The document discusses the integration of continuous deployment practices using tools like Ansible, Packer, OpenSCAP, and Kubernetes within a DevOps culture. It outlines workflows for automating infrastructure, building secure images, and managing applications, emphasizing the importance of collaboration, cultural transformation, and leveraging cloud capabilities. Key highlights include automated security compliance, testing playbooks with Molecule, and orchestrating containers with Kubernetes for scalable deployments.

1. Continuous Deployment and Multi-Cloud
with Ansible, Packer, OpenSCAP and Kubernetes
Mihai Criveti
6th September 2019
http://galaxy.ansible.com/crivetimihai
1

2. 0 The rise of DevOps
1 Automate Your Infrastructure and Image Build Pipeline
2 Hashicorp Packer: Image Build Automation
3 OpenSCAP: Automate Security Baselines
4 Ansible: Provisioning and Configuration Management
5 Molecule: Test your Ansible Playbooks on Docker, Vagrant or Cloud
6 Kubernetes: Container Orchestration at Scale
2

3. 0 The rise of DevOps

4. People, Processes and Tools that bring Continuous Delivery of Value
Continuous Integration
Merging changes to the main branch as often as possible. Running automated builds
and tests against the build.
Continuous Deployment
Every change that passes all stages of your pipeline is released automatically.
Continuous Delivery
Making sure you can release new changes to customers quickly. Automated release
process to deploy your application.
3

5. Collaborate to continuously deliver
Figure 1: Practices
4

6. Cultural Transformation
• Culture: Build trust and align your team with better communication and
transparency.
• Discover: Understand the problem domain and align on common goals.
• Think: Know your audience and meet its needs faster than the competition.
• Develop: Collaborate to build, continuously integrate and deliver high-quality code.
• Reason: Apply AI techniques so that you can make better decisions.
• Operate: Harness the power of the cloud to quickly get your minimum viable product
(MVP) into production, and monitor and manage your applications to a high degree
of quality and meet your service level agreements. Grow or shrink your resources
based on demand.
• Learn: Gain insights from your users as they interact with your application.
5

7. 1 Automate Your Infrastructure
and Image Build Pipeline

8. Setting up an Infrastructure as Code Workflow for Images
Example Use Cases:
• Create development and test images (Vagrant and VirtualBox) with pre-installed
development tools.
• Test your application across a wide set of platforms with Molecule.
• Create secure OS images for production deployment.
Continuous, Secure Image Build Workflow:
• Build images (VMware, VirtualBox, KVM, Xen, Vagrant Box, AWS, Azure) from a single
source.
• Apply security baselines throughout all your environments.
• Install packages and perform configuration automatically.
6

9. Example Workflow: Build, Secure and Test Images for Multiple Environments
1. Track build artifacts (JSON, YAML, etc) in Git (ex: GitHub, GitLab, TravisCI).
2. Build virtual and cloud OS images with Hashicorp Packer.
3. Apply security profile with OpenSCAP (ex: PCI, Cloud).
4. Install baseline packages and configuration with Ansbile
5. Test your application across multiple platforms using Molecule (Docker, VirtualBox,
Cloud).
6. Build and package your Python applications as containers using podman, buildah an
helm.
7. Orchestrate your application containers using Kubernetes.
7

10. 2 Hashicorp Packer: Image Build
Automation

11. Packer: Builders
packer: builders
"builders": [ {
"type": "virtualbox-iso",
"boot_command": [
"<up><wait><tab>",
" text inst.ks=
http://{{ .HTTPIP }}:{{ .HTTPPort }}/{{user `vm_name`}}.cfg",
"<enter><wait>"
]}],
8

12. Packer: Provisioners
packer: provisioners
"provisioners": [
{
"type": "ansible",
"playbook_file": "{{user `playbook_file`}}"
}],
"post-processors": [ { "compression_level": 9 } ]
9

13. Packer building a VirtualBox image for RHEL 8 using Kickstart Automated Install
10

14. 3 OpenSCAP: Automate Security
Baselines

15. OpenSCAP security report:
11

16. Automatic Remediation as shell, ansible or puppet
12

17. Make your systems compliant with a simple command
Install and run OpenSCAP Scanner
dnf install openscap-scanner
sudo oscap xccdf eval --report report.html
--profile xccdf_org.ssgproject.content_profile_pci-dss
/usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml
13

18. 4 Ansible: Provisioning and
Configuration Management

19. Application Deployment, Configuration Management, Continuous Delivery
14

20. What can I do with Ansible?
15

21. Ansible Supports Technologies You Use Today
16

22. Ansible Overview
17

23. Ansible Tower
18

24. Ansible for Enterprise: Architecture
19

25. Ansible Playbooks
Run ansible:
ansible-playbook -i localhost, playbook.yml
playbook.yml
- hosts: all
connection: local
become: yes
gather_facts: yes
roles:
- role: kvm
20

26. What’s inside?
tasks/install.yml
- name: install RedHat packages
package:
name: "{{ redhat_packages }}"
state: present
become: yes
vars/main.yml
redhat_packages:
- policycoreutils-python-utils
- qemu-kvm
- qemu-img
21

27. Running ad-hoc commands, and ansible facts
ansible -m setup localhost
localhost | SUCCESS => {
"ansible_facts": {
"ansible_all_ipv4_addresses": [
"172.18.0.1",
"172.19.0.1",
"172.17.0.1",
"141.125.85.138",
"10.196.49.9",
"192.168.122.1"
22

28. 5 Molecule: Test your Ansible
Playbooks on Docker, Vagrant or
Cloud

29. Ansible Molecule
Creating a vagrant or docker machine and trigger goss tests:
molecule create -s vagrant-centos-7
molecule converge -s vagrant-centos-7
molecule login
In one step
molecule test
23

30. Molecule Cookie Cutter Templates
Cookiecutter: Better Project Templates
• Cookiecutter creates projects from project templates, e.g. Ansible role structure, with
molecule tests.
• Molecule provides a native cookiecutter interface, so developers can provide their
own templates.
Create a new role from a template, with molecule tests included
molecule init template
--url https://github.com/crivetimihai/ansible_cookiecutter.git
--role-name httpd
24

31. 6 Kubernetes: Container
Orchestration at Scale

32. 6 Kubernetes: Container Orchestration at Scale
Figure 5: Kubernetes is Desired State Management 25

33. Multi-Zone or Multi-Cluster
26

34. Static Analysis and Vulnerability Checks
Figure 6: Vulnerability Scanner: Check your Containers too!
27

35. Buildah: build images without root priviledges
28

36. Kubernetes Pipeline
29