CI/CD with Kubernetes

Transcript

1. @BastianHofmann CI/CD with Kubernetes Bastian Hofmann mail@bastianhofmann.de
2. Continuous Integration
3. Continuous Delivery
5. Container orchestration platform
6. Deploy, run and scale your services in isolated containers
7. No vendor lock in
8. Standardized APIs
9. Runs on
10. Your laptop
12. Bare metal
13. Cloud Providers
14. And if you don't want to install and maintain Kubernetes yourself
15. Managed Kubernetes
18. So we have code, how do we get this into Kubernetes?
19. Lot's of tools
20. Example for this talk
22. Example application
23. https:/ /gitlab.com/bashofmann/ angular-test-app
24. https:/ /gitlab.com/bashofmann/ angular-test-app-finished
25. Pipeline with multiple stages, each stage can have multiple jobs
26. Stage 1: Preparing
27. Stage 2: Linters and Tests
28. Stage 3: Building an image
29. Stage 4: On master: Deploying to Kubernetes into a stage namespace
30. Stage 5: On master: Testing if stage works
31. Stage 6: On tag: Tag the docker image
32. Stage 7: On tag: Deploying to Kubernetes into a prod namespace
33. Stage 8: On tag: Testing if prod works
34. In detail
35. Stage 1: Preparing
36. Only do slow operations once and cache and re-use results
37. Stage 2: Linters and Tests
38. Add linters for everything
39. Unit tests
40. Integration tests
41. Browser tests
42. Stage 3: Building an image
43. Make the build as fast as possible
44. Make the image as small as possible
45. Stage 4: On master: Deploying to Kubernetes into a stage namespace
46. Stage 5: On master: Testing if stage works
47. Stage 6: On tag: Tag the docker image
48. Stage 7: On tag: Deploying to Kubernetes into a prod namespace
49. Stage 8: On tag: Testing if prod works
50. Use a versioning scheme
51. Never deploy "latest"
52. Use Kubernetes namespaces
53. Use Helm or similar tools
54. Make use of Kubernetes "magic"
55. Sealed Secrets
56. Secrets are stored encrypted in Git and encrypted inside of the cluster
57. LoadBalancers
58. Automatically creates a highly available LoadBalancer with a public IP address
59. Ingress controller
60. The ingress controller (nginx) listens on routing rules in Ingress Resources and configures itself to route incoming traffic to the correct running and healthy pods
61. cert-manager
62. Cert-manager listens on Ingress Resources and if they need TLS, requests a certificate from LetsEncrypt
63. external-dns
64. External-DNS listens on Ingress Resources and creates DNS entries
65. Prometheus
66. Kubernetes and Node metrics are automatically included
67. Kubernetes and Node alerts are automatically included
68. Kubernetes and Node dashboards are automatically included
69. Scraping targets can be automatically discovered
70. Service Meshes
72. Alternatives
73. Flux
75. Knative
76. Kubernetes-based platform to deploy and manage modern serverless workloads
77. Tekton CD
78. CI that runs completely within Kubernetes with Kubernetes Custom Resources
79. mail@bastianhofmann.de https:/ /twitter.com/BastianHofmann http:/ /speakerdeck.com/u/bastianhofmann