Download to read offline
![SENZA: DEFINITION YAML
SenzaInfo:
StackName: hello-world
Parameters:
- ImageVersion:
Description: "Docker image version of Hello World."
SenzaComponents:
- Configuration:
Type: Senza::StupsAutoConfiguration # auto-detect network setup
- AppServer: # will create a launch configuration and ASG with scaling triggers
Type: Senza::TaupageAutoScalingGroup
InstanceType: t2.micro
SecurityGroups: [app-hello-world]
ElasticLoadBalancer: AppLoadBalancer
TaupageConfig:
runtime: Docker
source: "stups/hello-world:{{Arguments.ImageVersion}}"
ports:
8080: 8080](https://image.slidesharecdn.com/stups-151124180133-lva1-app6892/85/Stups-io-an-Open-Source-Cloud-Framework-for-AWS-79-320.jpg)
Uploaded byJan Löffler
Stups.io - an Open Source Cloud Framework for AWS
STUPS.io is an open source cloud framework for AWS that provides maximum developer freedom while enabling near-real-time audit compliance for applications. It utilizes isolated AWS accounts with Docker deployment, managed SSH access, and immutable infrastructure to give development teams autonomy while ensuring security and compliance.
More Related Content
Similar to Stups.io - an Open Source Cloud Framework for AWS
Stups.io - an Open Source Cloud Framework for AWS
- 1. STUPS.io an Open SourceCloud Framework for AWS jan.loeffler@zalando.de / @jlsoft2 DevOpsCon Munich 2015-11-25
- 2. We shape ourbuildings; thereafter they shape us
- 3. Conway’s Law “organizations whichdesign systems ... are constrained to produce designs which are copies of the communication structures of these organizations” Melvin Conway
- 4.
- 9.
- 13.
- 14.
- 15. 70+ delivery teams Platformteam deploy request servers request storage PLATFORM Datacenter
- 18. DELIVER AMAZING PRODUCTS EFFICIENTLY AT SCALE,AND FEELING GREAT ABOUT IT.
- 19. PURPOSE - AUTONOMY- MASTERY
- 23. DRIVE The Surprising Truth AboutWhat Motivates Us Daniel Pink
- 24.
- 25.
- 26. GLOBAL REGRESSION INNOVATION LAB TECH SERVICE PRODUCT OWNER PRODUCT SPECIALIST DELIVERY LEAD PEOPLE LEAD BUSINESS ASSURANCE PRODUCT OVERARCHING ADMIN &SUPPORT CONTROLLING EXECUTIVE SUPPORT COMPLIANCE RISK , SECURITY & STRATEGY ONBOARDING & TECHADEMY AGILE COACHING PROJECT MANGEMENT ENGINEERING PRODUCTIVITY DELIVERY LEAD PEOPLE LEAD DELIVERY
- 29.
- 30.
- 31.
- 32.
- 33.
- 34.
- 36.
- 37.
- 39. WHERE TO GO DataCenter IDataCenter II AWS APP 1 APP 2 APP 3 APP 4 APP 5 APP 6 APP 1 APP 2 APP 3 APP 4 APP 5 APP 6 APP 1 APP 2 APP 3 APP 4
- 41.
- 42.
- 43.
- 44.
- 45.
- 46. STUPS STUPS To UnleashPenguin Swarms https://stups.io
- 47. ➊ One AWSaccount per Team ➋ Deployment with Docker ➌ Managed SSH Access ➍ REST/OAuth 2.0 mandatory ➎ Traceability of changes IN A NUTSHELL STUPS
- 48. AWS STUPS DOCKER DEPLOY SSH ACCESS AUDIT REPORTS FULLAWS ACCESS A PLATFORM ON TOP OF AMAZON WEB SERVICES
- 49. “We provide maximumfreedom for developers while enabling near-real- time audit compliance for every single application.” -- Zalando STUPS Delivery Team
- 50. Public Internet *.jacob.example.org *.edward.example.or g Team “Jacob” Team “Edward” ELB ELB ISOLATEDAWS ACCOUNTS & OAUTH 2.0 & SECURITY Data CenterLB AWS
- 51. IMMUTABLE STACKS ELB myapp-v1 myapp.example.org EC2 +Docker EC2 + Docker EC2 + Docker 100%
- 52. IMMUTABLE STACKS ELB myapp-v1 EC2 +Docker EC2 + Docker EC2 + Docker ELB myapp-v2 EC2 + Docker EC2 + Docker myapp.example.org 90% 10% $ senza traffic myapp v2 10
- 53. IMMUTABLE STACKS ELB myapp-v1 EC2 +Docker EC2 + Docker EC2 + Docker ELB myapp-v2 EC2 + Docker EC2 + Docker myapp.example.org 0% 100% $ senza traffic myapp v2 100
- 54. EXAMPLE STACK AWS EC2 TaupageAMI Docker Container Application ✓ In isolated team account ✓ Created by senza through Cloud Formation ✓ Docker Runtime ✓ Managed SSH access ✓ Audit Logging ✓ Log Collection ✓ Monitoring ✓ Reviewed security additions ✓ Ubuntu ✓ OpenJDK ✓ Zalando CA certificate ✓ scm-source …
- 55.
- 56.
- 57. Securing REST basedMicroservices Lock all doors ● Open only ports that you need permanently ● Grant SSH access only temporary ● Use a firewall for each app container Encrypt all channels & critical data ● Keep all transferred data confidential ● Use TLS ● Encrypt data in databases & use HSM Authenticate & Authorize ● Make sure you talk to the right guy ● Check if access is permitted ● Use OAuth 2.0 Monitor & Limit your API calls ● Control who accesses your API how often, when and from where ● Use Rate Limiting against fraud ● Use external Security Services against DDoSIsolate your apps ● Only one app per container / server ● Use Docker or CoreOS Rkt
- 58.
- 59. SCM Ticket system Issue “ABC-123” Commit“afb123” msg: ABC-123..
- 60. SCM Pier One DockerRegistry build Ticket system Image “docker/myart:1.0” commit: afb123Issue “ABC-123” Commit “afb123” msg: ABC-123..
- 61. Pier One DockerRegistry build approved Application Version “1.0” artifact: docker/myart:1.0 Ticket system Application Registry SCM Image “docker/myart:1.0” commit: afb123Issue “ABC-123” Commit “afb123” msg: ABC-123.. ✓ Specification ✓ Artefact tested
- 62. Pier One DockerRegistry build approved EC2 Instance Docker Container Application Version “1.0” artifact: docker/myart:1.0 AMI Ticket system Application Registry SCM Image “docker/myart:1.0” commit: afb123Issue “ABC-123” Commit “afb123” msg: ABC-123.. ✓ Specification ✓ Artefact tested
- 64. Spilo Highly available open-source PostgreSQLappliance https://github.com/zalando/spilo
- 66. Apache License Version 2.0STUPS stups.io& github.com/zalando-stups
- 67. Radical Agility Purpose -Autonomy - Mastery Architecture principles Immutable Infrastructure Security is key SUMMARY
- 68. Build a trustful“devops” culture & Utilize cloud services to give teams autonomy MESSAGE
- 69. Try STUPS.io https://stups.io https://docs.stups.io All componentsare Open Source https://github.com/zalando https://github.com/zalando-stups
- 70. Jan Löffler ● Headof Platform Engineering ● Twitter: @jlsoft2 ● jan.loeffler@zalando.de ● http://www.slideshare.net/jlsoft/
- 71. We shape ourbuildings; thereafter they shape us
- 72. STUPS website &docs https://stups.io https://docs.stups.io All components are Open Source https://github.com/zalando https://github.com/zalando-stups
- 73.
- 76. FROM zalando/openjdk:8u40-b09-4 EXPOSE 8080 COPYtarget/hello-world.jar / COPY target/scm-source.json / CMD java $(java-dynamic-memory-opts) ↲ -jar /hello-world.jar DOCKERFILE
- 77. $ docker build-t ↲ pierone.example.org/myteam/hello-world:0.2 . $ pierone login Getting OAuth2 token "pierone".. OK Storing Docker client configuration in ~/.dockercfg.. OK $ docker push pierone.example.org/myteam/hello-world:0.2 DOCKER BUILD & PUSH
- 78. $ pierone tagsmyteam hello-world Team │Artifact │Tag │Created│By | myteam hello-world 0.1-andre-test 13d ago ahartmann myteam hello-world 0.1 3d ago ahartmann myteam hello-world 0.2 3m ago hjacobs $ pierone scm myteam hello-world 0.2 Tag│Author │URL │Revision │Status│Created│By | 0.2 hjacobs git:git@github.. 442b7502 10m ago hjacobs VERIFY IMAGE UPLOAD
- 79. SENZA: DEFINITION YAML SenzaInfo: StackName:hello-world Parameters: - ImageVersion: Description: "Docker image version of Hello World." SenzaComponents: - Configuration: Type: Senza::StupsAutoConfiguration # auto-detect network setup - AppServer: # will create a launch configuration and ASG with scaling triggers Type: Senza::TaupageAutoScalingGroup InstanceType: t2.micro SecurityGroups: [app-hello-world] ElasticLoadBalancer: AppLoadBalancer TaupageConfig: runtime: Docker source: "stups/hello-world:{{Arguments.ImageVersion}}" ports: 8080: 8080
- 80. SENZA: STACK DEPLOYMENT $senza create hello-world.yaml 1 0.2 Generating Cloud Formation template.. OK Creating Cloud Formation stack hello-world-1.. OK $ senza events hello-world.yaml 1 Stack Name│Ver.│Resource Type │Resource ID │Status │Status Reason │Event Time hello-world 1 CloudFormation::Stack hello-world-1 CREATE_IN_PROGRESS User Initiated 10m ago ... hello-world 1 CloudFormation::Stack hello-world-1 CREATE_COMPLETE 6m ago
- 81. docker run -d--log-driver=syslog ↲ --restart=on-failure:10 ↲ -e DB_SUBNAME=.. ↲ -v /meta:/meta:ro ↲ -e CREDENTIALS_DIR=/meta/credentials ↲ -p 8080:8080 -p 7979:7979 ↲ -u 999 ↲ pierone.example.org/stups/pierone:0.5 TAUPAGE: DOCKER COMMAND LINE
- 82.
- 84. docker run ..--log-driver=syslog .. /etc/rsyslog.d/24-application.conf :syslogtag, startswith, "docker" ↲ /var/log/application.log /etc/logrotate.d/.. Don’t forget log rotation.. TAUPAGE: DOCKER SYSLOG
- 85. APPLICATION LOGS: TAUPAGESUPPORTS LOGENTRIES AND SCALYR
- 87. SSH ACCESS: TIME-LIMITEDACCESS TO ANY TEAM SERVER
- 89.
- 90. ZMON APPLIANCE *.foo.example.org *.bar.example.org Team“Foo” Team “Bar” EC2 Instance EC2 InstanceEC2 Instance EC2 Instance ZMON Appliance ZMON Appliance KairosDB EC2 Instance EC2 Instance ZMON Controller ELB ELB
- 91.
- 93. Ubuntu & OpenJDKbase image Log to STDOUT Config via environ. vars (+ KMS decryption) Non-root execution Persistence via EBS mounts Immutable stacks, no orchestration DNS endpoints, etcd e.g. for Hystrix streams RECAP: DOCKER IN STUPS