►
From YouTube: Where to Put All That YAML: Secure Content Management for Cloud Native Apps - Ryan Abrams, Mirantis
Description
Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Where to Put All That YAML: Secure Content Management for Cloud Native Apps - Ryan Abrams, Mirantis
An important part of the CI/CD toolchain for cloud-native apps is managing the content. In addition to your actual source code, container images and Helm Charts and Kubernetes Object YAMLs are all part of bringing apps into production. They are your intellectual property and must be managed carefully. The OCI distribution spec under the Linux Foundation was originally designed for container images, but the manifest and index definitions in the spec are quite flexible. This means it’s possible to support newer artifact types using the OCI distribution spec, including Helm Charts, build caches, snapshots and other YAML files, with some minor modifications, leveraging the same OCI-compliant registries to support more than just containers. In this talk, Ryan Abrams will discuss the common traits of different configuration formats and how you can use existing tools to support them.
https://sched.co/Zeiq
A
Welcome
everyone
to
this
talk
entitled
where
to
put
all
that
yaml.
So
we
had
a
couple
of
issues
with
the
video,
so
we're
gonna
be
doing
this
live.
Hopefully
I
remember
all
the
content.
We're
gonna
be
talking
about
distributed
applications
in
general
kind
of
the
evolution
of
distributed
applications
and
what
our
approach
to
them
was
at
docker
and
in
particular,
we're
going
to
be
talking
about
a
a
project
that
was
a
joint
partner
partnership
project
between
microsoft
and
docker
called
cnap,
which
is
a
distribution
format
for
distributed
applications.
A
So
I'll
give
you
some
context
on
the
problem
of
distributed
applications
in
general,
and
you
know
in
distribution
and
all
that
we'll
go
over
some
history,
stuff
kind
of
the
evolution
of
that
and
we'll
do
a
state
of
the
state
which
is
talking
about
what
cnab
is
today
and
finally,
we
have
a
demo,
not
really
a
live
demo.
Unfortunately,
we
only
have
some
screenshots
that
I'll
be
able
to
share
with
you
a
little
bit
about
myself.
So
you
know,
who
is
this
person
who's
talking
to
you
about
cnab?
A
So
my
name
is
ryan.
I
worked
at
a
cloud
startup
called
netkin
for
about
a
year
out
of
a
university
that
got
acquired
by
docker.
Where
I
worked
for
five
years.
I
kind
of
worked
all
over
the
place
while
I
was
there.
I
worked
on
docker
hub,
worked
on
the
enterprise
side
and
got
to
help
with
developing
the
distribution
format
for
cnab,
which
is
what
I'll
be
talking
to
you
about
today.
Currently
I
work
at
stripe
and
also
it's
my
birthday.
A
Okay,
so
what
really
is
the
challenge
here
like?
What
do
we
mean
when
we
talk
about?
You
know
the
distribution
of
multi-service
applications,
the
distribution
of
distributed
applications,
so,
starting
with
you,
know
premise
of
docker
democratized
containers.
You
know
containers
existed
before
docker,
of
course,
but
you
know
what
docker
did
was:
give
that
really
clean
user
experience.
You
know,
dr
paul
dr
push
docker
run
for
being
able
to
run
containers
as
a
primitive
in
the
cloud
for
running.
A
You
know
single
process
applications,
and
so
you
know
developers
got
these
tools
and
these
really
nice
elegant
tools
for
running
these
multi
in
for
running
these
single
process
applications
and
what
that
created,
maybe
as
a
side
effect
you
might
say.
Is
it
unlocked
this
movement
towards
multi-service
applications?
You
know
once
you
have
these
easier
primitives
for
evolving
single
process
applications.
You
know
in
a
data
center
or
in
the
cloud
you
start
to
move
towards.
A
You
know
these
multi-service
architectures
and
so
a
question
that
we
repeatedly
asked
ourselves
at
docker
was:
how
can
we
unlock
that
same
clean
user
experience
that
same
clean
experience
for
life
cycle
management,
but
for
multi-service
applications?
So
you
know
you've,
let's
say
you've
got
you
know:
api
front-end
workers,
asynchronous
workers,
databases,
messaging
queues,
load,
balancing.
You
know
all
of
these
components
that
make
up
a
multi-service
application.
A
A
A
Briefly,
after
that
there
was
a
thing
called
dabs,
so
dabs
were
distributed,
application
bundles.
These
were
essentially
a
way
to
package
up
a
multi-service
compose
defined
application
as
a
binary
and
ship
that
around-
and
you
know
what
we
realized
with
those
was.
They
were
still
lacking
that
really
clean
docker
push.
A
Docker,
pull
docker,
run
user
experience
a
little
bit
of
history
after
that,
so
after
a
while
docker
stack
incorporated
the
compose
binary
format,
so
you
could
do
you
know
docker
stack,
dash
c
compose
file,
and
so
you
know
this
is
the
first
time
that
we
really
had
as
opposed
to
compose
as
its
own
python,
based
binary
being
shipped
along
with
the
docker
tool
chain.
This
was
something
in
the
docker
binary
itself
that
was
aware
of
the
compose
format.
A
So
all
the
meanwhile,
while,
like
all
of
these
attempts
at
developing
a
tool
set
for
multi-service
applications,
all
the
while,
while
all
of
this
is
happening,
we're
seeing
widespread
adoption
of
kubernetes
as
the
orchestration
orchestrator
of
choice
for
a
lot
of
people.
So
we're
thinking
you
know
we,
we
can't
really
have
a
solution
here,
that's
going
to
be
swarm-centric,
for
those
who
don't
know
swarm
is
is
docker's
orchestrator,
so
enter
c,
which
would
be
you
know
the
latest
latest
and
greatest
when
it
comes
to
distribution
of
multi-service
applications.
A
So
this
is
a
project
that
starts
in
2018.
It
start
it
starts
with
some
great
work.
That's
done
by
the
developer
team
in
paris
at
docker,
as
well
as
a
partnership
with
microsoft,
and
since
then
it's
seen
quite
a
bit
of
adoption
across
the
industry
across
a
lot
of
stakeholders,
artifactory
and
red
hat,
to
name
just
a
couple
on
the
distribution
side.
So
what
cnab
stands
for
is
cloud
native
application,
bundles
and
it's
a.
A
Essentially,
a
format
for
packaging
in
multi-service
applications,
as
well
as
all
of
the
other
components
that
make
a
cloud
native
application
what
it
is,
but
you
know
as
we'll
see
it
can
be
it
it's
you're
able
to
use
cnap
for
a
lot
more
than
just
you
know,
multi-service
applications
that
was
use
case.
You
know
top
use
case
the
first
of
many
use
cases,
but
there
are
multiple
other
ones.
A
So
before
we
get
into
all
of
those
different
different
use
cases,
let's
talk
a
little
bit
about
the
components
of
a
cnab,
so
you
know,
cnab
itself
can
refer
to
the
specification,
and
I
can
tell
you
where
to
find
the
specification,
but
a
particular
cnav
is
a
particular
bundle
and
what
that
bundles
up
is
a
few
different
things.
So
the
first
thing
is
a
bundle
json
which
essentially
contains
the
metadata
of
your
application.
A
So
things
like
author
version
description,
that
sort
of
stuff
would
be
contained
in
the
bundle
json
there's
a
thing
called
an
invocation
image,
which
is
a
container
image,
and
essentially
this
is
a
container
image
that
you
point
at
an
environment
and
you
tell
it
to
stand
up
your
application
and
from
there
it's
able
to
do
whatever
steps
necessary.
I
mean
I
mean
we're
talking.
You
know
beyond
turing
complete
here.
This
is
like
any
it's
a
container
image,
it's
written
in
any
language.
A
You
would
like
using
any
framework
you
like
and
is
able
to
stand
up
your
application
against
any
target
environment.
So
your
target
environment
could
be
an
orchestrator
here.
It
could
be
a
cloud
provider
like
aws
and
the
invocation
image
is
able
to
stand
up
your
environment
service
images
are
also
packed
packaged
up
into
the
bundle
here
so
service
images
would
be
those
things
that
we
were
talking
about
earlier.
So
let's
say
you
have
you
know
your
api
container
image
and
your
worker
container
image
and
a
database.
A
You
would
like
the
package
up
or
you
can
tell
your
invocation
image.
You
would
like
to
use
your
cloud
provider's
database
as
a
service
offering.
Instead,
all
of
this
can
be
specified
using
a
combination
of
the
bundle
json
and
the
the
service
images
and
the
invocation
image,
and
the
last
thing
it
will
say
here
is
cnab
is
parameterized,
and
so
what
that
means.
A
You
know,
in
contrast
to
earlier
attempts
with
docker
compose
where
there
was
an
ability
to
override
parameters
that
were
specified
as
environment
variables
in
the
compose
format,
but
it
wasn't
very
clear
which
things
were
external
user
facing
or
configurable
at
ops
parameters
versus
which
things
were
internal
implementation.
Details
that
really
you
shouldn't
be
overriding
so
with
cnab
cnub
makes
that
very
explicit.
What
things
are
parameters
that
are
exposed
to
the
person
deploying
the
application
at
deploy
time,
and
even
has
some
some
good
type
systems
and
checks
on
that.
A
A
So
all
of
those
are
the
basic
components
of
cnab,
and
so,
as
we
discussed,
cnav
is
usable
for
distributing
multi-service
applications,
but
you
can
also
set
it
use
it
for
other
things.
So
setting
up
a
cloud
environment
is
one
example
you
can.
You
can
point
it
at
you
know,
essentially
your
cloud
provider
and
say
spin
up
everything
from
me
from
scratch,
including
you
know,
make
a
vpc
for
me:
set
the
security
groups
for
me
load.
You
know:
load
balancers,
using
load
balancers
as
a
service,
etc.
A
A
So
we're
going
to
do
a
brief
interlude
here
and
talk
about
oci,
because
you
know
this
talk
is
specifically
going
to
be
about
not
seeing
up
but
the
distribution
of
bundles.
So
how
does
that
you
go
about?
You
know
shipping,
these
bundles,
getting
them
from
where
it
is
that
they're
built
to
where
it
is
they're
ultimately
run
so
we'll
talk
a
bit
about
oci.
So
oci
is
the
open
container
initiative.
A
This
is
essentially
a
collective
of
stakeholders
in
the
container
space
who
specify
things
like
standards.
So
there
are
a
whole
bunch
of.
There
are
two
standards
in
particular
to
pay
attention
to
there's
the
the
distribution
standard
and
the
runtime
standard.
So
it
has
a
specification
for
how
you
go
about.
You
know
distributing
artifacts
via
you
know,
what's
called
a
registry,
so
a
docker
hub,
for
instance,
is
a
registry
where
you
can
store
and
ship
and
share
container
images,
and
essentially
this
is
a
collection
of
json
specifications.
A
A
Importantly,
what
the
index
format
added
on
top
of
the
original
multi-arch
image
format
was
generic
annotations,
so
these
are
essentially
a
collection
of
key
value
pairs
that
you
can
use
to
specify
whatever
additional
information
you
want
in
this
artifact,
and
thanks
to
that,
we've
seen
you
know
quite
a
bit
of
use
of
oci
indices
for
for
a
whole
bunch
of
different
use.
Cases
to
name
a
few,
so
build
caches
in
built.
Docker's
build
kit
container
snapshots
upstream
refs
is
something
that
we're
going
to
come
back
to
in
just
a
minute.
A
Also
importantly,
so
what
an
oci
index
can
do
is
reference
another
oci
index.
That's
a
nice
feature
that
allows
you
essentially
to
build.
You
know
recursively,
you
can
build
fairly
complex
graphs
of
oci
indices
and
thanks
to
that
feature,
we
were
able
to
ship
as
a
as
a
pleasant
surprise,
we
were
able
to
ship
multi-arch
multi-service
cnabs
in
the
first
go.
A
So
when
you
combine
these
two,
this
is
essentially
what
it
looks
like.
So
this
is
a
kind
of
a
summarized
version
of
an
oci
index
here
containing
cnab,
so
you
can
see
as
an
example.
Here
we
have
our
top
level
construct,
which
is
our
manifest,
and
this
is
a
list
of
all
of
the
manifests
and
indices
that
are
referenced
from
this
oci
index.
So
you
can
see,
we've
got
a
media
type
that
specifies
you
know.
This
is
a
manifest.
A
Annotations
importantly,
are
used
to
specify
what
role
this
image
plays
within
the
cnab.
So
here
we
have
an
annotation
indicating
that
this
image
is
the
invocation
image.
So,
as
I
mentioned
earlier,
the
invocation
image
is
essentially
the
entry
point
for
the
cnab
as
well
as
annotations
for
metadata.
So
you
know
we
were
very
selective
here
in
in
terms
of
what
annotations
made
it
to
our
top
set
of
our
top
set
of
metadata
things
that
we
really
wanted
to
be
able
to
surface
in
the
ui
very
easily.
A
So
there
were
a
few
different
kind
of
competing
distribution
formats
for
cnap,
and
we
really
like
this
one-
and
you
know
we've-
we
flushed
this
one
out
quite
a
bit,
and
so
let
me
talk
a
little
bit
about
what
this
gave
us
as
a
format.
So
the
I
think
most
important
thing
for
us
was
that
it
really
simplified
authorization.
A
A
Another
advantage
was
that
signatures
were
preserved,
so
you
know
you,
you
essentially
reference
the
same
exact,
manifest
from
within
an
oci
index.
That
was
what
may
have
been
built
by
an
upstream
company.
Let's
say
which
means
that
the
digest
for
that
manifest
stays
the
same,
which
means
that
the
signatures
for
that
manifest
stay
the
same.
So
you
know
you
could,
in
theory
and
and
we
we
developed
prototypes
of
this-
of
preserving
signature
metadata
in
the
index
itself.
A
As
I
mentioned
as
a
pleasant
surprise,
we
were
able
to
do
multi-arch
and
multi-service
in
the
first
version
of
this,
and
you
know.
Unfortunately,
I
can't
show
you
this,
but
we
were
able
to
develop
in
the
enterprise
version
apis
as
well
as
uis
for
deep
inspection
of
images.
So
you
can
imagine
you
know
you
start
with
your
top
level
application
and
you
can
drill
down
into
you.
A
You
see
a
summary
of
all
of
the
vulnerability
data
that
was
found
through
scanning
of
that
image,
but
you
could
drill
into
specific
components
into
specific
architectures
and
see
vulnerabilities
found
through
scanning
there
as
well,
and
finally,
we
have
our
demo.
So,
as
I
mentioned,
this
isn't
going
to
be
a
live
demo.
I'll
just
show
you
a
few
screenshots
of
how
it
is
that
you
work
with
this.
To
do
this,
I
cloned
the
famous
docker
voting
application,
which
you
can
find
at
github.
A
So
once
I
cloned
it,
I
made
a
couple
of
minor
modifications
to
make
it
work
for
a
docker
app
and
once
I
had
that
you
can
see
here,
I've
got
a
screenshot
of
doing
a
docker
app
push.
This
essentially
was
a
push
that
I
did
to
push
up
the
dock,
the
app
to
docker
hub.
Just
one
note
here
so
this
this
platform
that
I
have
indicated
here.
This
allows
you
to
to
filter
which
architecture
and
os
combinations
you'd
actually
like
to
push.
A
So
this
is
a
way
of
filtering
it
down.
You
know
if
you
have
multi-arch
applications
and
there
are
like
30
architectures
provided,
but
you
don't
want
to
push
all
of
them.
You
can
specify
that
I'm
not
sure
all
of
you
can
see
this,
but
this
is,
if
you
do,
if
you
then
go
and
do
a
curl
on
the
resource
that
you've
just
pushed
you'll
get
this
as
a
json
response,
and
you
can
see
so
this.
This
really
fleshes
out.
A
What
I
was
talking
about
earlier
in
terms
of
these
are
all
of
the
components
of
the
oci
index.
These
are
all
of
the
individual
manifests
that
are
referenced
by
digest,
as
well
as
the
annotations
that,
let
you
know
you
know
metadata
about
what
role
each
of
these
images
plays
in
your
multi-service
image,
as
well
as
top-level
metadata,
specifying
things
like
description
and
version,
etc.
A
And
then,
once
I
had
that
I
was
able
to
do
a
docker
app
install
and,
as
you
can
see,
it's
sending
up
all
the
individual
resources.
You
know
service,
network
etc,
and
it
worked,
and
I
was
able
to
do
a
cast
of
vote
and
it
looks
like
I
voted
for
cats
when
I
went
to
go
check
it
out.
Oh
one
thing
I
should
say
you
know
just
just
really
clarify
like
you
know
how
this
is
a
multi-service
application.
So
you
know
this.
This
is
a.
A
This
is
a
net
application
in
combination
with
some
python,
so
you
know
really
multi-service
as
well
as
it's
got
a
database
to
store
all
this
stuff,
so
you
know
really
like
a
proper
multi-service
application
and,
lastly,
thank
you
all
I.
I
hope
that
that
went
pretty
smoothly
because,
as
I
mentioned,
we
had
some
issues
with
the
video.
A
So
hopefully
I
remembered
everything
that
I
wanted
to
say,
so
you
can
follow
the
project
cnab
at
cnab.io,
and
there
are,
let
me
give
a
shout
out
to
their
a
bunch
of
members
from
the
paris
team
at
docker
who
are
currently
actively
working
on
this
here
attending
kubecon.
Now
and
some
of
them
will
be
giving
some
excellent
talks
on
this
as
well,
and
now
we
have
q.
A
A
A
A
A
A
A
A
A
A
Is
docker
the
only
runtime
able
to
run
cnn
bundles?
No!
So,
oh,
that's
that's
a
little
bit
of
a
difficult
question
to
answer
because
docker
apps
themselves.
Yes,
if
you
want
to
run
docker
app,
install
which
is
compliant
with
this,
the
cnap
spec,
you
will
have
to
do
that
on
docker
itself,
but
you
can
point
it
to
an
environment
that
uses
other
container
runtimes.
So,
let's
say
you're
sending
up
a
kubernetes
application
using
cnab.
A
A
A
A
So
if
you
use
the
the
docker
cli
and
the
docker
app
tooling,
essentially
you
can
run
through
this
flow.
Unfortunately,
I
wasn't
able
to
show
it,
but
you
know
you
can
do
it
a
docker
app
in
it,
which
will
be
to
set
up
all
of
your
files
locally
for
configuring,
your
application,
if
you
have
a
compose
application
already,
it
will
use
that
as
the
basis
for
your
application
and
then
you
can
go
into
those
gambles
specifically,
and
you
know
specify
these
are
the
components
of
my
application.