up a Kubernetes Cluster Part 2: Fork the Sock Shop Repository Part 3: Setup CI and Connect a Container Registry Part 4: Let’s Get Started with GitOps Further Resources 11 14 21 23 integration tool kicks off unit tests that eventually build the Docker image that gets pushed to the container registry. With a typical CI/CD pipeline, Docker images are deployed using some sort of bash CONTINUOUS INTEGRATION CONTINUOUS DEPLOYMENT Write Code VCS Code Base Unit Tests Integ Tests Container Registry DEPLOY eBook 8 Security and the Typical CI/CD Pipeline How secure is the typical CI/CD

IstioCon 2021 IstioCon 2021 is the inaugural community conference for the industry's most popular service mesh. IstioCon is a community-led event, showcasing the lessons learned from running Istio in production London ● Have 2 cats @rytswd #IstioCon Briefly about UPSIDER ● Startup providing B2B payment service ● Uses Istio extensively in production ● Headquarter in Tokyo, Japan ● Remote team around the world components Handles Custom Resources Handles actual traffic Can be standalone or sidecar Other Container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd Istio Operator istio-operator

delivery. It allows the teams that wrote, delivered, and supported the software to work together in service of that goal. DevOps isn’t necessarily a department, but rather a culture in your organization. Kubernetes [1.5] container platform, in particular, has fostered a whole new way of thinking about application deployment, because con- figuration files are used to declare the creation of container instances scribed in a 2021 blog post [1.7], is very interesting. Back in 2017, Weaveworks was a Software-as-a-Service (SaaS) company that hosted applications on their platform using Kubernetes as the infrastructure

it is today. Kubernetes brings much-needed container orchestration capabilities like: • Automated rollouts and rollbacks of deployments • Service discovery and load balancing capabilities − translates into a faster turnaround for new features and functionality for the customer. SELF-SERVICE With the existing CI/CD approach, the development team remains dependent on the operations team empowers teams to become more efficient and strategic. It enables development teams to be more self-service in nature as they would be less dependent on platform and operations teams to deploy and handle

system. THE GITOPS GUIDE TO BUILDING & MANAGING INTERNAL PLATFORMS 3 weave.works ▼ Self-service developer experience (DX) In the past, the only way a developer could get access to servers, data team delivers self-service APIs to developers. This team builds and maintains the platform that is consumed by development teams. The platform they build is a collection of self-service APIs, tools, services are internal customers of the platform team. In order to properly fulfill its role as an internal service provider, the platform team must take a strategic approach to resource management. “The challenge

Test Security Checks Release Deploy Stage Deploy Prod OpenShift Build Automate building container images using Kubernetes tools OpenShift Pipelines Kubernetes-native on-demand delivery pipelines OpenShift Builds 12 Automate building container images using Kubernetes tools GENERAL DISTRIBUTION 13 OpenShift Builds A Kubernative-native way to building container images on OpenShift which is portable with microservices and distributed teams in mind OPENSHIFT PIPELINES Containers Built for container apps and runs on Kubernetes Serverless Runs serverless with no CI/CD engine to manage and

project. The OpenStack ® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are GITOPS？ GitOps 是为云原生应用程序实施持续部署的一种声明方式。您可以使用 GitOps 创建可重复进程，用于在 多集群 Kubernetes 环境间管理 OpenShift Container Platform 集群和应用程序。GitOps 以快速的速度处 理和自动化复杂部署，节省部署和发行周期期间的时间。 GitOps 工作流通过开发、测试、临时和生产环境来推送应用程序。GitOps Red Hat OpenShift Container Platform 中，以及 Red Hat OpenShift Container Platform 的好处，以及 Red Hat Enterprise 支持、质量保证并专注于企业安全性。 注意 注意 因为 Red Hat OpenShift GitOps 的发行节奏与 OpenShift Container Platform 不同，所以 Red

工单系统量计费 虚拟机服务（vm-service） 虚机自服务及运营 容器云集群服务（container-service） 容器云集群服务 运营分析（operation-analytics） IT 容量管理、趋势分析、健康分析、优化 大屏（screen-display） 可视化大屏，实时展示云管平台各项关键数据 公有云网络管理（network-service） 公有云网络管理 杭州飞致云信息科技有限公司 云管平台是可扩展的，开发人员基于扩展模块的标准规范进行二次开 发，来满足企业的个性化定制需求。 以下扩展模块是 CloudExplorer 云管平台已经有的扩展模块： 模块名称 描述 对象存储服务（oss-service） 对象存储服务，支持常用私有云和公有云对象存储 漏洞扫描（scan） 绿盟漏洞扫描对接和漏洞分析 堡垒机（jumpserver） 用于 Jumpserver 堡垒机对接 AWS 费用管理（aws-billing-data） 费用管理（aws-billing-data） AWS 费用可视化分析、优化及分摊 物理机管理（physical-machine） 物理机自动发现及自助申请 负载均衡（loadbalancer-service） 负载均衡自服务及资源管理 数据库服务（paas-service） 数据库自服务、资源池管理及运营 2.1.4 模块镜像 杭州飞致云信息科技有限公司 7 2.2 组件间关系 CloudExplorer 的每个模块都

Applications OpenShift 4 - A Smarter Kubernetes Platform Automated, full-stack installation from the container host to application services Seamless Kubernetes deployment to any cloud or on-premises environment kustomization.yaml └── services └── service-a ├── base │ ├── config │ │ ├── 300-deployment.yaml │ │ ├── 310-service.yaml │ │ └── kustomization.yaml dev-deployment.yaml ├── dev-service.yaml └── kustomization.yaml ├── base │ ├── deployment.yaml │ ├── kustomization.yaml │ └── service.yaml └── overlays ├── development

Serverless … CaaS (Compute as a Service) … BaaS (Backend as a Service) Serverless ≈ CaaS + BaaS 用户运维 Serverless 介绍 Physical Machine vs. Virtaul Machine vs. Container vs. Serverless Hardware Virtualization Virtual Machine Hardware Virtualization O/S Containers Runtime Applications Functions Container Hardware Virtualization O/S Containers Runtime Applications Functions Serverless Hardware