Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Progressive Delivery in the Kubernetes Era - Vo...

Progressive Delivery in the Kubernetes Era - Voxxed Days Luxembourg

Kevin Dubois

June 22, 2023
Tweet

More Decks by Kevin Dubois

Other Decks in Technology

Transcript

  1. Kevin Dubois • Principal Developer Advocate at Red Hat •

    18+ years of experience building and delivering software applications • Speak English, Dutch, French, Italian • Passionate about improving Dev Experience with Open Source @[email protected] youtube.com/@thekevindubois linkedin.com/in/kevindubois github.com/kdubois @kevindubois.com
  2. Developer Flow Outer loop Inner loop Pull/Merge Request Production Build

    / Package Code Push Debug Code Review Build Deploy Security Tests Compliance Inner loop Outer loop Developer Test
  3. Today, let’s focus on the “Outer Loop” The outer loop

    consists of the larger team processes that your code flows through on its way to the cluster: code reviews, integration tests, security and compliance. It needs be transparent and fast for developers from all teams. Outer Loop Development
  4. CI - CD - CD Build Test Security Checks Release

    Deploy Stage Deploy Prod Continuous Integration Continuous Delivery Continuous Deployment Manual Auto
  5. The application Push to give energy windmill Kafka Topic 2.Sends

    the interaction Dashboard: Green Energy Nickname Team Push/Tap to generate energy Cars that needs energy Two teams competing (top 5 players) First wins
  6. Architecture 3: Generate power (REST) Game Dashboard 1: Assign player

    Name & Team (REST) 6: Update dashboard (SSE) 2: Increment player cluster counter 4: Send power event 5: Receive power events
  7. Developer Flow Outer loop Inner loop Pull/Merge Request Production Build

    / Package Code Push Debug Code Review Build Deploy Security Tests Compliance Inner loop Outer loop Developer Test
  8. Cloud-Native CI/CD Containers Built for container apps and runs on

    Kubernetes Designed with microservices and distributed teams in mind DevOps Serverless Runs serverless with no CI/CD engine to manage and maintain
  9. Why Cloud-Native CI/CD? Traditional CI/CD Cloud-Native CI/CD Designed for Virtual

    Machines Designed for Containers and Kubernetes Require IT Ops for CI engine maintenance Pipeline as a service with no Ops overhead Plugins shared across CI engine Pipelines fully isolated from each other Plugin dependencies with undefined update cycles Everything lifecycled as container images No interoperability with Kubernetes resources Native Kubernetes resources Admin manages persistence Platform manages persistence Config baked into CI engine container Configured via Kubernetes ConfigMaps Declarative !
  10. Tekton is a Graduated Continuous Delivery Foundation project and follows

    the OpenSSF best practices. Contributions from Google, Red Hat, Cloudbees, IBM, Elastic, Puppet, and many more An open-source project for providing a set of shared and standard components for building Kubernetes-style CI/CD systems https://tekton.dev
  11. Step • Runs commands within container(builder image) • Mounts volumes,

    uses env vars • Eg. ‘mvn test’ or ‘git clone’ Task • A list of steps that are executed in sequential order • Takes inputs, outputs parameters Task Run • Runs a individual Task Pipeline • List of tasks defined to run in a certain order • Takes inputs, outputs parameters Pipeline Run • Runs a Pipeline Typed Decoupled Cloud Native Declarative Tekton Concepts
  12. apiVersion: tekton.dev/v1beta1 kind: Pipeline metadata: name: wind-turbine-pipeline spec: params: -

    name: MANIFESTS_GIT_REPO type: string tasks: - name: git-clone params: - name: url value: $(params.GIT_REPO) workspaces: - name: output workspace: source workspaces: - name: source
  13. Tekton CLI(tkn) •List and Describe • Pipeline • Resource •

    Task • Task Run • Pipeline Run •View logs • Task Run • Pipeline Run •https://github.com/tektoncd/cli
  14. What is GitOps? Treat everything as code Git is the

    single source of truth Operations through Git workflows
  15. CI/CD Engines Jenkins Spinnaker Tekton Concourse CI …... CI/CD versus

    GitOps Desired State Cluster State Observe State Take Action GitOps Engines ACM, ArgoCD, FluxCD Razee, Faros Desired State Cluster State
  16. ArgoCD Sync Monitor Detect drift Take action Argo CD is

    a declarative, GitOps continuous delivery tool for Kubernetes. Cluster and application configuration versioned in Git Automatically syncs configuration from Git to clusters Drift detection, visualization and correction
  17. Source Git Repository Image Registry CI Config Git Repository Kubernetes

    CD Pull Request / Commit Push Pull GitOps Application Delivery Model
  18. GitOps Application Delivery Model Push Pull Pull Request Source Git

    Repository Image Registry Config Git Repository Kubernetes Deploy Monitor Detect drift CD Take action
  19. What is Progressive Delivery? Build Test Security Checks Release Deploy

    Stage Deploy Prod Continuous Integration Continuous Delivery Continuous Deployment Manual Auto
  20. What is Progressive Delivery? • No Big Bang • Deploy

    != Release • Metrics • Subset of Users
  21. Why Progressive Delivery? • Decreases Downtime • Limits the Tragedy

    • Deploy & Release to Production faster • Less mocking or setting up unreliable ‘fake’ services
  22. 43

  23. Blue - Green apiVersion: v1 kind: Service metadata: name: my-service

    labels: app: mystuff spec: ports: - name: http port: 8000 selector: inservice: mypods type: LoadBalancer apiVersion: apps/v1 kind: Deployment metadata: name: mynode-deployment spec: replicas: 1 selector: matchLabels: app: mynode template: metadata: labels: app: mynode spec: containers: - name: mynode image: quay.io/rhdevelopers/mynode:v1 ports: - containerPort : 8000 kubectl label pod -l app=mynode inservice=mypods
  24. Controlling Microservices with a Service Mesh Code Independent (Polyglot) •

    Intelligent Routing and Load-Balancing • Smarter Canary Releases • Dark Launch • Chaos: Fault Injection • Resilience: Circuit Breakers • Observability & Telemetry: Metrics and Tracing • Security: Encryption & Authorization • Fleet wide policy enforcement 51
  25. Istio Architecture Control Plane The data plane is composed of

    a set of intelligent proxies (Envoy) deployed as sidecars. These proxies mediate and control all network communication between microservices. They also collect and report telemetry on all mesh traffic. The control plane manages and configures the proxies to route traffic. Data Plane
  26. Pod Container JVM Service A Sidecar Container Pod Container JVM

    Service C Sidecar Container Pod Container JVM Service B Sidecar Container The sidecar intercepts all network traffic
  27. Canary Release apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: recommendation spec:

    hosts: - recommendation http: - route: - destination: host: recommendation subset: version-v1 weight: 75 - destination: host: recommendation subset: version-v2 weight: 25
  28. Shadowing Traffic apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: recommendation spec:

    hosts: - recommendation http: - route: - destination: host: recommendation subset: version-v1 mirror: host: recommendation subset: version-v2
  29. Dark Canary apiVersion: networking.istio.io/v1alpha3 kind: VirtualService metadata: name: recommendation spec:

    hosts: - recommendation http: - match: - headers: end-user: exact: Alexandra route: - destination: host: recommendation subset: version-v2 - route: - destination: host: recommendation subset: version-v1
  30. Rolling out automatically apiVersion: argoproj.io/v1alpha1 kind: Rollout metadata: name: rollouts-demo

    labels: app: rollouts-demo spec: strategy: canary: steps: - setWeight: 20 - pause: duration: "1m" - setWeight: 50 - pause: duration: "2m" canaryService: rollouts-demo-canary stableService: rollouts-demo-backend trafficRouting: istio: virtualService: name: rollout-vsvc routes: - primary …
  31. Metrics Based Rollouts strategy: canary: analysis: args: - name: service-name

    value: rollouts-demo-canary.canary.svc.cluster.local templates: - templateName: success-rate canaryService: rollouts-demo-canary stableService: rollouts-demo-stable trafficRouting: istio: virtualService: name: rollout-vsvc routes: - primary steps: - setWeight: 30 - pause: { duration: 20s } - setWeight: 40 - pause: { duration: 10s } - setWeight: 60 - pause: { duration: 10s } - setWeight: 80 - pause: { duration: 5s } - setWeight: 90 - pause: { duration: 5s } - setWeight: 100 - pause: { duration: 5s }
  32. apiVersion: argoproj.io/v1alpha1 kind: AnalysisTemplate metadata: name: success-rate spec: args: -

    name: service-name metrics: - name: success-rate interval: 10s successCondition: len(result) == 0 || result[0] >= 0.95 failureLimit: 2 provider: prometheus: address: https://internal:[email protected]:9090 query: | sum(irate(istio_requests_total{ reporter="source", destination_service=~"{{args.service-name}}", response_code!~"5.*"}[30s]) ) Metrics Based Rollouts
  33. Final Notes • State is always hard, start with stateless

    • Step by Step • Embrace GitOps • If you haven’t automatically destroyed something by mistake, you aren’t automating enough • Demos ◦ https://dn.dev/istio-tutorial ◦ https://github.com/kdubois/progressive-delivery ◦ https://github.com/redhat-developer-demos/bubbles-progressive-delivery ◦ github.com/redhat-developer-demos/quinoa-wind-turbine 65
  34. Start exploring in the OpenShift Sandbox. Learn containers, Kubernetes, and

    OpenShift in your browser. developers.redhat.com/developer-sandbox Try Red Hat's products and technologies without setup or configuration.
  35. 68 Learn OpenShift and all Cloud Native for free in

    our web based learning portal Resources Try OpenShift GitOps on our learning portal Red Hat Developers Deep Dive Join our workshops to explore Argo CD, Tekton, Kubernetes, Helm and more! Sign up at developers.redhat.com Find out more about Red Hat’s products and what it offers developers GitOps ebooks Find out more on GitOps with ebooks https://developers.redhat.com/e-books Get more about GitOps on Red Hat Developer Portal!
  36. Join Red Hat Developer. Build here. Go anywhere. facebook.com/RedHatDeveloper youtube.com/RedHatDevelopers

    twitter.com/rhdevelopers linkedin.com/showcase/red-hat-developer Thank you!