SlideShare a Scribd company logo
KUBERNETES
DEPLOYMENTS
A “HANDS-OFF”
APPROACH
KUBERNETES MEETUP
DORTMUND
RODRIGO REIS
2018-01-24
2
ZALANDO IN NUMBERS
> 4.5billion EUR
2017
> 200
million
visits
per
month
> 14,000
employees in
Europe
> 70%
of visits via
mobile devices
> 22
million
active customers
> 250,000
product choices
~ 2,000
brands
15
countries
3
WE BRING FASHION TO PEOPLE IN 15 COUNTRIES
2008-2009
2010
2012-2013
2011
4
OUR FOOTPRINT AROUND EUROPE
as of November 2017
1
8
10
11
12
13
BERLIN HEADQUARTERS AND OUTLET
BRIESELANG FULFILLMENT CENTER
ERFURT FULFILLMENT CENTER AND TECH OFFICE
MÖNCHENGLADBACH FULFILLMENT CENTER AND TECH OFFICE
LAHR FULFILLMENT CENTER
DORTMUND TECH HUB
FRANKFURT OUTLET
DUBLIN TECH HUB
HELSINKI TECH HUB
MILAN (STRADELLA) FULFILLMENT CENTER
KÖLN OUTLET
PARIS (MOISSY-CRAMAYEL) FULFILLMENT CENTER
SZCZECIN (GRYFINO) FULFILLMENT CENTER
HAMBURG ADTECH LAB
STOCKHOLM (BRUNNA) FULFILLMENT CENTER (start winter 2017)
10
9
7
6
5
3
2
1
11
12
13
4
14
15
15
14
9
8
7
6
5
4
3
2
1
5
OUR FOOTPRINT AROUND EUROPE
TECH
as of November 2017
1
8
10
11
12
13
BERLIN HEADQUARTERS AND OUTLET
BRIESELANG FULFILLMENT CENTER
ERFURT FULFILLMENT CENTER AND TECH OFFICE
MÖNCHENGLADBACH FULFILLMENT CENTER AND TECH OFFICE
LAHR FULFILLMENT CENTER
DORTMUND TECH HUB
FRANKFURT OUTLET
DUBLIN TECH HUB
HELSINKI TECH HUB
MILAN (STRADELLA) FULFILLMENT CENTER
KÖLN OUTLET
PARIS (MOISSY-CRAMAYEL) FULFILLMENT CENTER
SZCZECIN (GRYFINO) FULFILLMENT CENTER
HAMBURG ADTECH LAB
STOCKHOLM (BRUNNA) FULFILLMENT CENTER (start winter 2017)
10
9
7
6
5
3
2
1
11
12
13
4
14
15
15
14
9
8
7
6
5
4
3
2
1
6
WE ARE CONSTANTLY INNOVATING TECHNOLOGY
HOME-BREWED,
CUTTING-EDGE
& SCALABLE
technology solutions
~ 1,900
employees from
tech locations
(HQs in Berlin)7
77
nations
help our brand to
WIN ONLINE
7
TECH INFRASTRUCTURE
8
ZALANDO TECH PLATFORM
THE COMPLETE HISTORY (ABRIDGED)
ZOMCATPHP STUPS KUBERNETES
2010 2015 2016
Data center
WAR
LXC
AWS
Docker
Cloud Formation
Low level (AWS API)
AWS
Docker
Cloud Formation
Kubernetes manifest
Higher abstraction level
Data center
PHP files
2008
9
SCALE?
66
Clusters
329
Accounts
10
GROWTH
11
GROWTH
12
OUR KUBERNETES
ARCHITECTURE
13
CLUSTER COMPONENTS
Hosted in AWS
Three Cloud Formation stacks
● Master & Worker ASGs + etcd
● Nodes with Container Linux
Kubernetes manifests applied separately
● Kube-system Deployments
● DaemonSets
OPEN SOURCE ☺
https://github.com/zalando-incubator/kubernetes-on-aws
14
etcd
etcd
AT A GLANCE
...
...
kubectl
Worker
Node
Kubelet
Pod
Container
Pod
Container
Container
Master
Node
API Server
Scheduler
Controller
Manager
etcd
USER
15
ISOLATED AWS ACCOUNTS
Internet
*.xpto.example.org
Product XYZ
xpto
Account
Load Balancer
xpti
Account
Load Balancer
*.xpti.example.org
16
Cloud Formation Stack
CLUSTER PROVISIONING
USER
Autoscaling Group
create
CLUSTER
LIFECYCLE
MANAGER
apply manifests
GIT
CLUSTER
REGISTRY
Post
gres
AWS
API
provision
CF resources
create
CF stack Master
Node
API Server
Master
Node
Worker
Node
Worker
Node
Worker
Node
17
● Compliance
● How To Deploy
● Ease Of Use
CHALLENGES
18
BUT FIRST...
Motivation for Kubernetes
● Resource Efficiency
● Cost Efficiency
● Velocity
● Cloud Independence
THIS IS AN OPPORTUNITY FOR CHANGE
19
CHALLENGES
COMPLIANCE
Some Of Our Compliance Rules
● Applications must run on certified (or whitelisted) AMIs
● All images must:
○ Come from an authorized Docker repository
○ Contain an SCM Source file
○ Be versioned
● Code changes must be peer reviewed and approved (4 eyes principle)
20
CHALLENGES
HOW TO DEPLOY
Options for CI/CD
● Jenkins
● GoCD
● Concourse
● Spinnaker
● Travis Enterprise
● AWS CodeBuild, CodePipeline
Problems
● Non reproducible builds
● Not cloud ready
● No automatic setup
● Difficult to scale up/down
● 2 Configuration Steps
● Manual credential configuration
● Lack of Kubernetes support
21
CHALLENGES
EASE OF USE
IDEA
DESIGN
PLAN
CODE
TEST BUILDDEPLOY
VERSION?
COMPLIANCE?
SIZING?
COST?
CI/CD
22
QUESTION
What if the developer didn’t have to
worry about those steps?*
*coding not included
23
● Hands Off
● Compliant By Default
● Secure By Default
A DIFFERENT APPROACH
24
A DIFFERENT APPROACH
● Hands Off
● Compliant By Default
● Secure By Default
➢ No Manual Access to Live*
➢ Automate Setup/Deployment Steps
➢ Separate Test and Live Environments
*Some exceptions apply
25
● Hands Off
● Compliant By Default
● Secure By Default
A DIFFERENT APPROACH
26
A DIFFERENT APPROACH
HANDS OFF
Back to our Options for CI/CD....
● Jenkins
● GoCD
● Concourse
● Spinnaker
● Travis Enterprise
● AWS CodeBuild, CodePipeline
27
A DIFFERENT APPROACH
HANDS OFF
Back to our Options for CI/CD....
● Jenkins
● GoCD
● Concourse
● Spinnaker
● Travis Enterprise
● AWS CodeBuild, CodePipeline
● In-house developed (CDP)
28
A DIFFERENT APPROACH
HANDS OFF
CDP
● Fully Integrated With Kubernetes
● No Need To Manage CI Infrastructure
● Triggered By Code Changes
● More To Come...
29
CDP
DEPLOYMENT PIPELINE
CDPGHE
xpto
Account
deploytrigger deploypush code
pull
30
CDP
DEPLOYMENT DEFINITION
delivery.yaml
version: "2017-09-20"
pipeline:
- id: deployment
desc: Deploy to xpto
type: process
target: xpto
process: microservice_standard_deployment
config:
apply_permanent_resources:
env:
TARGET: playground
APPLICATION: nginx-hello-world
IMAGE: registry.opensource.zalan.do/teapot/nginx-hello-world
VERSION: "0.2"
REPLICAS: "3”
31
CDP
CONFIGURATION
├── delivery.yaml # CDP Config
└── deploy
└── apply
├── deployment.yaml # K8S Deployment
├── ingress.yaml # K8S Ingress
└── service.yaml # K8S Service
$ zkubectl init --kubernetes-cluster=xpto
Writing delivery.yaml.. OK
Writing NOTES.txt.. OK
Writing deploy/apply/deployment.yaml.. OK
Writing deploy/apply/ingress.yaml.. OK
Writing deploy/apply/service.yaml.. OK
32
CDP
DEPLOY PIPELINES
33
● Hands Off
● Compliant By Default
● Secure By Default
A DIFFERENT APPROACH
34
A DIFFERENT APPROACH
COMPLIANT BY DEFAULT
Kubernetes AMIs
● Developers don’t have to choose instance type or AMI
○ Deployments result in Pods running in existing Worker Nodes
● All Kubernetes Nodes are based in compliant, whitelisted AMIs
Docker Repository
● CDP only pulls images from authorized repositories
● When pushing images, CDP automatically includes:
○ SCM Source information
○ Version tagging
35
CDP
BUILD PIPELINE
CDPGHE
trigger buildpush code
push
36
CDP
BUILD DEFINITION
delivery.yaml
version: "2017-09-20"
pipeline:
- id: build
type: script
commands:
- desc: Build and push Docker image
cmd: |
IMAGE=pierone.stups.zalan.do/kraken/knowledge-base
RELEASE_VERSION=${CDP_SOURCE_BRANCH}-${CDP_BUILD_VERSION}
RELEASE_IMAGE=${IMAGE}:${CDP_BUILD_VERSION}
docker build --build-arg BUILD_VERSION=${RELEASE_VERSION} 
-t ${RELEASE_IMAGE} .
docker push ${RELEASE_IMAGE}
Auto-generated by CDP
37
DEVELOPER CONSOLE
CREATING A NEW REPOSITORY
38
DEVELOPER CONSOLE
CREATING A NEW REPOSITORY
When a repository is created through the console:
● A hook is configured for triggering CDP
● Zappr is configured, enforcing Pull Request approvals before merge
○ Zappr is a Github extension developed in Zalando
OPEN SOURCE ☺
https://zappr.opensource.zalan.do
39
A DIFFERENT APPROACH
COMPLIANT BY DEFAULT
Our Compliance Rules
● Applications must run on certified (or whitelisted) AMIs ✓
● All images must: ✓
○ Come from an authorized Docker repository ✓
○ Contain an SCM Source file ✓
○ Be versioned ✓
● Code changes must be peer reviewed and approved (4 eyes principle) ✓
40
● Hands Off
● Compliant By Default
● Secure By Default
A DIFFERENT APPROACH
41
A DIFFERENT APPROACH
SECURE BY DEFAULT
● Test and Production environments are completely isolated
● A Kubernetes Test Cluster is also provisioned
○ Manual access is permitted
● IAM Credentials are isolated between test and live environments
○ Different OAuth Provider in test environment
42
SO THIS...
Internet
*.xpto.example.org
Product XYZ
xpto
Account
Load Balancer
xpti
Account
Load Balancer
*.xpti.example.org
43
IS ACTUALLY THIS
*.xpto.example.org
*.xpti.example.org
xpti
Account
Load Balancerxpto
Account
Load Balancer
xpto-test
Account
Load Balancer
*.xpto-test.example.org
xpti-test
Account
Load Balancer
*.xpti-test.example.org
Internet
44
Trigger
PUTTING IT ALL TOGETHER
CDPGHE
Prod Deploy
Test Deploy
PR
M
erge
M
aster
1. A user creates a Pull Request (PR) in Github Enterprise (GHE)
2. PR Triggers CDP
➢ CDP Deploys the PR to the Test Kubernetes Cluster
3. Another user approves the PR and merges to Master
4. Merge to Master triggers again CDP
➢ CDP Deploys Master to the Production Kubernetes Cluster
xpto
Account
xpto-test
Account
45
CONCLUSION
● CDP enables hands off deployments to Kubernetes
● Compliance is automatically handled by CDP and Developer Console
● Test and Production are guaranteed to be separated through Credentials Isolation
Automation saves time
New features go live faster
Isolation secures environments
Developers focus on business specific features
46
LINKS
Kubernetes on AWS Docs
http://kubernetes-on-aws.readthedocs.io/en/latest/admin-guide/kubernetes-in-production.html
Zalando Cluster Configuration
https://github.com/zalando-incubator/kubernetes-on-aws
Skipper HTTP Ingress Router
https://github.com/zalando/skipper/
Kube AWS Ingress Controller
https://github.com/zalando-incubator/kube-ingress-aws-controller
External DNS
https://github.com/kubernetes-incubator/external-dns
PostgreSQL Operator
https://github.com/zalando-incubator/postgres-operator
Zappr
https://zappr.opensource.zalan.do
THANK YOU
QUESTIONS?
rodrigo.reis@zalando.de
Thanks to
Dimitrij Holev
2018-01-23
RODRIGO REIS
DIGITAL FOUNDATION
SOFTWARE ENGINEER

More Related Content

What's hot

Elasticsearch Monitoring in Openshift
Elasticsearch Monitoring in OpenshiftElasticsearch Monitoring in Openshift
Elasticsearch Monitoring in Openshift
Lukas Vlcek
 
Building Developer Pipelines with PKS, Harbor, Clair, and Concourse
Building Developer Pipelines with PKS, Harbor, Clair, and ConcourseBuilding Developer Pipelines with PKS, Harbor, Clair, and Concourse
Building Developer Pipelines with PKS, Harbor, Clair, and Concourse
VMware Tanzu
 
WTF Do We Need a Service Mesh?
WTF Do We Need a Service Mesh? WTF Do We Need a Service Mesh?
WTF Do We Need a Service Mesh?
Anton Weiss
 
Remote debugging of Application in Kubernetes
Remote debugging of Application in KubernetesRemote debugging of Application in Kubernetes
Remote debugging of Application in Kubernetes
ConSol Consulting & Solutions Software GmbH
 
Container Runtime Security with Falco, by Néstor Salceda
Container Runtime Security with Falco, by Néstor SalcedaContainer Runtime Security with Falco, by Néstor Salceda
Container Runtime Security with Falco, by Néstor Salceda
Cloud Native Day Tel Aviv
 
Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016
Opsta
 
Red Hat OpenShift on Bare Metal and Containerized Storage
Red Hat OpenShift on Bare Metal and Containerized StorageRed Hat OpenShift on Bare Metal and Containerized Storage
Red Hat OpenShift on Bare Metal and Containerized Storage
Greg Hoelzer
 
Open shift 4 infra deep dive
Open shift 4    infra deep diveOpen shift 4    infra deep dive
Open shift 4 infra deep dive
Winton Winton
 
Extended and embedding: containerd update & project use cases
Extended and embedding: containerd update & project use casesExtended and embedding: containerd update & project use cases
Extended and embedding: containerd update & project use cases
Phil Estes
 
Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...
Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...
Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...
DevOps.com
 
K8s debugging talk
K8s debugging talkK8s debugging talk
Introduction to openshift
Introduction to openshiftIntroduction to openshift
Introduction to openshift
MamathaBusi
 
Multi-cloud Kubernetes BCDR with Velero
Multi-cloud Kubernetes BCDR with VeleroMulti-cloud Kubernetes BCDR with Velero
Multi-cloud Kubernetes BCDR with Velero
Kublr
 
DevConf 2017 - Realistic Container Platform Simulations
DevConf 2017 - Realistic Container Platform SimulationsDevConf 2017 - Realistic Container Platform Simulations
DevConf 2017 - Realistic Container Platform Simulations
Jeremy Eder
 
Monitoring Cockpit for OpenShift Clusters
Monitoring Cockpit for OpenShift ClustersMonitoring Cockpit for OpenShift Clusters
Monitoring Cockpit for OpenShift Clusters
ConSol Consulting & Solutions Software GmbH
 
Let's Try Every CRI Runtime Available for Kubernetes
Let's Try Every CRI Runtime Available for KubernetesLet's Try Every CRI Runtime Available for Kubernetes
Let's Try Every CRI Runtime Available for Kubernetes
Phil Estes
 
KubeCon EU 2016: ITNW (If This Now What): Orchestrating an Enterprise
KubeCon EU 2016: ITNW (If This Now What): Orchestrating an EnterpriseKubeCon EU 2016: ITNW (If This Now What): Orchestrating an Enterprise
KubeCon EU 2016: ITNW (If This Now What): Orchestrating an Enterprise
KubeAcademy
 
Docker London Meetup: Docker Engine Evolution
Docker London Meetup: Docker Engine EvolutionDocker London Meetup: Docker Engine Evolution
Docker London Meetup: Docker Engine Evolution
Phil Estes
 
Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...
Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...
Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...
Red Hat Developers
 
State of Builder and Buildkit by Tonis Tiigi (Docker)
State of Builder and Buildkit by Tonis Tiigi (Docker)State of Builder and Buildkit by Tonis Tiigi (Docker)
State of Builder and Buildkit by Tonis Tiigi (Docker)
Docker, Inc.
 

What's hot (20)

Elasticsearch Monitoring in Openshift
Elasticsearch Monitoring in OpenshiftElasticsearch Monitoring in Openshift
Elasticsearch Monitoring in Openshift
 
Building Developer Pipelines with PKS, Harbor, Clair, and Concourse
Building Developer Pipelines with PKS, Harbor, Clair, and ConcourseBuilding Developer Pipelines with PKS, Harbor, Clair, and Concourse
Building Developer Pipelines with PKS, Harbor, Clair, and Concourse
 
WTF Do We Need a Service Mesh?
WTF Do We Need a Service Mesh? WTF Do We Need a Service Mesh?
WTF Do We Need a Service Mesh?
 
Remote debugging of Application in Kubernetes
Remote debugging of Application in KubernetesRemote debugging of Application in Kubernetes
Remote debugging of Application in Kubernetes
 
Container Runtime Security with Falco, by Néstor Salceda
Container Runtime Security with Falco, by Néstor SalcedaContainer Runtime Security with Falco, by Néstor Salceda
Container Runtime Security with Falco, by Néstor Salceda
 
Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016Introduction to Kubernetes - Docker Global Mentor Week 2016
Introduction to Kubernetes - Docker Global Mentor Week 2016
 
Red Hat OpenShift on Bare Metal and Containerized Storage
Red Hat OpenShift on Bare Metal and Containerized StorageRed Hat OpenShift on Bare Metal and Containerized Storage
Red Hat OpenShift on Bare Metal and Containerized Storage
 
Open shift 4 infra deep dive
Open shift 4    infra deep diveOpen shift 4    infra deep dive
Open shift 4 infra deep dive
 
Extended and embedding: containerd update & project use cases
Extended and embedding: containerd update & project use casesExtended and embedding: containerd update & project use cases
Extended and embedding: containerd update & project use cases
 
Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...
Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...
Five Lessons Learned from Large-scale Implementation of Kubernetes in the Ent...
 
K8s debugging talk
K8s debugging talkK8s debugging talk
K8s debugging talk
 
Introduction to openshift
Introduction to openshiftIntroduction to openshift
Introduction to openshift
 
Multi-cloud Kubernetes BCDR with Velero
Multi-cloud Kubernetes BCDR with VeleroMulti-cloud Kubernetes BCDR with Velero
Multi-cloud Kubernetes BCDR with Velero
 
DevConf 2017 - Realistic Container Platform Simulations
DevConf 2017 - Realistic Container Platform SimulationsDevConf 2017 - Realistic Container Platform Simulations
DevConf 2017 - Realistic Container Platform Simulations
 
Monitoring Cockpit for OpenShift Clusters
Monitoring Cockpit for OpenShift ClustersMonitoring Cockpit for OpenShift Clusters
Monitoring Cockpit for OpenShift Clusters
 
Let's Try Every CRI Runtime Available for Kubernetes
Let's Try Every CRI Runtime Available for KubernetesLet's Try Every CRI Runtime Available for Kubernetes
Let's Try Every CRI Runtime Available for Kubernetes
 
KubeCon EU 2016: ITNW (If This Now What): Orchestrating an Enterprise
KubeCon EU 2016: ITNW (If This Now What): Orchestrating an EnterpriseKubeCon EU 2016: ITNW (If This Now What): Orchestrating an Enterprise
KubeCon EU 2016: ITNW (If This Now What): Orchestrating an Enterprise
 
Docker London Meetup: Docker Engine Evolution
Docker London Meetup: Docker Engine EvolutionDocker London Meetup: Docker Engine Evolution
Docker London Meetup: Docker Engine Evolution
 
Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...
Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...
Profile your Java apps in production on Red Hat OpenShift with Cryostat | Dev...
 
State of Builder and Buildkit by Tonis Tiigi (Docker)
State of Builder and Buildkit by Tonis Tiigi (Docker)State of Builder and Buildkit by Tonis Tiigi (Docker)
State of Builder and Buildkit by Tonis Tiigi (Docker)
 

Similar to Kubernetes Deployments: A "Hands-off" Approach

Free GitOps Workshop (with Intro to Kubernetes & GitOps)
Free GitOps Workshop (with Intro to Kubernetes & GitOps)Free GitOps Workshop (with Intro to Kubernetes & GitOps)
Free GitOps Workshop (with Intro to Kubernetes & GitOps)
Weaveworks
 
Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019
Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019
Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019
Henning Jacobs
 
AzureDay Kyiv 2016 Release Management
AzureDay Kyiv 2016 Release ManagementAzureDay Kyiv 2016 Release Management
AzureDay Kyiv 2016 Release Management
Sergii Kryshtop
 
Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...
Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...
Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...
Ambassador Labs
 
Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...
Henning Jacobs
 
Velocity NY 2018 "The Cloud Native Developer Workflow"
Velocity NY 2018 "The Cloud Native Developer Workflow"Velocity NY 2018 "The Cloud Native Developer Workflow"
Velocity NY 2018 "The Cloud Native Developer Workflow"
Daniel Bryant
 
Advanced Code Flow, Notes From the Field
Advanced Code Flow, Notes From the FieldAdvanced Code Flow, Notes From the Field
Advanced Code Flow, Notes From the Field
Ariel Moskovich
 
DevSecOps - Security in DevOps
DevSecOps - Security in DevOpsDevSecOps - Security in DevOps
DevSecOps - Security in DevOps
Aarno Aukia
 
Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...
Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...
Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...
Henning Jacobs
 
Full stack development best practice and toolset
Full stack development best practice and toolsetFull stack development best practice and toolset
Full stack development best practice and toolset
Reid Lai
 
SACON NY 19: "Creating an effective developer experience for cloud-native apps"
SACON NY 19: "Creating an effective developer experience for cloud-native apps"SACON NY 19: "Creating an effective developer experience for cloud-native apps"
SACON NY 19: "Creating an effective developer experience for cloud-native apps"
Daniel Bryant
 
Delivery Pipelines as a First Class Citizen @deliverAgile2019
Delivery Pipelines as a First Class Citizen @deliverAgile2019Delivery Pipelines as a First Class Citizen @deliverAgile2019
Delivery Pipelines as a First Class Citizen @deliverAgile2019
ciberkleid
 
Free GitOps Workshop
Free GitOps WorkshopFree GitOps Workshop
Free GitOps Workshop
Weaveworks
 
Avoid the Vendor Lock-in Trap (with App Deployment)
Avoid the Vendor Lock-in Trap (with App Deployment)Avoid the Vendor Lock-in Trap (with App Deployment)
Avoid the Vendor Lock-in Trap (with App Deployment)
Peter Bittner
 
Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...
Henning Jacobs
 
Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...
Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...
Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...
Marcin Bielak
 
Improve Code Quality and Time to Market: 100% Cloud-Based Development Workflow
Improve Code Quality and Time to Market: 100% Cloud-Based Development WorkflowImprove Code Quality and Time to Market: 100% Cloud-Based Development Workflow
Improve Code Quality and Time to Market: 100% Cloud-Based Development Workflow
Acquia
 
CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"
CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"
CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"
Daniel Bryant
 
Production-Ready Kubernetes: It's Not About Technology
Production-Ready Kubernetes: It's Not About TechnologyProduction-Ready Kubernetes: It's Not About Technology
Production-Ready Kubernetes: It's Not About Technology
Antoine Craske
 
Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies
Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies
Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies
Daniel Oh
 

Similar to Kubernetes Deployments: A "Hands-off" Approach (20)

Free GitOps Workshop (with Intro to Kubernetes & GitOps)
Free GitOps Workshop (with Intro to Kubernetes & GitOps)Free GitOps Workshop (with Intro to Kubernetes & GitOps)
Free GitOps Workshop (with Intro to Kubernetes & GitOps)
 
Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019
Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019
Developer Experience at Zalando - Handelsblatt Strategisches IT-Management 2019
 
AzureDay Kyiv 2016 Release Management
AzureDay Kyiv 2016 Release ManagementAzureDay Kyiv 2016 Release Management
AzureDay Kyiv 2016 Release Management
 
Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...
Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...
Montreal Kubernetes Meetup: Developer-first workflows (for microservices) on ...
 
Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - Destinat...
 
Velocity NY 2018 "The Cloud Native Developer Workflow"
Velocity NY 2018 "The Cloud Native Developer Workflow"Velocity NY 2018 "The Cloud Native Developer Workflow"
Velocity NY 2018 "The Cloud Native Developer Workflow"
 
Advanced Code Flow, Notes From the Field
Advanced Code Flow, Notes From the FieldAdvanced Code Flow, Notes From the Field
Advanced Code Flow, Notes From the Field
 
DevSecOps - Security in DevOps
DevSecOps - Security in DevOpsDevSecOps - Security in DevOps
DevSecOps - Security in DevOps
 
Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...
Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...
Why Kubernetes? Cloud Native and Developer Experience at Zalando - OWL Tech &...
 
Full stack development best practice and toolset
Full stack development best practice and toolsetFull stack development best practice and toolset
Full stack development best practice and toolset
 
SACON NY 19: "Creating an effective developer experience for cloud-native apps"
SACON NY 19: "Creating an effective developer experience for cloud-native apps"SACON NY 19: "Creating an effective developer experience for cloud-native apps"
SACON NY 19: "Creating an effective developer experience for cloud-native apps"
 
Delivery Pipelines as a First Class Citizen @deliverAgile2019
Delivery Pipelines as a First Class Citizen @deliverAgile2019Delivery Pipelines as a First Class Citizen @deliverAgile2019
Delivery Pipelines as a First Class Citizen @deliverAgile2019
 
Free GitOps Workshop
Free GitOps WorkshopFree GitOps Workshop
Free GitOps Workshop
 
Avoid the Vendor Lock-in Trap (with App Deployment)
Avoid the Vendor Lock-in Trap (with App Deployment)Avoid the Vendor Lock-in Trap (with App Deployment)
Avoid the Vendor Lock-in Trap (with App Deployment)
 
Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...
Why we don’t use the Term DevOps: the Journey to a Product Mindset - DevOpsCo...
 
Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...
Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...
Digital twins IoT - for industry 4.0 (meetup Wireless & Networks, Poznan 12.1...
 
Improve Code Quality and Time to Market: 100% Cloud-Based Development Workflow
Improve Code Quality and Time to Market: 100% Cloud-Based Development WorkflowImprove Code Quality and Time to Market: 100% Cloud-Based Development Workflow
Improve Code Quality and Time to Market: 100% Cloud-Based Development Workflow
 
CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"
CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"
CNCF Webinar Series: "Creating an Effective Developer Experience on Kubernetes"
 
Production-Ready Kubernetes: It's Not About Technology
Production-Ready Kubernetes: It's Not About TechnologyProduction-Ready Kubernetes: It's Not About Technology
Production-Ready Kubernetes: It's Not About Technology
 
Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies
Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies
Podman, Buildah, and Quarkus - The Latest in Linux Containers Technologies
 

Recently uploaded

Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
Prayukth K V
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
DianaGray10
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
91mobiles
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
Jemma Hussein Allen
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
OnBoard
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
Product School
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
RTTS
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Product School
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
Frank van Harmelen
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
Laura Byrne
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
DianaGray10
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Ramesh Iyer
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Albert Hoitingh
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Product School
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
KatiaHIMEUR1
 

Recently uploaded (20)

Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 previewState of ICS and IoT Cyber Threat Landscape Report 2024 preview
State of ICS and IoT Cyber Threat Landscape Report 2024 preview
 
UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4UiPath Test Automation using UiPath Test Suite series, part 4
UiPath Test Automation using UiPath Test Suite series, part 4
 
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
 
The Future of Platform Engineering
The Future of Platform EngineeringThe Future of Platform Engineering
The Future of Platform Engineering
 
Leading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdfLeading Change strategies and insights for effective change management pdf 1.pdf
Leading Change strategies and insights for effective change management pdf 1.pdf
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...
 
JMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and GrafanaJMeter webinar - integration with InfluxDB and Grafana
JMeter webinar - integration with InfluxDB and Grafana
 
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
The Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and SalesThe Art of the Pitch: WordPress Relationships and Sales
The Art of the Pitch: WordPress Relationships and Sales
 
UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3UiPath Test Automation using UiPath Test Suite series, part 3
UiPath Test Automation using UiPath Test Suite series, part 3
 
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...
 
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
Encryption in Microsoft 365 - ExpertsLive Netherlands 2024
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
 
Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !Securing your Kubernetes cluster_ a step-by-step guide to success !
Securing your Kubernetes cluster_ a step-by-step guide to success !
 

Kubernetes Deployments: A "Hands-off" Approach

  • 2. 2 ZALANDO IN NUMBERS > 4.5billion EUR 2017 > 200 million visits per month > 14,000 employees in Europe > 70% of visits via mobile devices > 22 million active customers > 250,000 product choices ~ 2,000 brands 15 countries
  • 3. 3 WE BRING FASHION TO PEOPLE IN 15 COUNTRIES 2008-2009 2010 2012-2013 2011
  • 4. 4 OUR FOOTPRINT AROUND EUROPE as of November 2017 1 8 10 11 12 13 BERLIN HEADQUARTERS AND OUTLET BRIESELANG FULFILLMENT CENTER ERFURT FULFILLMENT CENTER AND TECH OFFICE MÖNCHENGLADBACH FULFILLMENT CENTER AND TECH OFFICE LAHR FULFILLMENT CENTER DORTMUND TECH HUB FRANKFURT OUTLET DUBLIN TECH HUB HELSINKI TECH HUB MILAN (STRADELLA) FULFILLMENT CENTER KÖLN OUTLET PARIS (MOISSY-CRAMAYEL) FULFILLMENT CENTER SZCZECIN (GRYFINO) FULFILLMENT CENTER HAMBURG ADTECH LAB STOCKHOLM (BRUNNA) FULFILLMENT CENTER (start winter 2017) 10 9 7 6 5 3 2 1 11 12 13 4 14 15 15 14 9 8 7 6 5 4 3 2 1
  • 5. 5 OUR FOOTPRINT AROUND EUROPE TECH as of November 2017 1 8 10 11 12 13 BERLIN HEADQUARTERS AND OUTLET BRIESELANG FULFILLMENT CENTER ERFURT FULFILLMENT CENTER AND TECH OFFICE MÖNCHENGLADBACH FULFILLMENT CENTER AND TECH OFFICE LAHR FULFILLMENT CENTER DORTMUND TECH HUB FRANKFURT OUTLET DUBLIN TECH HUB HELSINKI TECH HUB MILAN (STRADELLA) FULFILLMENT CENTER KÖLN OUTLET PARIS (MOISSY-CRAMAYEL) FULFILLMENT CENTER SZCZECIN (GRYFINO) FULFILLMENT CENTER HAMBURG ADTECH LAB STOCKHOLM (BRUNNA) FULFILLMENT CENTER (start winter 2017) 10 9 7 6 5 3 2 1 11 12 13 4 14 15 15 14 9 8 7 6 5 4 3 2 1
  • 6. 6 WE ARE CONSTANTLY INNOVATING TECHNOLOGY HOME-BREWED, CUTTING-EDGE & SCALABLE technology solutions ~ 1,900 employees from tech locations (HQs in Berlin)7 77 nations help our brand to WIN ONLINE
  • 8. 8 ZALANDO TECH PLATFORM THE COMPLETE HISTORY (ABRIDGED) ZOMCATPHP STUPS KUBERNETES 2010 2015 2016 Data center WAR LXC AWS Docker Cloud Formation Low level (AWS API) AWS Docker Cloud Formation Kubernetes manifest Higher abstraction level Data center PHP files 2008
  • 13. 13 CLUSTER COMPONENTS Hosted in AWS Three Cloud Formation stacks ● Master & Worker ASGs + etcd ● Nodes with Container Linux Kubernetes manifests applied separately ● Kube-system Deployments ● DaemonSets OPEN SOURCE ☺ https://github.com/zalando-incubator/kubernetes-on-aws
  • 15. 15 ISOLATED AWS ACCOUNTS Internet *.xpto.example.org Product XYZ xpto Account Load Balancer xpti Account Load Balancer *.xpti.example.org
  • 16. 16 Cloud Formation Stack CLUSTER PROVISIONING USER Autoscaling Group create CLUSTER LIFECYCLE MANAGER apply manifests GIT CLUSTER REGISTRY Post gres AWS API provision CF resources create CF stack Master Node API Server Master Node Worker Node Worker Node Worker Node
  • 17. 17 ● Compliance ● How To Deploy ● Ease Of Use CHALLENGES
  • 18. 18 BUT FIRST... Motivation for Kubernetes ● Resource Efficiency ● Cost Efficiency ● Velocity ● Cloud Independence THIS IS AN OPPORTUNITY FOR CHANGE
  • 19. 19 CHALLENGES COMPLIANCE Some Of Our Compliance Rules ● Applications must run on certified (or whitelisted) AMIs ● All images must: ○ Come from an authorized Docker repository ○ Contain an SCM Source file ○ Be versioned ● Code changes must be peer reviewed and approved (4 eyes principle)
  • 20. 20 CHALLENGES HOW TO DEPLOY Options for CI/CD ● Jenkins ● GoCD ● Concourse ● Spinnaker ● Travis Enterprise ● AWS CodeBuild, CodePipeline Problems ● Non reproducible builds ● Not cloud ready ● No automatic setup ● Difficult to scale up/down ● 2 Configuration Steps ● Manual credential configuration ● Lack of Kubernetes support
  • 21. 21 CHALLENGES EASE OF USE IDEA DESIGN PLAN CODE TEST BUILDDEPLOY VERSION? COMPLIANCE? SIZING? COST? CI/CD
  • 22. 22 QUESTION What if the developer didn’t have to worry about those steps?* *coding not included
  • 23. 23 ● Hands Off ● Compliant By Default ● Secure By Default A DIFFERENT APPROACH
  • 24. 24 A DIFFERENT APPROACH ● Hands Off ● Compliant By Default ● Secure By Default ➢ No Manual Access to Live* ➢ Automate Setup/Deployment Steps ➢ Separate Test and Live Environments *Some exceptions apply
  • 25. 25 ● Hands Off ● Compliant By Default ● Secure By Default A DIFFERENT APPROACH
  • 26. 26 A DIFFERENT APPROACH HANDS OFF Back to our Options for CI/CD.... ● Jenkins ● GoCD ● Concourse ● Spinnaker ● Travis Enterprise ● AWS CodeBuild, CodePipeline
  • 27. 27 A DIFFERENT APPROACH HANDS OFF Back to our Options for CI/CD.... ● Jenkins ● GoCD ● Concourse ● Spinnaker ● Travis Enterprise ● AWS CodeBuild, CodePipeline ● In-house developed (CDP)
  • 28. 28 A DIFFERENT APPROACH HANDS OFF CDP ● Fully Integrated With Kubernetes ● No Need To Manage CI Infrastructure ● Triggered By Code Changes ● More To Come...
  • 30. 30 CDP DEPLOYMENT DEFINITION delivery.yaml version: "2017-09-20" pipeline: - id: deployment desc: Deploy to xpto type: process target: xpto process: microservice_standard_deployment config: apply_permanent_resources: env: TARGET: playground APPLICATION: nginx-hello-world IMAGE: registry.opensource.zalan.do/teapot/nginx-hello-world VERSION: "0.2" REPLICAS: "3”
  • 31. 31 CDP CONFIGURATION ├── delivery.yaml # CDP Config └── deploy └── apply ├── deployment.yaml # K8S Deployment ├── ingress.yaml # K8S Ingress └── service.yaml # K8S Service $ zkubectl init --kubernetes-cluster=xpto Writing delivery.yaml.. OK Writing NOTES.txt.. OK Writing deploy/apply/deployment.yaml.. OK Writing deploy/apply/ingress.yaml.. OK Writing deploy/apply/service.yaml.. OK
  • 33. 33 ● Hands Off ● Compliant By Default ● Secure By Default A DIFFERENT APPROACH
  • 34. 34 A DIFFERENT APPROACH COMPLIANT BY DEFAULT Kubernetes AMIs ● Developers don’t have to choose instance type or AMI ○ Deployments result in Pods running in existing Worker Nodes ● All Kubernetes Nodes are based in compliant, whitelisted AMIs Docker Repository ● CDP only pulls images from authorized repositories ● When pushing images, CDP automatically includes: ○ SCM Source information ○ Version tagging
  • 36. 36 CDP BUILD DEFINITION delivery.yaml version: "2017-09-20" pipeline: - id: build type: script commands: - desc: Build and push Docker image cmd: | IMAGE=pierone.stups.zalan.do/kraken/knowledge-base RELEASE_VERSION=${CDP_SOURCE_BRANCH}-${CDP_BUILD_VERSION} RELEASE_IMAGE=${IMAGE}:${CDP_BUILD_VERSION} docker build --build-arg BUILD_VERSION=${RELEASE_VERSION} -t ${RELEASE_IMAGE} . docker push ${RELEASE_IMAGE} Auto-generated by CDP
  • 38. 38 DEVELOPER CONSOLE CREATING A NEW REPOSITORY When a repository is created through the console: ● A hook is configured for triggering CDP ● Zappr is configured, enforcing Pull Request approvals before merge ○ Zappr is a Github extension developed in Zalando OPEN SOURCE ☺ https://zappr.opensource.zalan.do
  • 39. 39 A DIFFERENT APPROACH COMPLIANT BY DEFAULT Our Compliance Rules ● Applications must run on certified (or whitelisted) AMIs ✓ ● All images must: ✓ ○ Come from an authorized Docker repository ✓ ○ Contain an SCM Source file ✓ ○ Be versioned ✓ ● Code changes must be peer reviewed and approved (4 eyes principle) ✓
  • 40. 40 ● Hands Off ● Compliant By Default ● Secure By Default A DIFFERENT APPROACH
  • 41. 41 A DIFFERENT APPROACH SECURE BY DEFAULT ● Test and Production environments are completely isolated ● A Kubernetes Test Cluster is also provisioned ○ Manual access is permitted ● IAM Credentials are isolated between test and live environments ○ Different OAuth Provider in test environment
  • 42. 42 SO THIS... Internet *.xpto.example.org Product XYZ xpto Account Load Balancer xpti Account Load Balancer *.xpti.example.org
  • 43. 43 IS ACTUALLY THIS *.xpto.example.org *.xpti.example.org xpti Account Load Balancerxpto Account Load Balancer xpto-test Account Load Balancer *.xpto-test.example.org xpti-test Account Load Balancer *.xpti-test.example.org Internet
  • 44. 44 Trigger PUTTING IT ALL TOGETHER CDPGHE Prod Deploy Test Deploy PR M erge M aster 1. A user creates a Pull Request (PR) in Github Enterprise (GHE) 2. PR Triggers CDP ➢ CDP Deploys the PR to the Test Kubernetes Cluster 3. Another user approves the PR and merges to Master 4. Merge to Master triggers again CDP ➢ CDP Deploys Master to the Production Kubernetes Cluster xpto Account xpto-test Account
  • 45. 45 CONCLUSION ● CDP enables hands off deployments to Kubernetes ● Compliance is automatically handled by CDP and Developer Console ● Test and Production are guaranteed to be separated through Credentials Isolation Automation saves time New features go live faster Isolation secures environments Developers focus on business specific features
  • 46. 46 LINKS Kubernetes on AWS Docs http://kubernetes-on-aws.readthedocs.io/en/latest/admin-guide/kubernetes-in-production.html Zalando Cluster Configuration https://github.com/zalando-incubator/kubernetes-on-aws Skipper HTTP Ingress Router https://github.com/zalando/skipper/ Kube AWS Ingress Controller https://github.com/zalando-incubator/kube-ingress-aws-controller External DNS https://github.com/kubernetes-incubator/external-dns PostgreSQL Operator https://github.com/zalando-incubator/postgres-operator Zappr https://zappr.opensource.zalan.do
  • 47. THANK YOU QUESTIONS? rodrigo.reis@zalando.de Thanks to Dimitrij Holev 2018-01-23 RODRIGO REIS DIGITAL FOUNDATION SOFTWARE ENGINEER