Continuous Delivery Foundation CD Summit 2022 - Detroit, 4 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Bringing Shipwright to Beta - and Beyond! - Adam Kaplan, Red Hat

Description

For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/

Bringing Shipwright to Beta - and Beyond! - Adam Kaplan, Red Hat

Shipwright will soon unveil a beta API that brings stronger guarantees of support and stability. The project began as an experiment to simplify container image builds, and its graduation to beta marks a significant milestone in its maturity. As Shipwright evolved, the community strove to balance simplicity, flexibility, and security in its feature set. This lightning talk will highlight which features are graduating to beta, which features are not graduating, and how the Shipwright community came together to make these decisions. Come see how Shipwright will help teams deliver cloud-native applications on the cloud-native infrastructure!

A

So I'm going to talk about bringing shipwright to Beta And Beyond. um My name is Adam Kaplan, as fatim mentioned I'm a software engineer at Red, Hat I'm, one of the maintainers of the shipwright project and I'm also a contributor to tekton.

A

So for those of you who do not know what shipwright is or haven't had an opportunity to play around with it, shipwright makes it easy to build container images on cloud native infrastructure.

A

It became a CD Foundation project last year and recently the community came together to define a beta API which, with stronger support, guarantees and a clearer vision of what we want to do.

A

uh We've come a long way since our launch about two years ago. um This this pretty fairly modest mission statement and during the workshop we found ourselves coming back to that First Fundamental question of who we are, what is shipwright and, more importantly, what do we want shipwright to become so we concluded that shipwright is and should remain, a framework for building container images share price core apis, make it simple to build a container image from source using tools that are actively maintained by a community of experts.

A

What shipwright does is it separates the build strategy, as we call it from the build definition and execution and that's something that is going to remain a Cornerstone of the framework.

A

But during our discussions we realize that building the image is more than just the image that really the image is the starting point. uh Software supply chain security is a topmost concern. You're, going to see it everywhere at a see at uh here today, at CD, Summit and everywhere else. At uh kubecon this week, teams, large and small have this as a topmost concern and for cloud native applications. They really demand more than just the image, and so that's something that we think shipwright can provide.

A

Artifacts, like image scans image, signatures software bill of materials, provenance attestations all are things that you need to build modern software for the cloud, and we really think shipwrite should be able to rise up and meet these demands.

A

The other thing that we decided is that we will continue to run on cloud native, Cloud native infrastructure powered by kubernetes and techton.

A

We can go further, though, and start plugging ship right into the enormous Cloud native ecosystem, and if you haven't taken a look at it, if you look at the cncf landscape, it is something that would probably blow up the entire screen here.

A

um Some of the things we've we've talked about is integrating with CD events, which was probably mentioned a little earlier, Argo CD through things like Argo, workflows and much much more. We are just getting started with this effort through the triggers and image sub projects.

A

Over these past two years, though, uh we've found ourselves in shipwright coalescing around three core values: Simplicity flexibility and security.

A

So for simple Simplicity for us means that we provide an extreme experience that is intuitive and consistent.

A

It also means that we shouldn't be afraid to take an opinionated stance on common tasks or features that we want to add to the project we discovered during the beta API, where some of our apis weren't exactly intuitive or consistent and we'd identified changes to fix those problem areas. One of them is cleaning up how developers Define their source code. We initially had a feature that allowed you to Define multiple sources, and that proved to be problematic, and so we are only going to have a single Source per build.

A

We will also continue to maintain our opinionated steps to actually obtain that source code from get flexibility means that we provide space for teams to bend ship right to fit their needs, and this really starts with the build strategy model itself which we're keeping at the core of the API.

A

We then continue down this path with the parameters extension which lets you have customization between the build strategy and the build execution.

A

So during the API Workshop, we also uh made sure that our apis would be tool agnostic so that we can really help the grow. The ecosystem of build tools for a lot of us when we start building container image. The first thing you're thinking of is Docker, but there's a lot more out there, things that can do darker files, like Conoco, builda, Cloud native, build packs plus- and this is something that's uh really something I like to see- is the emergence of language, specific tools like jib, Co and I.

A

Think there's one for net that I think I saw recently came out all these things that know what language they're building and are able to build container images with the least amount of privilege as possible.

A

A

uh Yes, I can go, go back to that uh a little later, um but so, in order to help grow the ecosystem of these tools. We really need to make sure that in shipwright we keep the API agnostic to a tool.

A

uh What we found is that there are a few fields that we have in our initial API that were tool specific or might have only been used by a few tools but weren't Universal, so those unfortunately, are going to have to be dropped uh and, lastly, is their focus on security, which, for US, starts with a transparent pod security model that comes in the build strategy. Api.

A

In order to run a build strategy, you've got to declare your pod security context. uh This means you're going to expose if you need special permissions and what we'd like to see is an evolution away from tooling that needs privileged or even root containers, because both of these on kubernetes are known to be potential security risks.

A

uh So, as a community, we've also started with other tools to make the security of the built images from shipwright more transparent, such as trivi, and we hope to continue these efforts with emerging tools in the future, so starting in version 0.12, which we hope to have released in the coming weeks. Shipwright is going to introduce the beta API and we'll begin phasing out the current Alpha API.

A

We encourage current and future users of shipwrite to provide feedback, as we start rolling this new API out and if you'd like to learn more, uh you can uh we'd love for you to join our community. You can find our documentation and latest news at shipwright.io. We have the mailing list for shipwright Dev. We are also on kubernetes slack in the shipwright channel, uh and you can also find out more about us and contribute directly to GitHub through all the repos that we have. uh The central one is the community repo.

A

That's where we post our community meetings. We have them every Monday at 9am, Eastern Time on Zoom, uh so with that and on behalf of the shipwright community I. Thank you for attending this talk attending CD, Summit uh and I. Think we'll probably have time for questions.

A

A

uh We currently do not have any plans for integrating with Rico, um but that is something that we would be happy to talk to you about. Yes,.

A

Fault, so for those who don't know what vault is I, think you're assuming I'm you're talking about hashing Corp yeah, so uh Vault Works directly with kubernetes, where you can have your secrets securely stored off the cluster and then Vault kind of brings them in uh shipwright. uh Under the hood were using kubernetes and tecton. You are allowed to use, seek kubernetes Secrets inside of a shipwright, build as a volume, and you can also use it as a source for like environment variables.

A

So that's kind of built into the platform that you don't even need to tell shipwright about hashicorp Vault and it will just work.

A

Any other questions.

A

Foreign, thank you.