CI/CD with Kubernetes

CI/CD with Kubernetes

Ded87c77266697ee6981c2277bb97633?s=128

Bastian Hofmann

August 30, 2019
Tweet

Transcript

  1. @BastianHofmann CI/CD with Kubernetes Bastian Hofmann mail@bastianhofmann.de

  2. Continuous Integration

  3. Continuous Delivery

  4. None
  5. Container orchestration platform

  6. Deploy, run and scale your services in isolated containers

  7. No vendor lock in

  8. Standardized APIs

  9. Runs on

  10. Your laptop

  11. None
  12. Bare metal

  13. Cloud Providers

  14. And if you don't want to install and maintain Kubernetes

    yourself
  15. Managed Kubernetes

  16. None
  17. None
  18. So we have code, how do we get this into

    Kubernetes?
  19. Lot's of tools

  20. Example for this talk

  21. None
  22. Example application

  23. https:/ /gitlab.com/bashofmann/ angular-test-app

  24. https:/ /gitlab.com/bashofmann/ angular-test-app-finished

  25. Pipeline with multiple stages, each stage can have multiple jobs

  26. Stage 1: Preparing

  27. Stage 2: Linters and Tests

  28. Stage 3: Building an image

  29. Stage 4: On master: Deploying to Kubernetes into a stage

    namespace
  30. Stage 5: On master: Testing if stage works

  31. Stage 6: On tag: Tag the docker image

  32. Stage 7: On tag: Deploying to Kubernetes into a prod

    namespace
  33. Stage 8: On tag: Testing if prod works

  34. In detail

  35. Stage 1: Preparing

  36. Only do slow operations once and cache and re-use results

  37. Stage 2: Linters and Tests

  38. Add linters for everything

  39. Unit tests

  40. Integration tests

  41. Browser tests

  42. Stage 3: Building an image

  43. Make the build as fast as possible

  44. Make the image as small as possible

  45. Stage 4: On master: Deploying to Kubernetes into a stage

    namespace
  46. Stage 5: On master: Testing if stage works

  47. Stage 6: On tag: Tag the docker image

  48. Stage 7: On tag: Deploying to Kubernetes into a prod

    namespace
  49. Stage 8: On tag: Testing if prod works

  50. Use a versioning scheme

  51. Never deploy "latest"

  52. Use Kubernetes namespaces

  53. Use Helm or similar tools

  54. Make use of Kubernetes "magic"

  55. Sealed Secrets

  56. Secrets are stored encrypted in Git and encrypted inside of

    the cluster
  57. LoadBalancers

  58. Automatically creates a highly available LoadBalancer with a public IP

    address
  59. Ingress controller

  60. The ingress controller (nginx) listens on routing rules in Ingress

    Resources and configures itself to route incoming traffic to the correct running and healthy pods
  61. cert-manager

  62. Cert-manager listens on Ingress Resources and if they need TLS,

    requests a certificate from LetsEncrypt
  63. external-dns

  64. External-DNS listens on Ingress Resources and creates DNS entries

  65. Prometheus

  66. Kubernetes and Node metrics are automatically included

  67. Kubernetes and Node alerts are automatically included

  68. Kubernetes and Node dashboards are automatically included

  69. Scraping targets can be automatically discovered

  70. Service Meshes

  71. None
  72. Alternatives

  73. Flux

  74. None
  75. Knative

  76. Kubernetes-based platform to deploy and manage modern serverless workloads

  77. Tekton CD

  78. CI that runs completely within Kubernetes with Kubernetes Custom Resources

  79. mail@bastianhofmann.de https:/ /twitter.com/BastianHofmann http:/ /speakerdeck.com/u/bastianhofmann