GitLab PubSec & Regulated Industries, 25 Sep 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Commit Virtual 2020: Workload Portability AND Remaining Compliant using GitLab and Kubernetes

Description

Speaker: Frank Ford

Public cloud is great. We love public cloud. But sometimes, regulatory, company compliance, and legal restrictions necessitate an on-prem solution.

This session will explore ways to remain compliant with an on-prem solution while you work through your organization’s public cloud challenges. Using GitLab and Kubernetes allows for workload portability that will enable a simple transition once your organization gives the green light.

Get in touch with Sales: http://bit.ly/2IygR7z

A

You'd, probably rather be in the public cloud, but sometimes regulatory company compliance and legal restrictions necessitate an on-prem solution in achieving workload portability and remaining compliant using git lab and kubernetes frank ford of genworth will explore ways to remain compliant with an on-prem solution. While you work through your organization's public cloud challenges, he'll show you how to do that using gitlab and.

B

Kubernetes, this is get lab, commit virtual 2020, and this is achieving workload portability and remaining compliant using git lab and kubernetes. I am frank ford. I am a senior it architecture, design manager for genworth.

B

Personally, I'm passionate about continuous integration, continuous development, devsecops automation in general and and cloud a little bit about gymworf jimworth is a financial services company. Currently we sell long-term care insurance and mortgage insurance, but we also administer life insurance and annuity blocks of business. Our corporate headquarters is in richmond virginia and my home office is in lynchburg virginia just a little bit of a level set.

B

um I'm going to be talking about um public cloud and on-premises today and when I'm referring to public cloud, I'm talking about the the big three public cloud providers, so amazon, google and microsoft and on-prem I'm referring to on-premises. So these are this: is your actual data center, whether it's hardware that you own or something that you've contracted out to another company? um It's it's actual on your your on-premises data center.

B

um Now, when we're talking about public cloud, there's a number of advantages that uh public cloud brings to the table. So um you know public cloud being on demand, everything being very dynamic uh and elastic you provision just what you need uh and everything's very quick to provision um in terms of pricing. uh You know it's the page. You go pricing model, so you're only paying for the resources that you're actually uh using, which can present a cost savings uh to your company.

B

um You don't have to worry about, like maintenance of the hardware, because you're running on somebody else's computer, so the the main limitation here is um your particular budget. Your cost center. You know how much your wallet can actually handle.

B

There are a number of challenges, though uh you know, contracts present a fair number of challenges, so you more or less accept uh the general tnc's from the the big public cloud providers and then you can uh add baas uh to those to kind of help. um You know, structure the contract uh so that it, uh you know, add a little bit more protection for you.

B

um Pricing uh around pay as you go, can actually sometimes be a hindrance uh if your sourcing department likes to to budget blocks of dollars and they want to try and allocate those dollars to a particular budget year. um Data security and privacy you're you are responsible for um securing and making making sure that your data remains private inside the public cloud, also adhering to regulations. So things like for for hipaa gdpr uh things like that.

B

You need to make sure that your uh workloads that you want to run in public cloud uh adhere to those particular regulations, um access restrictions, making sure that only the right people have access to your public cloud infrastructure and understand that you're also potentially increasing your attack surface, especially if you have your public cloud infrastructure hooked into your corporate network.

B

um So understanding those entry points is is a big thing and also you know, understanding your organization structure and making sure that your organization is actually ready um to proceed to public cloud. um So you, you may actually know that your end goal is public cloud, but your organization may be moving through navigating some of these challenges um and and or you may just kind of be handcuffed by uh regulation and and some of that needs to be sorted through.

B

So how do you kind of maintain some of that momentum or, in some cases, generate momentum uh to get yourself started? While you wait for some of that stuff to actually be worked through, staying on, prem is a good way to either help build or maintain momentum for moving to public cloud.

B

If you under, if you know your target public cloud, the the big three public cloud providers offer on-prem solutions to help aid in this effort. So amazon outpost, google, anthose, microsoft, azure stack, however those cost money. um You may not necessarily have the budget for one of these or you may actually need to prove some value in some of these things. So kubernetes can actually help with that. There's a there's a couple and then there's a few more but but listed here.

B

Rancher rke allows you to very quickly spin up a kubernetes cluster in a using just docker containers and cube adm allows you to bootstrap your own kubernetes cluster. If you feel like taking on uh that challenge, uh this is an example of a of a of an rke cluster, yaml and kind of the process for getting that spun up. Like I said it runs, you can either run it on a traditional vm or bare metal that just has docker containers that just has docker installed it spins up in docker containers.

B

You can very easily spin up a a multi-node cluster and, like I said, the the configuration is contained in the cluster yaml file is over here to the side and really all you do is you you write this file, you run rke up, you wait a minute or two and within a little bit of time you have a fully functional single or multi-node kubernetes cluster.

B

So now we get to the fun part of workload portability. So we've talked about okay, we're we're building some workloads on-prem and we know we're eventually going to need to migrate them to uh public cloud um as you're starting to spin some of these workloads up. You need to think about workload portability.

B

um So you know you're, going through your you're building new workloads, you're, going through your monolith to microservices transition or you're migrating existing applications to application containers and you plan to orchestrate them using kubernetes workload. Portability needs to be at that forefront of what you're thinking about as you're as you're kind of designing and working through these efforts, gitlab can assist with some of this gitlab has the ability to target on-prem and cloud resources and gitlab also has some features such as crossplane.

B

That can help with your multi-cloud deployment and also portability issues as well. Just some caveats here and I'm going to read this verbatim, because it's very important is just because your application is containerized and orchestrated with kubernetes does not guarantee that the workload is portable. So some things you need to think about are uh you know: please continue to take workload portability into your design as you're, designing new workloads, but also think about external um external dependencies.

B

Does your application need an external load balancer? Does your application need uh persistence? Does your application need uh connectivity to your corporate network? um Also think about? Is your application, stateless or staple all of these things kind of help guide you when it comes to to being able to build portable workloads?

B

So now that we've talked about workload portability, we need to talk about compliance being able to to automate automate automate automate. um Automation is the the the best and and most key aspect to uh remaining compliant with um your your your ci cd processes, so um building a ci cd process, preferably in gitlab.

B

Allows you to make sure that you are following the same procedures at every step along the way you have a defined repeatable process that you know is going to deploy your your application.

B

The same way uh every time adopting infrastructure is code stored in version control, provides you with a a kind of a golden copy, running configuration that can be reviewed and audited at any point in time, and you can also leverage open source tools to apply policy to your your your environment, so taking advantage of open policy agent to apply policy uh at various levels of your environment, so um conf test uh allows integration of open policy agent policies into the cicd pipeline.

B

Gatekeeper is a kubernetes admission controller which can apply policy um at the kubernetes cluster level uh and then also uh open policy. Agent has plug-ins for numerous things, such as being able to apply policy to your infrastructure's code, uh as well as things like at the at the network level um monitoring your cluster, so um you know leveraging prometheus grafana for visualization of metrics and and and things like that, and also uh when you do get to public cloud um having a cloud security, posture management solution.

B

uh There's a number of them out there um kind of helps, keep you compliant uh kind of as you as you migrate to uh to public cloud. So conclusions, public cloud is great. Sometimes it doesn't necessarily make sense for everybody right off the bat, whether that's due to external regulation.

B

uh Some you know company policy or uh you know you actually need to show and free value of some of these things to uh to some folks. um You know using some open source tools. You can very easily spin up a kubernetes cluster on prem and, of course, utilizing gitlab and uh additional open source tooling. uh You can easily implement secure and compliant cicd pipelines, on-prem uh and those can then be migrated to uh any kubernetes cluster that you uh wish to migrate to.

B

So thank you and I have my uh my email and twitter there. uh I will warn you that my twitter is mainly auto racing and virginia tech football. So thanks.

B