Bringing Buildpacks to Kubernetes

Kubernetes solves orchestration of containers, but it does not solve the 10 year problem of ensuring that the software running in production always contains CVEs to the root filesystem, to OS packages, to language packages, and the application itself.

Replace Dockerfiles with Cloud Native Buildpacks to convert your application software into OCI/docker images, and use tools like pack and kpack to continuously upgrade images with latest dependencies, and to rebase the base OS layer of images to latest version.

Transcript

1. Title Text
   Body Level One
   Body Level Two
   Body Level Three
   Body Level Four
   Body Level Five
   Bringing Buildpacks to
   Kubernetes
   Cloud Foundry Summit Hague 2019
   Dr Nic Williams @drnic
   

   View Slide

2. @drnic
   To Infinity! Let's Build a Buildpack
   More of me (Dr Nic)
   2pm
   Office Hours: Buildpacks
   Buildpack Core Team
   11am
   TOMORROW
   

   View Slide

3. @d
   @drnic
   Problem
   Scope
   ?
   Consider every app over 10 years
   Real world problem changes
   Programming language changes
   Dependency changes
   Several major OS version changes
   Perhaps one wholesale OS change
   Deployment platform changes
   CI/CD changes
   Original dev team disbanded
   CVEs are everywhere
   

   View Slide

4. @d
   @drnic
   Ideal
   Universe
   Separation of concerns
   Dev team
   Real world problem changes
   Language-specific team
   Programming language changes
   Dependency changes
   Platform team
   Several major OS version changes
   Perhaps one wholesale OS change
   Deployment platform changes
   CI/CD changes
   

   View Slide

5. @d
   @drnic
   Possible
   Universe
   Dev team
   Real world problem changes
   Programming language changes
   Dependency changes
   Language-specific team
   Supported versions
   Runtime configuration
   Platform team
   CI/CD changes
   Several major OS version changes
   Perhaps one wholesale OS change
   Deployment platform changes
   

   View Slide

6. @d
   @drnic
   Actual
   Universe
   Dev team
   

   View Slide

7. @d
   @drnic
   Actual
   Universe
   Dev team
   

   View Slide

8. View Slide

9. @d
   @drnic
   Choose

   your

   Problem
   Statement
   ?
   How to package our app once?

   Solution: Dockerfile
   Operate/upgrade app for 10 yr?
   Solution: Not with a Dockerfile
   or
   

   View Slide

10. Cloud Native Buildpacks
    Pivotal & Heroku initiative
    CNCF incubation
    

    View Slide

11. View Slide

12. Buildpacks
    Lifecycle
    Builder OCI/Docker image
    

    View Slide

13. Separation of Concerns
    Operating System updates to existing OCIs
    

    View Slide

14. @d
    @drnic
    Today Introduce kpack
    Build images atop Kubernetes
    Introduce pack CLI
    Build images locally, deploy to Kube
    kP
    

    View Slide

15. @d
    @drnic
    Quick
    Demo
    docker run -p 8080
    NodeJS app
    pack build Ɲ
    Run in a kubernetes pod
    Inside container to see folders
    

    View Slide

16. @d
    @drnic
    Quick
    Demo
    $ pack set-default-builder \
    cloudfoundry/cnb:cflinuxfs3
    $ pack build starkandwayne/sample-app-nodejs
    [detector] ======== Results ========
    [detector] pass: Node Engine Buildpack
    [detector] pass: Yarn Buildpack
    …
    [builder] -----> Node Engine Buildpack 0.0.26
    [builder] Node Engine 10.16.2:
    [builder] Downloading from …
    $ docker run -ti -p 8080:8080 \
    starkandwayne/sample-app-nodejs
    

    View Slide

17. Example
    Spring
    $ pack build starkandwayne/sample-app-java
    ===> DETECTING
    [detector] skip: org.cloudfoundry.archiveexpanding@1.0.0-RC02
    [detector] pass: org.cloudfoundry.openjdk@1.0.0-RC02
    [detector] pass: org.cloudfoundry.buildsystem@1.0.0-RC02
    [detector] pass: org.cloudfoundry.jvmapplication@1.0.0-RC02
    [detector] pass: org.cloudfoundry.tomcat@1.0.0-RC02
    [detector] pass: org.cloudfoundry.springboot@1.0.0-RC02
    [detector] skip: org.cloudfoundry.jdbc@1.0.0-RC02
    [detector] skip: org.cloudfoundry.jmx@1.0.0-RC02
    [detector] Resolving plan... (try #1)
    [detector] Success! (7)
    …
    [builder] Cloud Foundry OpenJDK Buildpack 1.0.0-RC02
    [builder] OpenJDK JDK 11.0.4: Contributing to layer
    $ docker run -ti -p 8080:8080 \
    starkandwayne/sample-app-java
    

    View Slide

18. @d
    @drnic
    Deployment
    $ pack build \
    starkandwayne/sample-app-nodejs:0.0.1 \
    --publish
    $ kubectl apply -f deployment.yaml
    $ kubectl get pods,services
    $ watch curl :8080
    $ pack build …:0.0.2 --publish
    edit deployment.yml
    $ kubectl apply -f deployment.yaml
    

    View Slide

19. @d
    @drnic
    yarn
    v
    npm
    $ yarn install
    $ pack build starkandwayne/sample-app-nodejs
    [detector] ======== Results ========
    [detector] pass: Node Engine Buildpack
    [detector] pass: Yarn Buildpack
    …
    [builder] Process types:
    [builder] web: yarn start
    $ docker run -ti -p 8080:8080 \
    starkandwayne/sample-app-nodejs
    

    View Slide

20. @d
    @drnic
    yarn
    v
    npm
    $ rm yarn.lock
    $ npm install
    $ pack build starkandwayne/sample-app-nodejs
    [detector] ======== Results ========
    [detector] pass: Node Engine Buildpack
    [detector] pass: NPM Buildpack
    …
    [builder] Process types:
    [builder] web: npm start
    $ docker run -ti -p 8080:8080 \
    starkandwayne/sample-app-nodejs
    

    View Slide

21. @d
    @drnic
    kpack
    kP
    configure via kube resources
    buildpack lifecycle as a service
    runs in kubernetes Ɲ
    push images to any registry
    kpack or similar will come to CF
    

    View Slide

22. @d
    @drnic
    kpack
    image
    kP
    pack build starkandwayne/sample-app-nodejs
    --builder cloudfoundry/cnb:cflinufs3 \
    --path sample-app-nodejs/ \
    --publish
    Similar to:
    

    View Slide

23. @d
    @drnic
    Quick
    Demo
    $ kubectl apply -f serviceaccount.yaml
    $ kubectl apply -f builder-cflinuxfs3.yaml
    $ git clone …/sample-app-nodejs.git
    $ kubectl apply -f kpack-image.yaml
    $ logs -image sample-app-nodejs
    …
    $ kubectl get image sample-app-nodejs
    starkandwayne/sample-app-nodejs@sha256:dbcf56
    kP
    https://github.com/starkandwayne/sample-app-nodejs.git
    

    View Slide

24. @d
    @drnic
    Deployment
    # edit deployment.yaml image ref
    $ kubectl apply -f deployment.yaml
    $ kubectl get all
    $ watch curl -sS
    Hello World!
    # commit change to app; wait for new image
    $ kubectl get builds -w
    $ logs -image sample-app-nodejs
    # edit deployment.yaml image ref
    $ kubectl apply -f deployment.yaml
    $ kubectl get pods -w
    Hello CF Summit!
    kP
    https://github.com/starkandwayne/sample-app-nodejs.git
    

    View Slide

25. @d
    @drnic
    Built with
    pack
    $ ./hack/release.sh
    … similar to…
    pack build gcr.io/kpack/controller ./cmd/controller
    pack build gcr.io/kpack/build-init ./cmd/build-init
    pack build gcr.io/kpack/source-init ./cmd/source-init
    …creates release.yaml
    kP
    https://github.com/pivotal/kpack
    

    View Slide

26. Buildpacks
    Lifecycle
    Builder OCI/Docker image
    pack or kpack or (soon) cloud foundry
    

    View Slide

27. @d
    @drnic
    Possible
    Universe
    Dev team
    Real world problem changes
    Programming language changes
    Dependency changes
    Language-specific team
    Supported versions
    Runtime configuration
    Platform team
    CI/CD changes
    Major OS version changes
    One wholesale OS change
    Deployment platform changes
    App
    Buildpacks
    Builders
    Base OS
    Run Image
    CF platform
    

    View Slide

28. @d
    @drnic
    Avoid
    Don't go straight to Dockerfiles
    

    View Slide

29. @drnic
    To Infinity! Let's Build a Buildpack
    More of me (Dr Nic)
    2pm
    Office Hours: Buildpacks
    Buildpack Core Team
    11am
    TOMORROW
    

    View Slide