AWS TechConnect- Enterprise Container Adoption

Cloudreach has built a framework for adopting containers within the enterprise. We shared our framework and perspective at AWS TechConnect.

Transcript

1. Enterprise Container Adoption AWS TechConnect 2018
2. Alex Rhea Cloud Enablement Leader @ Cloudreach - Have worked with organizations to build hyper-scale infrastructure - Driver of immutable infrastructure and automation over humans - Designed and implemented CaaS platforms for large enterprises - Creator and Maintainer of Harbor Master, a Docker Node.js SDK - Proud Hokie, Golf enthusiast, and Caps fan /alexandermrhea arhea _arhea alex.rhea@cloudreach.com
3. How do container change what we do and how we do it? Our Perspective
4. Containers at the core are an application packaging format. Yet containers require organizations rethink the way software is delivered, managed and secured. Cloudreach works with customers to efficiently and effectively adopt containers and gain better insight into their applications. 6 ©2017 Cloudreach Limited
5. Right Tool Right Job Containers are a crowded market and it can be tough to identify the right tool for the right job. Identifying the tools and processes to successfully adopt containers can be difficult.
6. Data Container Platform Host Network Layers of Container Security Similar to traditional infrastructure, a layered security model is required to deploy containers successfully. Building a secure Containers as a Service platform requires securing the network, the host, the platform, the container, and the data.
7. One of the most important pieces to container adoption is managing image sprawl. When done correctly this allows organizations to patch applications faster than ever. It also shifts organizations from being reactive to proactive. 9 ©2017 Cloudreach Limited
8. 10 Base Image Management Base images should be centrally managed so that all applications can be patched. Docker Registry Vulnerability Scanning and Alerting Development of base images (Java, Node.js, etc.) Automated CI/CD to central registry Security + Platform Teams Application Teams Automated Reporting and Alerting Development teams build applications on top of base images Automated CI/CD to central registry Image automatically deployed to production Image Scanning
9. Awesome, all our applications and dependencies are in one place! But how do we ship code? 11 ©2017 Cloudreach Limited
10. Container is built using the Dockerfile checked into SCM Container is signed using the build team’s key. Container is tested for correctness and also scanned for CVEs Container is signed using the test and security key after the checks have passed. Delivering Secure Containers to Production Commit Code Container Test Container Build Code is committed from the developer’s machine to SCM Code is signed using the developer’s PGP key A B C Deployment D Containers are continually scanned for CVEs. i As enterprises ship more and more software it becomes increasingly difficult to manage production estates and even more difficult to maintain security.
11. We are now shipping code faster and more secure than ever, but who does what? Surrounding our container environments with a proper operating model is key to a successful platform. 13 ©2017 Cloudreach Limited
12. 14 ©2018 Cloudreach Responsibility Container security starts with the responsibility model. Containers enable Infrastructure, Development, and Security teams to work together by creating clean partitions between responsibility. Docker Platform On-Premises Hardware Public Cloud Provider Application Development Teams Infrastructure Teams Application Application Application Application Security Team
13. Containers are best when they can be deployed in an ephemeral manner. That’s great, but my application needs persistent storage. How do I bring storage to my containers if I don’t know where my containers are running? 15 ©2017 Cloudreach Limited
14. 16 ©2018 Cloudreach Managing Data Containers are ephemeral instances of the application therefore a persistence layer between the container and disk is needed to facilitate data storage. Where possible we always recommend leveraging platform services such as hosted databases, caches, and queues. Docker Daemon Instance Volume Driver Application Application Container requests a persistent disk. Docker or Kubernetes calls the Volume Driver plugin to provide a cloud native disk. The RexRay volume driver by Dell EMC Labs brokers API calls to mount a disk (EBS, EFS, Persistent Disk, or Unmanaged Disk) to the instance and mount that directly into the container.
15. Our containers are now running and storing data, but do we know how they are doing? Centralized container monitoring and logging is critical to a successful container deployment. 17 ©2017 Cloudreach Limited
16. 18 ©2018 Cloudreach CVE Monitoring Application components (containers) should be scanned continually for CVEs and remediation. Networking Monitoring Analyze network traffic using Guarduty and Twistlock. Centralized Monitoring Data Centralize data so that data can be correlated during debugging. Log Analysis Logs should continually analyzed for errors, PII, and performance concerns. Macie and Athena are great tools for doing this at scale. Centralized Logging Platform Logs streamed from containers to a central storage facility like Cloudwatch. Logging and Monitoring Centralized Monitoring and Logging Access to monitoring and logs is critical in an ephemeral environment.
17. I hear “containers are more secure.” But how does this work? Containers are a packaging format which allows us to lock down and monitor all aspects of the container toolchain and runtime. 19 ©2017 Cloudreach Limited
18. Cloudreach has partnered with Twistlock to secure container based applications, networks, and pipelines. Twistlock is a turn key security solution for container vulnerability management, run time defense, and container firewalls. 20 ©2017 Cloudreach Limited +
19. TWISTLOCK | © 2018 21 Twistlock platform BUILD SHIP RUN Cloud Native Firewalling Runtime Defense Access Control Vulnerability Management Compliance
20. TWISTLOCK | © 2018 22 Automatically Prevent Attacks Whitelist based models for every application and traffic flow Cloud Native Layer 3 and Layer 7 Firewalls Fully automated model creation and enforcement – zero touch protection
21. TWISTLOCK | © 2018 23 Detect and Prevent Vulnerabilities Industry leading precision across images, containers, hosts, and serverless functions Automated prioritization of vulnerabilities based on your environment
22. TWISTLOCK | © 2018 24 Extend Compliance Into Cloud Native Environments One-click enforcement for CIS, PCI-DSS, HIPAA, GDPR , NIST SP800-190, and FISMA Real-time and trending dashboards and audit-ready reports
23. TWISTLOCK | © 2018 25 Deliver Devops Speed With CISO Control Native plugins and standalone scanner for integration into any CI/CD workflow “Shift-Left” quality gates and compliance / vulnerability thresholds
24. There are many steps along the way to successfully adopting containers. Containers are a critical piece to many cloud journeys. This all seems so easy, where do we get started? 26 ©2017 Cloudreach Limited
25. 27 ©2018 Cloudreach Container Adoption Containers follow a very similar process to cloud adoption within the enterprise. We combine assessments and planning into Container Adoption which drives successful implementations. - Assess Application Container Readiness - Assess security, deployment, logging, and monitoring tooling - Assess high availability, disaster recovery, and backup requirements - Assess Licensing and COTs products estate and implications to containerizing Assess - Container as a Service High Level Design (HLD) - Kubernetes vs Swarm Selection Framework - Containerize vs Hosted Service Framework - Migration, Training, Security, and Operational Planning Plan Container Readiness Assessment Container Governance Model Assess Plan Build Automate Operate
26. 28 ©2018 Cloudreach Container Platforms At Scale Based on our assessment and planning phases we help organizations build highly available, scalable, and fault tolerant environments using code. Assess Plan Build Automate Operate - Using Terraform we build out the CaaS platform as code - Using Packer we build repeatable machine image creation processes based on enterprise policies and industry best practices - Integrate Active Directory, LDAP, or IAM to the CaaS platform (varies based on platform) - Integrate security tooling with the CaaS platform - Integrate monitoring and logging platforms with the CaaS platform - Deploy Development, Staging, and Production Platforms - Containerize and replatform the application for optimal performance and maintainability - Define applications as code using Docker Compose or Kubernetes tooling Build Containers as a Service Platform Containerized Applications Container Readiness Assessment Container Governance Model
27. 29 ©2018 Cloudreach Automating Infrastructure and Software Delivery Containers enable organizations to deliver software and infrastructure in a fully automated fashion. Assess Plan Build Automate Operate - Build a Jenkins pipeline to build, test, scan, and deploy containers based on enterprise, regulatory, and industry best practices - Integrate automated unit, integration, and UX testing to the CI/CD pipeline - Implement Blue/Green, Canary, or Rolling deployment strategy - Implement automated health checks and resolutions - Implement automated security checks for best practices and security standards to catch misconfigurations - Implement automated machine image rollout strategies to roll out new machine images with the latest patches after testing in lower environments - Implement a automated infrastructure deployment pipeline for rolling out new infrastructure Automate Automated Software Delivery Automated Infrastructure Delivery Containers as a Service Platform Containerized Applications Container Readiness Assessment Container Governance Model
28. 30 ©2018 Cloudreach Modern Application Management Cloudreach has always been a cloud first managed service provider. Assess Plan Build Automate Operate
29. If you would like access to this deck or would like to continue the conversation send me an email at alex.rhea@cloudreach.com 31 ©2017 Cloudreach Limited
30. Thanks!