KubeCon EU 2016: Transforming the Government
•Download as PPTX, PDF•
1 like•321 views
This talk is documents the UK Home Office's cloud-native journey, changing how we did devops forever! At the UK Home Office, we run Kubernetes in production. This talk is about how we got there, where we came from, where we are right now and where do we want to go from here. We will also cover what things worked out and which things didn't. From on-boarding projects into Kubernetes to continous delivery, this talk will give you a good understanding of what lies ahead if you decided to take the road to schedule containers in production. Sched Link: http://sched.co/68xS
Recommended
More Related Content
What's hot
What's hot (20)
Similar to KubeCon EU 2016: Transforming the Government
Similar to KubeCon EU 2016: Transforming the Government (20)
More from KubeAcademy
More from KubeAcademy (20)
Recently uploaded
Recently uploaded (20)
KubeCon EU 2016: Transforming the Government
- 1. Transforming The Government @ipedrazas We cannot confirm or deny this talk has ever happened
- 2. The World has Changed
- 7. Ivan
- 11. sprint 16 gds
- 12. It’s all about the people
- 13. Story of a Journey
- 22. Loads of Web Application Firewalls
- 24. Brace yourselves
- 25. Instead of focusing on building a solution we were focusing on running a solution in different environments
- 28. Farm of pets
- 29. 1 Region 3 AZs Based on CoreOS Bootstraps from a container
- 30. We run everything in containers
- 31. The idea behind our Platform is FOCUS
- 34. The Challenge...
- 35. “ In our experience, for a tool to be widely accepted, it must be compelling, add tremendous value, and reduce the overall cognitive load for the majority of Netflix engineers.” http://techblog.netflix.com/2016/03/how-we-build-code-at-netflix.html
- 37. A place to run your applications
- 38. Security
- 39. Monitoring
- 40. Logging
- 42. DRONE Docker host Jenkins Docker Registry Cluster Cluster Cluster
- 46. Things we have learnt
- 48. Kubernetes helps you to be better
- 49. New Concepts are difficult
- 51. Testing...
- 57. Healthchecks
- 60. are messy
- 61. TANGLED
- 62. Do one thing and do it well
- 63. Smaller pieces of code using Composition
- 65. Summary
- 68. Fragile
- 70. Thank You!
- 74. This presentation contains 42 animated gifs It is not a coincidence... Answer to the Ultimate Question of Life, the Universe, and Everything… kubernetes included!
Editor's Notes
- Changes in Dev, Ops and architecture...
- about transformation… Get rid of the suit
- Developer, Architect, fallen sysadmin, DevOps
- At the UK Home Office we try to do as much in the open as possible Developers are a little bit reticent at the beginning but it’s a good thing.
- Still, there are a few things, that are secret.
- Recently GDS (Government Digital Service) announced Sprint 16… not much needs to be added, really.
- If you want to go for an early lunch, this slide summarises the whole talk
- Where we were
- The perfect opportunity to make people’s lives better
- Having to send bits of paper we already store the records for backwards and forwards, madness!
- Classic 3 tier app There are many flavours, many ways of building and presenting the cake,
- Dropwizard
- Winter is coming… Managing with Ansible the environment forced us to have loads of env specific details. Environments were not reusable Time spent managing environments Complicated environment Unusual software: systemd to orchestrate + oracle db Ansible playbooks became a problem. Technical Debt. Instead of focusing on building a solution we were focusing on running a solution in different environments.
- There is a big gap between THEORY and PRACTICE… and details are VERY important Most of the problems came from trying to manage different environments Ansible forced us to have loads of env specific details. Environments were not reusable Time spent managing environments Complicated environment Unusual software: systemd to orchestrate + oracle db Ansible playbooks became a problem. Technical Debt. Instead of focusing on building a solution we were focusing on running a solution in different environments.
- We knew we this was very good. We wanted this!!!
- We ended up with this, because building immutable infrastructure… is hard!
- Velocity is important. We have to deliver more and faster
- The way to go is to reuse, reuse and reuse
- We don’t do things in Isolation. We have been talking with MoJ, for example, it’s not about what we do as Home Office Digital, it’s about what we all can do. Reusability
- As many PaaS providers know, it’s adoption.
- Vault
- Drone and Jenkins We have a separate CI cluster where we do the builds Builds SemVer Docker_host Dockerfile validation Docker Build & Docker push & deploy...
- Distance from development to deployment is critical The further away, the more disconnect teams will be. Drone helps us to bring deployment closer to developers. You build it, you own it… for real!
- We have
- Kafka example: A test creates a results file. We have to send that file somewhere because we want those results stored somewhere. The test should worry about testing not about how to send files across the cluster to a service. Test runs, leaves the file in a directory, Kafka sidekick picks up and puts it in a topic, Kafka consumer reads that topic and knows what to do with that file
- Better at developing and architecting Better at running systems
- We do multitenancy based on Namespaces. No more environments!! Changing people to think in New World concepts and abstractions takes a looooooooooooooong time.
- Testing with containers is different Testing with Kubernetes is very different also. From test to microservice to...
- This test verifies that I can connect to a MongoDB in my CI namespace
- Vault sidekick gets the credentials
- My mongo test uses those credentials to access Mongo With this test we have a test and an example for other people to learn how to wire up containers to access mongo.
- Healthchecks is one of those things that are moving from “It’s an OPS problem, to It’s a DEVs problem”
- The original implementation was based heavily on bash: Download the certificate from Vault Check if the certificate was valid Restart mongo if the certificate changes.. Separation of concerns One container fetches the certificate Mongo waits until the certificate is downloaded IF the certificate expires, we kill the pod (healthcheck) Mongo doesn’t know anything about certificate management
- Using Vault is great, but we have to work in the workflow. Secrets in Development and Secrets in production are very different. Still, there are secrets, and secrets.
- Normally Cert. management will be part of how the app runs, so you will need to add some Bash glue, and make your app do things that it shouldn’t do.
- The fact that we reduce the amount of wiring and plumbing in each component makes easier to manage Think of simple things, connected by simple principles.
- not only orchestrating your containers but also making your infrastructure better because during the move to Kubernetes you will be able to identify
- Be aware of how much PERSONAL talent your solution has.
- You will detect quickly when an application is fragile. IT WORKS! Hint: it will break, but you will fix it, and everything will be 200!
- Kubernetes is moving really fast.