May 20th
SpringOne 2020 Virtual Event
Starting September 2nd

Building Kubernetes images at scale with Tanzu Build Service

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Building Kubernetes images at scale with Tanzu Build Service

Similar to Building Kubernetes images at scale with Tanzu Build Service (20)

More from VMware Tanzu

More from VMware Tanzu (20)

Recently uploaded

Recently uploaded (20)

Building Kubernetes images at scale with Tanzu Build Service