Bringing Buildpacks to Kubernetes

Kubernetes solves orchestration of containers, but it does not solve the 10 year problem of ensuring that the software running in production always contains CVEs to the root filesystem, to OS packages, to language packages, and the application itself.

Replace Dockerfiles with Cloud Native Buildpacks to convert your application software into OCI/docker images, and use tools like pack and kpack to continuously upgrade images with latest dependencies, and to rebase the base OS layer of images to latest version.

Transcript

1. Title Text Body Level One Body Level Two Body Level Three Body Level Four Body Level Five Bringing Buildpacks to Kubernetes Cloud Foundry Summit Hague 2019 Dr Nic Williams @drnic
2. @drnic To Infinity! Let's Build a Buildpack More of me (Dr Nic) 2pm Office Hours: Buildpacks Buildpack Core Team 11am TOMORROW
3. @d @drnic Problem Scope ? Consider every app over 10 years Real world problem changes Programming language changes Dependency changes Several major OS version changes Perhaps one wholesale OS change Deployment platform changes CI/CD changes Original dev team disbanded CVEs are everywhere
4. @d @drnic Ideal Universe Separation of concerns Dev team Real world problem changes Language-specific team Programming language changes Dependency changes Platform team Several major OS version changes Perhaps one wholesale OS change Deployment platform changes CI/CD changes
5. @d @drnic Possible Universe Dev team Real world problem changes Programming language changes Dependency changes Language-specific team Supported versions Runtime configuration Platform team CI/CD changes Several major OS version changes Perhaps one wholesale OS change Deployment platform changes
6. @d @drnic Actual Universe Dev team
7. @d @drnic Actual Universe Dev team
9. @d @drnic Choose
 your
 Problem Statement ? How to package our app once?
 Solution: Dockerfile Operate/upgrade app for 10 yr? Solution: Not with a Dockerfile or
10. Cloud Native Buildpacks Pivotal & Heroku initiative CNCF incubation
12. Buildpacks Lifecycle Builder OCI/Docker image
13. Separation of Concerns Operating System updates to existing OCIs
14. @d @drnic Today Introduce kpack Build images atop Kubernetes Introduce pack CLI Build images locally, deploy to Kube kP
15. @d @drnic Quick Demo docker run -p 8080 NodeJS app pack build Ɲ Run in a kubernetes pod Inside container to see folders
16. @d @drnic Quick Demo $ pack set-default-builder \ cloudfoundry/cnb:cflinuxfs3 $ pack build starkandwayne/sample-app-nodejs [detector] ======== Results ======== [detector] pass: Node Engine Buildpack [detector] pass: Yarn Buildpack … [builder] -----> Node Engine Buildpack 0.0.26 [builder] Node Engine 10.16.2: [builder] Downloading from … $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-nodejs
17. Example Spring $ pack build starkandwayne/sample-app-java ===> DETECTING [detector] skip: org.cloudfoundry.archiveexpanding@1.0.0-RC02 [detector] pass: org.cloudfoundry.openjdk@1.0.0-RC02 [detector] pass: org.cloudfoundry.buildsystem@1.0.0-RC02 [detector] pass: org.cloudfoundry.jvmapplication@1.0.0-RC02 [detector] pass: org.cloudfoundry.tomcat@1.0.0-RC02 [detector] pass: org.cloudfoundry.springboot@1.0.0-RC02 [detector] skip: org.cloudfoundry.jdbc@1.0.0-RC02 [detector] skip: org.cloudfoundry.jmx@1.0.0-RC02 [detector] Resolving plan... (try #1) [detector] Success! (7) … [builder] Cloud Foundry OpenJDK Buildpack 1.0.0-RC02 [builder] OpenJDK JDK 11.0.4: Contributing to layer $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-java
18. @d @drnic Deployment $ pack build \ starkandwayne/sample-app-nodejs:0.0.1 \ --publish $ kubectl apply -f deployment.yaml $ kubectl get pods,services $ watch curl <LB>:8080 $ pack build …:0.0.2 --publish edit deployment.yml $ kubectl apply -f deployment.yaml
19. @d @drnic yarn v npm $ yarn install $ pack build starkandwayne/sample-app-nodejs [detector] ======== Results ======== [detector] pass: Node Engine Buildpack [detector] pass: Yarn Buildpack … [builder] Process types: [builder] web: yarn start $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-nodejs
20. @d @drnic yarn v npm $ rm yarn.lock $ npm install $ pack build starkandwayne/sample-app-nodejs [detector] ======== Results ======== [detector] pass: Node Engine Buildpack [detector] pass: NPM Buildpack … [builder] Process types: [builder] web: npm start $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-nodejs
21. @d @drnic kpack kP configure via kube resources buildpack lifecycle as a service runs in kubernetes Ɲ push images to any registry kpack or similar will come to CF
22. @d @drnic kpack image kP pack build starkandwayne/sample-app-nodejs --builder cloudfoundry/cnb:cflinufs3 \ --path sample-app-nodejs/ \ --publish Similar to:
23. @d @drnic Quick Demo $ kubectl apply -f serviceaccount.yaml $ kubectl apply -f builder-cflinuxfs3.yaml $ git clone …/sample-app-nodejs.git $ kubectl apply -f kpack-image.yaml $ logs -image sample-app-nodejs … $ kubectl get image sample-app-nodejs starkandwayne/sample-app-nodejs@sha256:dbcf56 kP https://github.com/starkandwayne/sample-app-nodejs.git
24. @d @drnic Deployment # edit deployment.yaml image ref $ kubectl apply -f deployment.yaml $ kubectl get all $ watch curl -sS <LB> Hello World! # commit change to app; wait for new image $ kubectl get builds -w $ logs -image sample-app-nodejs # edit deployment.yaml image ref $ kubectl apply -f deployment.yaml $ kubectl get pods -w Hello CF Summit! kP https://github.com/starkandwayne/sample-app-nodejs.git
25. @d @drnic Built with pack $ ./hack/release.sh … similar to… pack build gcr.io/kpack/controller ./cmd/controller pack build gcr.io/kpack/build-init ./cmd/build-init pack build gcr.io/kpack/source-init ./cmd/source-init …creates release.yaml kP https://github.com/pivotal/kpack
26. Buildpacks Lifecycle Builder OCI/Docker image pack or kpack or (soon) cloud foundry
27. @d @drnic Possible Universe Dev team Real world problem changes Programming language changes Dependency changes Language-specific team Supported versions Runtime configuration Platform team CI/CD changes Major OS version changes One wholesale OS change Deployment platform changes App Buildpacks Builders Base OS Run Image CF platform
28. @d @drnic Avoid Don't go straight to Dockerfiles
29. @drnic To Infinity! Let's Build a Buildpack More of me (Dr Nic) 2pm Office Hours: Buildpacks Buildpack Core Team 11am TOMORROW