Cloud Native Computing Foundation GitOpsCon North America 2021, 30 Oct 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Gitopsify Cellular Architecture - Ayush Ghosh & Sergey Sergeev, Cisco Systems, Inc.

Description

Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Gitopsify Cellular Architecture - Ayush Ghosh & Sergey Sergeev, Cisco Systems, Inc.

Building and managing data-intensive microservices applications have their challenges. Cellular architecture & Gitops together help create an independently deployable, manageable, and observable solution. We moved from running multiple expensive non-prod inconsistent environments to testing in production. Weave Flux, Istio, and Crossplane helped us build multi-cloud, multi-cluster declarative environments in minutes. With the new deployment model and custom tooling, devs can get a miniaturized version of the SaaS running on their laptops. The devs can pick and choose which components and versions they want to run locally. The CI/CD metrics have improved dramatically as the integration & E2E tests run against real apps and not mocks. The system spins up real cloud-native solutions for production deployments and falls back to containerized workloads for non-production. Adding support for new regions has come down to days of work from months.

A

Yeah we have just uh 10 minutes. Unfortunately, we have material for hours to talk, but we will give just high level overview. So, first of all, my name is sergey sanger from ap dynamics, cisco.

B

Hi, I'm ayush, I'm a principal engineer at cisco systems.

A

Yeah and we will talk about cellular architecture and how to detoxify it so first about ap dynamics, it's a full stack oops, it's a full stack, observability platform. uh It provides insights for businesses, users, applications, infrastructure, network and security.

A

We have sas deployments around the world, hundreds of billions of data points a day so um and let's talk about solar architecture and what it is. So it's a collection of components grouped from design and implementation for inter deployment, it's basically independent, independently deployable, manageable and observable, and it just provides a way to split like infinitely uh scaling problem into smaller chunks.

A

So you basically short your customers into each cell, so it provides a way to to to apply some upper bound for your sales probability and um basically it provides a way to limit blast radio. So if something happens with one cell deployment, it affects only that part of customers.

A

It also provides a way to reason about capacity and scalability, so you can define some upper bounds for each individual cell scalability.

A

Also, it is disaster recovery, it's very hard to uh to do disaster recovery for, like a huge deployment, infinitively growing. How? How do you recover it from disaster? So it's very hard. We have cell-based architecture, it can be tested validated, so you can apply some ici pipeline for your disaster recovery processes also, it helps to move some of the heavy traffic customers to an individual cell, so they do not act as a noisy neighbors for other customers and also it to minimize resources over privilege.

A

So, basically you may order provision resources in one cell, but once you have enough cell deployments, so it just limits the resources of your privilege union.

A

So what is a cell? So it's basically uh over a hundred of applications. We use microservices pattern at fd, so it's 100 over 100 of different micro services, with data stores and all the infrastructure and foundational components needed to run that system.

A

Also, we have a global control plane which hosts basically global services needed for sales to operate uh like a global event, bus to communicate and archestrate, tenant, provisioning or tenant management. Also, we have the management cell itself, which does basically fleet management, so it provisions new cells. It manages and monitors basically uh the rest of the cells and just again to highlight the scale. It's hundreds of applications uh contributed by dozens of engineering teams. So it's a quite a lot of things going on in each individual cell, and with this I will.

B

A

Usually provide more details about the githubs side of the.

B

Phones, yes, so we have a single management cell, which is responsible to provision all of our tenant cell and the control cell, so to add a tenant cell. You basically add something like uh manifest something like this, where you say which control side to deploy in which cloud which reason the number of tenants sell and things like that. So what it does is that once you commit this to our main tops repository, the flux in the management cell will reconcile and that will kick in the cross plane in that management cell.

B

That will actually create all the base. Kubernetes based cloud resources like the vpc, the subnet, the security group and the kubernetes cluster itself. It will also create the node group based on the profile that has been provided here and once the cluster is up and running, it will basically uh bootstrap once the cluster is up and running, it will bootstrap flux in the cluster and it with the cluster path that is provided here.

B

So the cluster path that was provided in the cluster in the cell creation, manifest is, is a path to the cluster configuration. So cluster configuration is a way to encapsulate all the components that go in a cluster or that needs to be installed in a cluster. This necessarily doesn't need needs to be the kubernetes resources. This can be any of the cloud resources that needs to be provisioned in that cell. So in our case, so this it's like a layer key.

B

So at start it's like a layer kick and then like the reconciliation order is from bottom to top, and the layer above is depending on the form for the services which are being provided from the layer below. So it start with our foundational components like the hem repositories, the foundational teams, definitions, the gateways and the service mesh. Once the foundational components are created, we start adding the security component, security and compliance components like kiberno and oppa. So this ensures that everything that's added after this point is compliant with our security and compliance policies.

B

So, after the security components are good and ready, we add the we onboard the teams, the in the onboarding teams, it basically the name spaces. The service account are back, so this gives us a very tight control on what the teams can or cannot do in the cell. So after the teams are added, we add the infrastructure components like the cross plane, the monitoring stuff so, ah and this infrastructure component is used by the shared data stores and the application components in shared source. We have kafka android.

B

So after the shared data stores are created which are shared by multiple teams, the applications components are being reconciled and we also encapsulate all the all the components that application needs, like the private, their private data stores, their ingress, their egress rule and any of the security components that is specific to their applications.

B

So and in at dynamics we use a mono repository, and so um we use a mono depository, so a flux, basically compa reconciles from a directory in the cluster overlay, which is which is basically uh which is basically derived from the base cluster overlap.

B

We have two flavors of our deployment, basically the ci flavor and the cloud flavor, so in the ephemeral flavor. What we do is we provision a continuous workload and if you basically spin up the same application in a cloud environment, you will spin up postgres, you will spin up actual cloud resources. Give you an example. Let's say you have an application which is deployed and unless you have application which needs redis. So if you deploy it in a fml cluster, it will use redis container.

B

But if you deploy the same application in a kubernetes or in aws environment, it will spin up elastic cache, so uh so yeah. So this gives us a uniform pattern to deploy the whole of sas dynamics, platform or part of it in our ci, cd, local or production environment and app dynamics, hiring come join us and see you in the break.

A

Yeah we we made it here. Each each slide deserves like a half an hour. Talk, that's why we just provided uh some high level where you meet us at the break in the hall. So we will be happy to chat with you in more details to answer your questions and, if you're excited about uh what we do come join us updates, hiring so and thank you so much for coming. So many people excited to see some back to normal.

B