Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2019 (Barcelona), 22 May 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Reproducible Development and Deployment with Bazel and Telepresence - Christian Roggia

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Reproducible Development and Deployment with Bazel and Telepresence - Christian Roggia, Engel & Völkers Technology GmbH

As the system grows in size and complexity the pain of maintaining an up-to-date local environment becomes less and less sustainable. Developers will eventually have to deal with large docker-compose YAMLs and strict build guidelines, slowing down the development process and encouraging build-push-deploy cycles instead. This talk will explore a better approach to the issue by making both development and deployment fully reproducible, reducing required efforts and allowing for more reliable releases. Attendees will be introduced to the Bazel ecosystem combined with Telepresence’s proxying capabilities. The final goal is to understand how Bazel can help developers achieve a fully hermetic and reproducible build environment, and how locally produced images can be connected from developers’ machines to the remote cluster through the two-way communication proxy offered by Telepresence.

https://sched.co/MPXE

A

Let's start in puia I'm your host for this afternoon. The next talk is gonna, be about reproducible, development and deployment environments with basil and telepresence. After the talk, there's gonna be a Q&A, so if you're leaving behind bit before that, please leave very like without too much noise, because people will be wanting to asking questions, and you want to respect the host Christian Raja from angle and focus is gonna. Give this talk stages. All yours. Thank.

B

You so welcome everybody. Today, topic of this presentation is going to be reproducible, development and deployment with basil and telepresence. So before we start, I will just give a short introduction of myself. My name is mr.

B

Rajan I'm, a software developer for focus technology, and our mission is to disrupt the real estate market with new technologies, so I'm also, currently the maintainer of share different official hard shots, log stash and elastic stack, which are closely related and I donor of another one, don't see Roy if you want to go deeper into a topic or you want to discuss more about today. Topic feel free to reach me on to the email, pitcher or whatever you prefer.

B

So the agenda for today will be divided into two main parts, so there are four sections, but two main parts. The first part is about an introduction of the software, so with that basil and telepresence, the second part is more about how they interact with each other, how they combine, and we will say some examples. So, at the end of every section, there is a demo so that you will not just get bore with all the slides and everything and I hope you can enjoy it.

B

So first question how many of you have ever heard or years basil before raise your hands. Okay, I see some people and that's really good. Also because basil, it's used to build basil.

C

B

They terminated itself and pencil frogs as well. It comes from I mean an internal project by Google and so Florida and Cuban ethical as well. So this is not really surprising. What is basil is a build automation tools, so something that is very close. It's see, make and make you are I'm pretty sure. All of you are familiar with that, so it works kind of a similar way, but it's much much more powerful than these tools. It allows features like parallel execution.

B

Incremental build reproducible builds hermetic, because then we will see more of these features during the presentation. Second question is how many of you have heard, or ever use telepresence before all right. So telepresence is a two-way communication proxy for kubernetes. It works in a kind of similar way as cube City Airport forward, but it's much much more powerful than that and during this presentation we are going to go into details of how it works and what enables you alright, so we're gonna start with basil and reproducible builds. Why do you need for producing the build?

B

So how does it help you? Why is it necessary about to understand what is reproducible builds and why do we need them? We need first to understand well the architecture that people use, how they build us after how you build your software and we're going to analyze twin main architecture for this, so the first one is the standard architecture which is pretty much like no architecture, it's taking all the software and install it on your machine, whether.

C

B

It's going, it's not Jes and hope that this will work. So there is gonna be very huge guidelines with me on how to make it work most of the time it will just not work. Your new comers are gonna scream, because this is hell for most of us and I know. Many of you know that so how many of you are currently developing this way I would like to know your hands. Don't be ashamed. Just raise your hand, okay. This is this really good? There is not too many hands me.

B

That's very bad architecture, so because engine need to make something up or running, it doesn't work out of the box. You just cannot check out the repository and make it work, so we are going with the next kind of architecture, one that has become more and more popular nowadays, which is the containerized architecture, so you building environment, it's inside a total container.

B

So if you need to be going, it would be the going tour chain if it Java is the SDK of Java and so on and so forth for all the programming languages that you are currently using. How many of you are using this one? Instead, that's surprising, so this is good, but there is still something that can grow better, because what is the problem with this kind of architecture? Well, when you build something with doctor? Well, if you build it now and if you build it in one week in one month, it's gonna be different.

B

The output is different, because doctor doesn't come with the promise that what is going to be deliver. What is the output is actually the same. It doesn't just doesn't give you this promise, so we are going to look at basil because basil instead gives you this kind of promise, this kind of guarantee you build this something now you mail it in one week you build it in one month: it's always the same output. It doesn't matter where, how or when you build it, the output doesn't change.

B

It's simply almost the same, and this gives you reliability, because in order to 24b repair reliable, it must be always the same output. You must know what you're producing and so for big large platforms or for critical applications. This is necessary, so just as a summary reproducible builds means that every output is always the same, and Hermetic bills means that it doesn't interact with the surrounding it doesn't matter what you have installed in your machine. It doesn't matter what's installed in your container.

B

There will be no difference whatsoever in the output of the binder itself right. So we don't gonna, see some example of this. I'm gonna run three commands. The first two comments are were related to going. Those are all basic commands. The first two I could have run it them before, but I would like to show you how basil actually works. The third command is just building the application itself.

B

So I'm gonna hope this.

B

It's you can see alright, so this is the first command and I can.

A

B

B

What's it didn't open from here.

B

So what basil is currently doing now is generating this file. You can see it here on your file, that's being generated, so this file simply tells basil what we are building, which is a going application and we are using just a simple file. It's just one single source file and I'm gonna show you immediately. So this is very, very.

C

B

We are just going to print the environment, whatever. The second part is just to include an external dependency, and we see one moment why I wanted to include an external dependency. So the second command is this one.

B

Alright, this was fast and on file has been changing. A new bunch of lines have been added. Why is this necessary? Because bayes's is the language agnostic, which means that basil doesn't care which language are you building is just simple, not aware of the language itself, so this simply tells Bay so that we are gonna, need an external dependency and is grabbing this dependency from the package manager of tolling, and it will command is well, as we said before, it's just building the image and.

B

That's it. We built the application, and this is a reproducible application, because we said before that basil comes with a promise and this promises to be always reproducible and hermetic.

B

So we're gonna move forward to the second software that we introduced before telepresence. So what is telepresence? We said before there is a two-way communication proxy, but what does it proxy? Because there is many thing that telepresence those and the first one is internal resources, which means that everything that is available inside your cloud is available on your left as well, once you launch telepresence, because it will be proxy, it means that you can use internal IP addresses and you can use internal host names.

B

So this makes available from within your machine, for example, instances SQL instances if you need them. It's gonna make available, for example, auto micro services that are running in your cluster that are discoverable from your cluster or pub/sub and so on and so forth. So this is the first feature. The first nice feature. You don't need to set up cube, CTR performer for this, because telepresence will do it for you. The second feature is volumes.

B

Telepresence makes available all the volumes that are mounted into your into your deployment to your machine. It uses a natural file system and it makes everything available, which means that if you want to use secrets that are mounted as volumes, you can do that without saving the file in your repository, Gillett, ok, so obscure path, you can just access it and Thurman is my favorite one environment variables.

B

So when you have our deployment at a time, I will say 99% of the time you have some kind of environment variables, and this will be proxy directly to your machine, which means it will be available to your application. So every secret every sink, every configuration that you need. It will be directly available to your application. This means that you no longer need the Yama file, the typical local internal files, the JSON file or whatever a local configuration you need, because you can simply use telepresence and get the environment variables directly from the cluster.

B

But how does telepresence doing? Because there is different way that telepresence do it and we're gonna quickly round. One of them and I will explain which one are we gonna use, so the first one is the VPN tunnel, so it just creates a simple VPN tunnels. It affects all the processes that are running on your machine, which might end up in some kind of unexpected behavior. So it's like yeah, okay, okay, I, would say and well it doesn't work with order of appearance.

B

If you have an office VPN, this method is just not gonna work, because it's gonna clash, the VPN that you have for your office mate, the VPN setup, what telepresence? So the next method is the tcp injection. Maybe some of you are familiar with this kind of approach. It simply loads a library beforehand. So all the calls that are made to try to resolve a hostname will first go through telepresence.

B

This has some drawbacks, because if, for example, it doesn't work, it's not equally linked binaries and well. If you have, if you're using a custom, DNS resolution, it will not work well. So the last one is my favorite one and it's the one that we are gonna use through this presentation in the future. Slides is the container mode, so basically you're launching a container and all the traffic incoming and outgoing from your document. Inner won't be proxy to telepresence. So this is nice because it affects only once single process.

B

You can use your office me peon and you can use docker. So we have everything in one single node and also this as I said before, we are gonna see one simple demo: I will not run all of them because, unfortunately, we have some time constraints here, but I won't run the first command, which is the telepresence without any building. Arguments and I will show you what we can do with telepresence.

B

B

So what I'm, connecting to all right now is this cluster inside the Google cloud platform. There is just one single instance running is a demo application. It's basically just an engineer server solving their response, hello, world. There is nothing very special about that, but we are gonna, see why this is so nice to have there and what we can do with that.

B

So the presence is asking for my password and now it's connecting so it's setting up a new deployment here, so I cannot refresh and you can see that it started a new deployment. This deployment is responsible for the proxy, so this will be the proxy inside our cluster.

B

And here now we have the common line so I'm, going to just print the environment, variables and filter out whatever is related to the beam application and as you can see, the output that we got is coming from kubernetes, because this is what Kuban it is provide by default, which is the IP address of the demo application. So we are going to just send a simple request to this service and.

B

This is going to be using the internal IP address. Normally you wouldn't be able to connect that, but telepresence makes it possible to actually connect, and here we go hello world. We are gonna, try also to use the internal hostname demo app, not a 4, which is not I'm.

D

B

But just to show, as a purpose that you can use the namespace as well, so we were actually able to connect to something that is internal to the cluster itself, and this is thanks to telepresence I'm gonna exit this demo and, as you can see, the cleaner process has started, which means that it will delete in a few seconds from here the actually telepresence the problem so going further with the presentation, the next section is the containerized development environments know what is a containerize development environment.

B

We said before that there are different kind of architecture where people can build their software, but let's bring this folder with. Let's do another step with this kind of architecture. How many fewer is in this one, no isolation for both execution and computation, so you are executing and building everything just in your machine, not continuing. No, nothing just raise your hand. Okay, not so many that's interesting. um So this brings a lot of problems.

B

This brings a lot of problems because what you're building what you're running is interacting actively with the host machine, and this creates a lot of conflicts. This creates a lot of you know, environments or a lot of problems that you do know how to solve, and you have no clue where it came from, because your computer is setup in a different way from the co-worker.

B

So this leads to the typical it works on my machine and it doesn't work to the others, so the second kind of architecture, the second kind of environment, is building and executing inside docker. So you have isolation for both execution and for both compilation. How many of you are familiar or currently actively using this kind of architecture?

B

Well, that's a lot of hands. It is really good. This is really nice and this brings a lot of good features because, as we said before, if we isolate from the surrounding environment from the salon host system, we are avoiding problems like it's, not working somewhere for some obscure reason or simply it just works out of the box. You can check out the repository and it will work. Your coworker will be able to run the software, compile your software just by checking out your repository and the next, the next one.

B

Well, it's simply usable environment, as we said before we reproduce herbal. It's good, we're producible built, brings a lot of reliability. It's it's a good feature to heaven. It's very important if you are working with large application or with critical ones, so we are just using basil heals. We are continuous in based on itself and we are using basil to make sure that what we are producing is something actually reproducible all right.

B

So we are gonna, simply build our docker image for basil, so it's very basic and I'm not gonna, run the first command, because otherwise it's going to take too long to download all the layers for damage, but I'm gonna run this all that you just to give an example. So this is Dhaka file, it's less than 20 lines. It doesn't take much to actually containerize your building environment and basil. It's even easier. You can find thousands of these kind of images that are already ready to be used.

B

So I'm just gonna build this and run it, and the grant comes from here right.

B

No, that was very fast because, of course, online machine is already built, so it's already available in the local image registry and I'm gonna run it just to show how basil works and well it simply prints out the version because, as we can see from the docker file, that's the default command, it's the version, colonial.

B

B

Run a local containerized application in the cloud. This is the next section, but before we go into this, we I want to highlight only from the previous slide, which is there is some yellow line. So up to here, we try always to get everything green, but here the result in yellow there is docker compose which is okay, but why is it occasional docking compose this? One of my favorite tool is so easy and so simple and takes away so much boredom from you.

B

So if you are developing, for example, a micro service, you need to run an SQL instance, it's very easy, but then what is the problem? Well, the problem is that at some point, your architectural micro and it might become very complex, and this is where things start to get nasty because, for example, in our company we have this synchronization service, which have to connect to multiple micro services. Multiple related systems, it has used many services and I can simply not emulate everything on my machine. I have just too many services that I need to emulate.

B

So what are we gonna do? What? How are we gonna solve? This problem: well, we are using telepresence, we will be using telepresence and we will be feeding the image that we generated with basil to telepresence, so we're gonna have reproducible bills which comes from basil because we said bills from basil are reproducible and we are generating mysteries in of Basel. So what is the best? One is imaged on this release. Images normally want to build something with doctor again used.

B

The first night is from and you're selecting a distro Ubuntu Alpine Debian, whatever the problem is that by using a distro, things start to get difficult to reproduce. So what pace of does is create this new kind of images. They do not contain any distro, so they contain literally two things which are the application itself and the runtime for that application. There is nothing else, not even the show there is.

B

Nothing is the decide these images they are completely destroyed and going back to the main topic we said, basil creates, reproducible builds and these reproducible builds can include images which are reproducible also- and this gives us this reproducible development environment, which is the first part of the title. This is the first part of what we wanted to achieve so by fitting this kind of images to telepresence by using telepresence as a proxy. We are creating a reproducible deployment. What does it mean? Reproducible deployment?

B

What simply is speaking on what you are using rhetorical pause is a fake environment. It's not a real environment, it doesn't emulate. It will never be able to actually Emily the real cloud. What you have inside a cloud with teleprinters. You are actually accessing real resources, which means that what's you're building on your laptop and what you want to flowing from the laptop inside the cloud and the cloud inside your cluster in cuban- and it will be exactly the same as your pipeline will build inside the pipeline and deploy inside a cloud.

B

There will be no difference in the services used and in the application itself. Everything will be exactly the same. So here is a short recap of what we have seen so far. We've seen why isolation is important with so why something be reproducible, it's very important when you have critical or large project- and we are gonna- see now the last tango. So the last demo we are gonna just run to commands to simple commands. The first one is well basil, generates images without the doctor runtime, so docker is not aware of word.

B

The images so basil doesn't know about the image. Sorry doctor doesn't know about the image, so my run in the first command. We are making docker aware that there is an image and we are loading this image into the local registry. The second command is well. The continuum would for this image inside the cloud inside our cluster and as we just seen before, if you remember this application will just print environment variables. It.

C

B

Much it's very simple.

B

So the first command we run against this. So this one this few lines here. So this will just no docker. Please know that this kind of please load this image inside the local registry and use this tag and I'm gonna run it in music because we are running out of time, so you can see they don't put their checksum and the tag of the image itself and now that.

A

B

Can run the last command, which is this one telepresence container mode, using the image that we put doesn't.

E

B

That we just generated.

B

Takes a little to load everything up, because telepresence has to start a new pod, so this takes a few seconds, but it will be running yeah okay, so we got the output as you can see, from the output. This is not the environment where both of my laptop, this is environment variables coming from kubernetes, so the application itself. It's not a word that is running on my laptop if things that is R actually running on the cloud, which is very important, because this gives us this reproducible deployment that we wanted.

B

So going back, you know what is the conclusion: what is the outcome from all of this once we are able to use telepresence in container mode with a reproducible image? What is the conclusion for this when the conclusion is that there will be virtually no difference between your local deployment and a remote deployment? The image is the same, the application is the same, and the resources are the same. So this is what we wanted, and this is what this presentation wanted to achieve. So, if you have any question now is the question-and-answer moment.

B

Otherwise there is some more jokes that you can read on the screen. I hope you enjoy this.

E

So is it still true that using telepresence you swap out one deployment on the cluster for everybody? So if you're as a developer use telepresence, everybody else will see your local. Yes,.

B

E

Running in the cluster, how? How can that be solved easily other than using a class of every bit developer.

B

Tricky question, so the question was basically, if I use this what deployment, so, if I take over a deployment. Of course, one developer is going to take over the planner from everyone else, so nobody is gonna, be able to develop well. I would say that one solution to this kind of problem is to use multiple namespaces in your development environment, so different developers are using different namespaces. This way you can take over your own deployments without disrupting the service for someone else or otherwise.

B

I think you need to take more and more complex architecture than this yeah. There is no easy way around this, but maybe you will be able to get a better answer by data wise of my the creators of this product because they are here at the cubicle, so you would be able to try out the ask them. My personal suggestion is to actually use our name space for each developer.

B

Any other question.

C

Hi-Yah, so how do you actually see the changes that you made locally? No, no, how do you actually see if you make changes to the code that you're developing? How are they reflected remotely? You need to execute some commands recompile. What's the workflow, the.

B

Changes on the deployment yeah.

C

What you basically are setting up the proxy, so it will see the code that you have locally and then you make some changes. Let's say you change some assets of your application or some coal. Then how is that then? How do you see do you have to recompile? Do you have to so.

B

The question is, if you, if you wanted to see some changes and like, for example, a traffic or so that you are taking over a deployment but has traffic inside and you want to see some changes. This is the wasn't a question about. Let's.

C

Say you are making our website and you change.

B

C

Html then, how do you actually see it reloaded.

B

Trying to rephrase the question because I'm really having a hard time listening, okay,.

C

So, let's, let's say you're making a you have an API and you change the format of their response. Yes,.

B

C

B

C

Is that going to be visible in the cluster? Oh.

B

Okay, no, it's very clear the question so, basically, when you are swapping and taking over the deployment itself well, first uncle I can run it right now. So there is okay. There is just a big multiplication: I'm gonna run the command from here.

B

So this is gonna, swap the deployment and actually take over the deployment.

B

This takes a while.

B

All right, so the first thing is that, while other developments would be able to see that our new deployment has been created. So this is the first signal that someone is taking over on existing deployment and how you will be able to see the optional changes.

B

Is that now all the traffic that has been sent to this deployment so to the original application, once you take over all the traffic that goes to this deployment will now come to your laptop, which means that if there is an application running the the output, what will be the response will be the response coming from your machine, not from a cloud anymore. If you do not run anything. So if you just swap deployment like in this case- and you do not run any other service in any other web server.

B

Well, if anyone tries to connect to this application- and it sends some traffic, they were just going to timeout, because there is nothing listening to this application. So this is how it ought to work. Sorry I had such a life.

B

D

I love the containerize built thing. One issue that I've run into is: it is developers on on Macs they're, usually running docker in a VM and building, say large amounts of native code or anything that's heavy.

D

Basically, everyone's laptop just kind of lights on fire is that an issue you've had to deal with it all with like it's, how you're running basil in docker and if so, how have you dealt with it? So.

B

Your question is whether it is a good idea to do this kind of approach for all the applications right yep, so.

D

Specifically, the build portion so.

B

The one that you are talking about in.

D

B

Let's go this one: isn't.

D

Yeah source code is built from Basel inside a container. That's something that I've seen it was like kind of heavy. On a on a Macbook, for example, the.

B

Using basil inside of container whether it is a good idea- well, we had a case in our company where there was a Windows user that was using place on her own laptop, and the problem is that basil is not so easy to install windows. It takes a very, very long steps. There is a lot of debugging, it's not really ready for Windows. It works a lot better with Linux and mccoys, so continue rising basil itself, a lot to use just docker and docking windows.

B

You install it with installer, it just take a few seconds, so this helps people to be able to be up already as soon as they check out the repository. So, of course, you can use basil without using docker, but you are gonna encounter at some point like a different version. This is also another problem. People using a different version of basil will lead up to different output or just to not be able to compile by using a docker image. You are ensuring that whoever is building is using. The current version of basil, okay fix.

F

For the odd swap you just showed on the demo app alright for the swap you showed on the demo app per year with a question with a question of this guy. You.

F

This this will swap the demo up for everyone or just.

B

Yes, that's gonna swap for everyone, so this is actually one the question that was already us, and so basically the problem is that, of course, if multiple people are working in the same environment. So if you have one single namespace in one single cluster, where multiple the workers are working, this is not gonna be easy, because once you take all primont, you aren't doing that for everyone. So you are affecting everyone that.

F

You, okay, I, wasn't sure route. Thank you. Okay,.

G

So when you do the swap deployment, is that now locked you can someone swap deployment? Your swap deployment like when you do that the swap deployment is that now reserved for you does telepresence keep track that you're now using it or can.

B

Someone else do.

G

The swap the button on my swap that's.

B

A good question I never try that so I I'm not actually sure what happens. If someone tries to swap my own deployment, this would be funny I guess the telepresence actually would swap the deployment itself. So there will be a swapping swapping and we're going to an exception and I. Don't know, I'm not sure how to answer to this, because we never try.

B

We we try to to work on our application into our own namespaces or there is not too many developers, so we can turn all the developers when we are developing something and we are taking over a deployment.

B

So if there was no other question, I have some free t-shirt for and I know that everyone knows loves free t-shirt, so you can just come and grab one. So.