Red Hat OpenShift OpenShift Commons Briefings, 1 Apr 2016

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenShift Commons Briefing #33: Grupo Santander-Produban's Journey to OpenShift on OpenStack

Description

For our latest Common's Briefing we have invited Produban to tell us their OpenShift story.

Produban is a global technology company that specializes in the continuous design and operation of IT infrastructures. Cristian Roldan of Produban will be talking about how they built their globally distributed platform and Infrastructure-as-a-Service (IaaS) cloud using OpenShift on OpenStack.

For the latest information on OpenShift 3.1 and available briefings, please visit http://commons.openshift.org or subscribe to the OpenShift Blog (https://blog.openshift.com).

The OpenShift Commons exists to provide a platform for customers, partners, developers and other open source technology initiatives to collaborate, share and accelerate the pace of innovation and adoption of OpenShift globally. The OpenShift Commons represents a new open collaborative community model designed to facilitate communication and sharing of best practices, feedback and development across the many open source initiatives that integrate with OpenShift. The best way to get involved is to join the conversation today at http://commons.openshift.org

A

A

Well, hello, everybody and welcome again to this open ship common briefing. We're really pleased today to have the folks from Kota bond with us to talk about their journey from pause and to open two three on OpenStack. So there's lots of great information here, and some of you may have heard the main presenter Cristiano Ronaldo previously at Red Hat summits about their journey people connect, and that was an awesome presentation. So we're really thrilled to have him back.

A

You just talk and tell them how the journey has progressed, and so what we're gonna do is we're gonna kick them about. 30 minutes talk about their experiences, their lessons learned. We knew that they want to see in the next generation of open ship and then you can ask questions in the bathroom. Everybody is needed, except the speakers.

A

There are some folks from Korriban with us, but they may answer the question in the chat point at the end of the presentation. Will any unanswered questions you'll ask out loud and we made the questions you asked in chat because that isn't saved in recording so without further ado, Christian I'll. Let you take it away and indicated and let's get started hello.

B

My name is Christian. Well, the idea for this impressive presentation is to talk about how we have deployed a open, sheath version 3 on RedHat stock. So, let's start well, who is in this in this presentation? Who is cool? Well, my name is Christian. I am the pastor in manager here with me, is also power or violence or Rodriguez. Who is our a principal he passed engineer and also Eduardo Mingus from Red Hat? He is our senior architect. So let's go to the next slide. I would like to to talk about what is a program?

B

Well, what what what we do? Well, everyone is blowin company. We, the we belong to the Santander group problem is the ite. Conch is an IT company or / one for Santander group, so we are more or less 5000 professional around the world, and in this is line we can see that we are in Mexico United, States, Brazil, Argentina, Chile, aim for to our UK German, etc. So we are basically basically a global company and down to the southern. There are several groups: okay.

B

Well, if, in this slide, I would like to plane what is our main objective using using open shield? Well, we have to design deploy operate with duration debate. Pass solution is passed. We are using open ship Marshall 3. Also, we were using open seas version 2, but we migrated to version 3 because we love containers within that container. Is this technology.

B

Data reason why we are using offensive version version 3.

B

This this past solution and we use this solution for a for a financial public. So for our perspective, this the past is really really critical because we are running financial applications. So, for us, is a miss a big challenge in order to have a very stable past environment, for this kind of obligation is a really big big challenge, so.

B

Why this is service is small division. Why? Because we have banks in United, States, Brazil, Argentina, Chile Mexico for 12, so we have right now: five five regions open ship is currently deployed only in two regions in Spain, but for next month we will have the Mexico regions. We will have two to open sea for deployment in our regions. Each region has three availability phones. We can see in this slide the different regions on also we can see the availability zones. Okay,.

B

Well- and this is slide, the idea is that I would like to talk about our offensive architecture so and we we can see that we provide. We have say several layers.

B

The first layer is a load balancing. We use a tape proxy to find different kind of services. We have here the different kind of services. We balance a console, open ship console or open ship, the API we balance a internet internet applications, internet applications, we ballin' css3 services, okay, so we we have deploy the load, balancer logins balancer in three and three regions.

B

Here we can see, the our limit is on. One row. Element is on two and three and the three relative thumbs are deployed on OpenStack. The version that we use is Tula. Okay, the next layer is a open ship master. We have three open ship master for each mission.

B

Every open ship master is deployed in one availability zone.

B

Also in this this no we have the a TCP service, the next, the next layer. We we have three or more nodes for open ship in infrastructure. We use this kind of nodes for routers or how cool are and also we could use this kind of note for open chief internal, precious thing. Okay,.

B

We, the next layer we can see the offensive service. We basically are open ship note this. This. This node are deploying three availability zones.

B

We we have to group of nodes, one will be for product and there are group of knowledge for non production, non production services- okay, we have several note in each region and but we we with deploy new new knows every month. Okay, we cut because we are growing more or less twenty percent every anymore.

B

Well also, we have four pencil for persistent storage per system volumes we use set. We have set cluster for our per second service.

B

We use this persistent service for basically for my SQL Postgres Cassandra and also a we. We have activated the radish gateway for a obsessed or start.

B

In the monitoring for monitoring, passe infrastructure monitoring, we use Wiley Interscope.

B

We have developed a very big monitoring solution. We will monitor every offensive component every past component that we have deploying its permissions.

B

Probably in another presentation, I would like to show our monitoring solution.

B

For reporting we we have, we have platforms, we will Detroit the little form node, but at the moment we we are not using the platform solution for offensive, but the idea is to use this service soon for M.

B

B

Logging offensive infrastructure logging. We are using our last research, Havana log, stash solution. We use this this this local management cluster only for the infrastructure loss. We don't use this cluster for application loss.

B

Also, we have a special node called some host through this host. We deployed the opposite cluster.

B

Eduardo will talk about how we deploy the infrastructure of infrastructure using until pocket, and so it's it's very interesting, the dock for a vacation, money monitoring. We we have a special cluster.

B

We use a Syrian to scope while into scope for application. We have three three nodes or one not in each availability zones and also we deploy.

B

3M docker registry for a one for euro another for Mexico and the last one for passive, and also this architecture has special data rake, a big data cluster, and this big. We also, we only store, looks from applications. Okay, so we we developed a special, a console.

B

We are not using Cabana with the blocker, also that is integrated with the with the offensive security in order to get the lot from the different project. Okay, so basically, this is. Our architecture is a very complex solution for authentication.

B

At the moment we are used in Allah, but we are planning to marry two of two and we also use external services from record IDM, DNS, LTP, proxy satellite capsule, so in the next in the next presentation follow along so well, we will talk about networking. Is the SDN moshed class OpenStack? Okay, so follow? Thank.

C

You very much so we used a as we may have already mentioned, in Red, Hat OpenStack and in wash is the end and we deploy over on top of them. Okay, why?

C

Why do we use a OpenStack infrastructure as a service? Many of you may be very familiar with typical infrastructure as a service advantages. It is your engagement and so there's nothing new to say about that, but for because of sound special requirements of our applications at the moment they should be in house. So we be. This is one of the regions, they're reasons because of which we decided to have anyhow solution instead of using a public cloud and then moment, why did we use nauseous TN for the?

C

If you don't know, know our garage, it's an SDN, a made by cattle. That's a very complex and Buddhist. The end solution is the extensible software defined Network. If you know about up and ship, you may algorithm be also already getting familiar with that, because open she hasn't come is there we use it because it allows us a very easy network management easier than in the traditional world.

C

Of course, we, our networking environment, is completely insulated, so we can decide what comes in what goes out and nothing else, and we have- and we can about many IP addressing problems. They work the biggest advantage. We can define very fine-grain traffic ACS. It means our rules, we can say from A to B that there can be Communications, RTC, pull TCP port, 80 and 443 and nothing more a and we can restrict in a very specific way which traffic is allowed and its traffic is not a lot which.

D

C

Well known as micro segmentation and last but not least, we also use liberate that much hello, interconnecting OpenStack projects in a very flexible way, and we use that for to us a song Bacon's we need to and with in a more secure way going out and in again by our internet.

C

So there is. This is a very good solution and we are happy with it. We using mostly is the end I think restricted River. There are some aspects that can be improved in both OpenStack, as excuse me can both do much with the end and developing chief networking by using nuage I mean, as I have already said. Open chief use has its own as the end, so in we deeply appreciate from top of OpenStack and wash we are deploying deploying when Sdn the top of another is near. This is not a good idea from the.

C

Also, there are some things in the middle chief is the end that could be improved a lot, some very basic networking configurations while, on the other hand, wash louse work on this configuration. Because of that no much people antelope me, you know, being an was planning for OpenShift I, think there are some traces of that in da Vinci, for it involve adding, observe hey whatever a we have a boot that we have recently participated in a proof of concept of this planning, which is in a very early deployment stage.

C

C

So we we have participated in that program concept, and we see also that where they have already below that they they really offer their eventual interesting features like having one sub leopard Brian, as if you are not familiar with open ship as the end it allocates a never know and and when eating about allows isolating networking among brilliant.

C

In me, it means you can have network connections between robots on project a but not from project a or project B, but you can connect project C to break it a and then connect both and then both from prison. A can talk with lots of projects it, but not with permits of project B. But this is not if this is completely decoupled from saplings, because subnets depend on the nodes. That can be something difficult to think about the fewer. If you come from the traditional networking world, so they offer using one subnet.

C

The project exists more logical and allow someone to do some advanced other advanced networking configurations. It also the most important feature I think I should have put it first, is that it allows all the numerous advanced configuration allows to perform a bit for any configuration at the passive level, as it already does at the OpenStack level, and one important features we are very happy with is that it keeps offensive enterprise experience by little.

C

It means, if you use conceive first more users will see the same that if they were not using much unless you want to configure something else, and of course you will see something different, but not if you have out nothing, we would provides them provide them. Some feedback, like we were very interesting, for example, meaning in turn named entertaining the solution to allow users to have service related to networking configuration I.

C

As we have as one of the advantages of s, the ends at the OpenStack level is that you can you have cell service? No one from infrastructure has been to touch much so that you can configure your network. It will be interesting to have that kind of cell service that people see. You should have that kind of social service on their BOTS and so other other minor attachments they.

C

Of course this is D, never live alone in the stage they are waiting to load a another big bunch of new interesting features like, for example, every two about the door would open overlay. It means to have to as the end when you deploy open Shifa, we can wash on top of the stack with nourish, and so we look forward for news about that, because we found it very interesting.

C

Now a made our nation and tasted sweet.

D

Hi everyone- this is Eduardo and I- will try to be as fast as possible and I would like to talk about or automatization that we have been working on the past few months. Okay, as Pablo and Christian talk about the architecture, we run opposite question three on top of and OpenStack plus. Then what is the end? So we first started with the OpenShift version 3.0, which we deployed. You see in manual instance from Horus formulation, and we started to think about what we will do, and this was our Learning Path.

D

We faces a few issues and we we we we learn from from the way how to deploy open sea from the appropriate way. We need to know a lot of things or a particular environment, and we face its own restrictions speaking about and work in things that makes us to customize a lot. The open sea distillation for us also adding new notes, was pretty crucial because we started to grow pretty fast.

D

We started with a few notes and then we suddenly faced it that we were low on notes, but as we customize develop the the notes, configuration and a lot of things, we couldn't run the uncivil InStyler with having some note. So we started to working on. He templates and the pretty basic script will complain all the prerequisites like the doctor installation and all our customization. We call the screed a commonly set a set and we started and to work in the computation.

D

But the thing was that we don't we didn't, have any configuration.

A

D

So there were servers that were deployed with some configuration and other that were were created before that didn't have that configuration we face it, the there's, no flake server that we make a lot of things by hand like, for example, the last one was expanded, a /part file system, and we want to automate new deployments. So we started to think about how do we automate these things?

D

We thought about having some golden OSP image that we would clone for every node, or maybe heap and plugged in into scripts, or maybe X P XE for deployment a base instance. We also were talking thinking about configuration management without evil or puppet, and also the package lives, lifecycle, management, satellite or maybe, and finally, the winners was uncivil and you seen Saturday.

D

So we started to to build some puppet modules like the ones that are slight for bass, stuff, like last base packages, DNS ntp, a lot of things that are common for all the fans in or in our infrastructure. Also for things like manage doctor configuration, for example, they dhoka start plugging the proxy configuration. It seems like open files limits inside that and so for.

D

The O's opens, if notes and opens, if masters- and we do all these popping olives and thinking about parametrization, to be able to modify a lot of things with just simple parameter modification all that kind of things we use a high era using an added ripple again, so we are able to track a modification on the parameters and this higher and puppet modules are deployed in capsule, which means that we use satellite to manage all our current configuration and for ansible we created a few playbook, the first one, which was just to deploy our basic instant, which means create the OpenStack instance, even the instance floating IP, the correct volume attachment such-and-such.

D

We have an internal DNS which Christiaan talked about before, and we need to register the instance in the DNS register the instance also in satellite to be able to apply all the modules apply. The modules run, Jim update to be the same content view with no the instance and reboot. So with with this basic provision, playbook, we have a proper base server and it will be customized later.

D

According to we created also a custom label to add a new node to the open sea if cluster, which means the tasks that are on the slide like, for example, create no certificates copy there, no certificates from the master to the node and move the host to the proper satellite hospital and run a pipette, which means that all the packets, the puppet modules attached on the OpenStack on the OpenShift node, are run. All the docker configuration opens here and this kind of things. We also set a proper open sea flavors.

D

We set it as non scheduled and non-scheduled able and we pull the docker image this needed for our infrastructure. Finally, we good they note, and you know this really for to be scheduled, able and that's it so for the current procedure of installing an envision, we used a custom playbook to create all the all the OpenStack instance, not not just the open sea ones, but also, for example, the monitoring.

D

Once we start the open ship using the default, open sea and support labels, but we just installed the Masters and the etcd, because we are, we use our custom label tool to all the all the nodes and that's pretty much it. We have a few lists to do features with, for example, automate all the post, open seas, installation like the custom Asian of HTC's or the Drogheda of raptors and such hey.

D

We want to have one single button to be able to deploy what we joined with just a click or just a script call, and we also are working on how to make the opposite ecosystem and the motoring infrastructure.

D

The last exert the persistent balloons creation and that's it for my part. Thank you.

A

Alright, well, that was a lot actually. So. Thank you all very much. There have been a number of questions in the chat, room and and I'm wondering myself a little bit. You've done some custom work here and I'm wondering how much of it are you looking to push back into like open ship origin, the open source project under under the hood, and is it possible to do that or is the custom work that you're doing good, ansible and Puppet very particular to your configuration.

B

Any concrete idea: okay,.

A

Well, I'll keep pushing you on that same as al. Are you doing cleaning management, I'd love to see someone some of these lessons learned incorporated into death, so everybody else can use it as well. So one of the questions you go asked was you're using ansible and puppet, and could you do these things that you're talking about these customizations are just ansible a.

B

Great question: yes, yes, I, think that this possible is my my point of view. We are thinking all that we probably for the next generation tritium need is just one of them. I, don't know which one but I can say you done. The console is only easy to it. You use it it's too easy to learn, but we are thinking about that.

A

There is another question that just came up: do you run separate open ship systems for SDLC environments, dev, test integration, fraud.

C

No, we do not run a separate is appreciate systems, we have a separate production and non production. Applications are separated in the same openshift instance. They don't know to run in the same note, but we have the same cluster. We don't use one cluster netizen. Yes,.

B

That, here that we use the same cluster for all the different environments, but the pollutions we we have a special notes only for pollution.

D

A

Okay and I'm, going back in the chat a little. What what what it here for, SSL or Sdn are using wild-card search or installing one for application. We.

B

Are using both we have a default wide can certificate, but if the application wants to use its own, its own certificate is also possible. Yes and.

A

There was there are a few questions about. What are you using for your docker registries? Are you exposing the one that comes with openshift? Are you standing up something external like the factory or nexus? We.

B

Are trying to use a core OS and the precious thing.

A

At the moment, you're using yes.

B

We are using a pencils in the porosity, but soon we will deploy the core OS. The cars they're.

A

Very interesting how you you managed to use some of the best. You know different best practices from different different off offerings. It's really a nice overview of everything. There's another question in here: are you using LDAP to authenticate users into OpenShift or for users of applications hosted on OpenShift.

C

We used a lot for effective users. We would use in each application is a responsibility of users which are the developers, and we have nothing to say.

A

Let's see, are there any other questions out there answered most of the ones that have come in one here. If you have to get in the top, though very good there's any question: how do you authorize users but opens what's the.

B

Question but we are used in Allah, we use the authentication, an Alsatian modules that opens it provide the.

D

Thing is we producers? They need to be don't to a proper LDAP group to be able to login Papaji.

D

So if any user from problem wants to be wants to use open ship, they need to be added, and that particular group.

B

Yes, we have directed solution for a ALM and which are an onboarding procedure for each new user. There is a morally the solution to create the user in a lot also to add that user to a specific allah group for opposite.

A

So I'll ask you guys what what are the new features that you're looking forward to in the next in the coming releases of open ship o.

B

Excellent wisdom, the young, excellent question, performance, performance, performance and performance.

B

Yes, we would like to do some vertical scaling, so we are waiting for version for a next version: 3.2 that will use fermented version, 1, 2 3 and the opening it that would be I, think 110 watts per node. So for us the most important feature is performance and vertical scaling.

C

In fact that we have a weekend did we could do a beefy end with many pots which VM, but we cannot do it not because of an infrastructure limit, but because of an oven-safe limitation.

C

It does not support more than some quantity of, but regardless of how big your VMs and we and the next version is going to fix that and that's what we are looking for. All.

A

Right, well, we're all looking forward to the release party for the next one too, so that coming soon the and we're hoping that, as it comes out the door, you can one of the first ones to do some testing and review and feedback on that as well and I know you guys have been involved prior to the release.

A

So thank you very much for all of your efforts on working with us on the leadership project and also for coming here today and talking with us about nerve reduction multi-region the deployment I learned a lot and I really wish. We get even in front of the entire OpenStack community and Austin's in Islam, and see what I can do. They figure out how to get you guys with Texas, and hopefully we can figure out how they get get more more open, staffers using an open ship as well.

A

It's about the third production conversation I've, had this peak above funny, open ship done OpenStack and its really really brilliant to see me working as well as the set stuff. So this is great stuff and people have questions for them. While you log in to the mailing list on a commons and ask I, will try and post this recording pretty quickly and I'll ask for them to send me who slides, if you want to take notes like that, have no catalyst for the mailing list as well.

A

Thanks again, everybody a nice evening, little bit errands thing and everybody. Thank you very much.

A

Take care guys.