Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Bringing Buildpacks to Kubernetes

Bringing Buildpacks to Kubernetes

Kubernetes solves orchestration of containers, but it does not solve the 10 year problem of ensuring that the software running in production always contains CVEs to the root filesystem, to OS packages, to language packages, and the application itself.

Replace Dockerfiles with Cloud Native Buildpacks to convert your application software into OCI/docker images, and use tools like pack and kpack to continuously upgrade images with latest dependencies, and to rebase the base OS layer of images to latest version.

Cb2b768a5e546b24052ea03334e43676?s=128

Dr Nic Williams

September 11, 2019
Tweet

Transcript

  1. Title Text Body Level One Body Level Two Body Level

    Three Body Level Four Body Level Five Bringing Buildpacks to Kubernetes Cloud Foundry Summit Hague 2019 Dr Nic Williams @drnic
  2. @drnic To Infinity! Let's Build a Buildpack More of me

    (Dr Nic) 2pm Office Hours: Buildpacks Buildpack Core Team 11am TOMORROW
  3. @d @drnic Problem Scope ? Consider every app over 10

    years Real world problem changes Programming language changes Dependency changes Several major OS version changes Perhaps one wholesale OS change Deployment platform changes CI/CD changes Original dev team disbanded CVEs are everywhere
  4. @d @drnic Ideal Universe Separation of concerns Dev team Real

    world problem changes Language-specific team Programming language changes Dependency changes Platform team Several major OS version changes Perhaps one wholesale OS change Deployment platform changes CI/CD changes
  5. @d @drnic Possible Universe Dev team Real world problem changes

    Programming language changes Dependency changes Language-specific team Supported versions Runtime configuration Platform team CI/CD changes Several major OS version changes Perhaps one wholesale OS change Deployment platform changes
  6. @d @drnic Actual Universe Dev team

  7. @d @drnic Actual Universe Dev team

  8. None
  9. @d @drnic Choose
 your
 Problem Statement ? How to package

    our app once?
 Solution: Dockerfile Operate/upgrade app for 10 yr? Solution: Not with a Dockerfile or
  10. Cloud Native Buildpacks Pivotal & Heroku initiative CNCF incubation

  11. None
  12. Buildpacks Lifecycle Builder OCI/Docker image

  13. Separation of Concerns Operating System updates to existing OCIs

  14. @d @drnic Today Introduce kpack Build images atop Kubernetes Introduce

    pack CLI Build images locally, deploy to Kube kP
  15. @d @drnic Quick Demo docker run -p 8080 NodeJS app

    pack build Ɲ Run in a kubernetes pod Inside container to see folders
  16. @d @drnic Quick Demo $ pack set-default-builder \ cloudfoundry/cnb:cflinuxfs3 $

    pack build starkandwayne/sample-app-nodejs [detector] ======== Results ======== [detector] pass: Node Engine Buildpack [detector] pass: Yarn Buildpack … [builder] -----> Node Engine Buildpack 0.0.26 [builder] Node Engine 10.16.2: [builder] Downloading from … $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-nodejs
  17. Example Spring $ pack build starkandwayne/sample-app-java ===> DETECTING [detector] skip:

    org.cloudfoundry.archiveexpanding@1.0.0-RC02 [detector] pass: org.cloudfoundry.openjdk@1.0.0-RC02 [detector] pass: org.cloudfoundry.buildsystem@1.0.0-RC02 [detector] pass: org.cloudfoundry.jvmapplication@1.0.0-RC02 [detector] pass: org.cloudfoundry.tomcat@1.0.0-RC02 [detector] pass: org.cloudfoundry.springboot@1.0.0-RC02 [detector] skip: org.cloudfoundry.jdbc@1.0.0-RC02 [detector] skip: org.cloudfoundry.jmx@1.0.0-RC02 [detector] Resolving plan... (try #1) [detector] Success! (7) … [builder] Cloud Foundry OpenJDK Buildpack 1.0.0-RC02 [builder] OpenJDK JDK 11.0.4: Contributing to layer $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-java
  18. @d @drnic Deployment $ pack build \ starkandwayne/sample-app-nodejs:0.0.1 \ --publish

    $ kubectl apply -f deployment.yaml $ kubectl get pods,services $ watch curl <LB>:8080 $ pack build …:0.0.2 --publish edit deployment.yml $ kubectl apply -f deployment.yaml
  19. @d @drnic yarn v npm $ yarn install $ pack

    build starkandwayne/sample-app-nodejs [detector] ======== Results ======== [detector] pass: Node Engine Buildpack [detector] pass: Yarn Buildpack … [builder] Process types: [builder] web: yarn start $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-nodejs
  20. @d @drnic yarn v npm $ rm yarn.lock $ npm

    install $ pack build starkandwayne/sample-app-nodejs [detector] ======== Results ======== [detector] pass: Node Engine Buildpack [detector] pass: NPM Buildpack … [builder] Process types: [builder] web: npm start $ docker run -ti -p 8080:8080 \ starkandwayne/sample-app-nodejs
  21. @d @drnic kpack kP configure via kube resources buildpack lifecycle

    as a service runs in kubernetes Ɲ push images to any registry kpack or similar will come to CF
  22. @d @drnic kpack image kP pack build starkandwayne/sample-app-nodejs --builder cloudfoundry/cnb:cflinufs3

    \ --path sample-app-nodejs/ \ --publish Similar to:
  23. @d @drnic Quick Demo $ kubectl apply -f serviceaccount.yaml $

    kubectl apply -f builder-cflinuxfs3.yaml $ git clone …/sample-app-nodejs.git $ kubectl apply -f kpack-image.yaml $ logs -image sample-app-nodejs … $ kubectl get image sample-app-nodejs starkandwayne/sample-app-nodejs@sha256:dbcf56 kP https://github.com/starkandwayne/sample-app-nodejs.git
  24. @d @drnic Deployment # edit deployment.yaml image ref $ kubectl

    apply -f deployment.yaml $ kubectl get all $ watch curl -sS <LB> Hello World! # commit change to app; wait for new image $ kubectl get builds -w $ logs -image sample-app-nodejs # edit deployment.yaml image ref $ kubectl apply -f deployment.yaml $ kubectl get pods -w Hello CF Summit! kP https://github.com/starkandwayne/sample-app-nodejs.git
  25. @d @drnic Built with pack $ ./hack/release.sh … similar to…

    pack build gcr.io/kpack/controller ./cmd/controller pack build gcr.io/kpack/build-init ./cmd/build-init pack build gcr.io/kpack/source-init ./cmd/source-init …creates release.yaml kP https://github.com/pivotal/kpack
  26. Buildpacks Lifecycle Builder OCI/Docker image pack or kpack or (soon)

    cloud foundry
  27. @d @drnic Possible Universe Dev team Real world problem changes

    Programming language changes Dependency changes Language-specific team Supported versions Runtime configuration Platform team CI/CD changes Major OS version changes One wholesale OS change Deployment platform changes App Buildpacks Builders Base OS Run Image CF platform
  28. @d @drnic Avoid Don't go straight to Dockerfiles

  29. @drnic To Infinity! Let's Build a Buildpack More of me

    (Dr Nic) 2pm Office Hours: Buildpacks Buildpack Core Team 11am TOMORROW