A presentation at Montpellier JUG & DevOps Montpellier in in Montpellier, France by Horacio Gonzalez
Montpellier - 2020-12-18 Kubernetes for DevOps… and Devs Horacio Gonzalez @LostInBrittany Montpellier Tech Hub
Who are we? Introducing myself and introducing OVH OVHcloud Montpellier Tech Hub
Horacio Gonzalez @LostInBrittany Spaniard lost in Brittany, developer, dreamer and all-around geek Flutter Montpellier Tech Hub
OVHcloud: A Global Leader 250k Private cloud VMs running 1 Dedicated IaaS Europe 30 Datacenters Own 20Tbps Hosting capacity : 1.3M Physical Servers 360k Servers already deployed Montpellier Tech Hub Netwok with 35 PoPs
1.3M Customers in 138 Countries
OVHcloud: Our solutions Cloud Web Hosting Mobile Hosting Telecom VPS Containers ▪ Dedicated Server Domain names VoIP Public Cloud Compute ▪ Data Storage Email SMS/Fax Private Cloud ▪ Network and Database CDN Virtual desktop Serveur dédié Security Object Storage Web hosting Cloud HubiC Over theBox ▪ Licences Cloud Desktop Securities MS Office Hybrid Cloud Messaging MS solutions Montpellier Tech Hub
Orchestrating containers Like herding cats… but in hard mode! Montpellier Tech Hub
From bare metal to containers Another paradigm shift Montpellier Tech Hub
Containers are easy… For developers Montpellier Tech Hub
Less simple if you must operate them Like in a production context Montpellier Tech Hub
And what about microservices? Are you sure you want to operate them by hand? Montpellier Tech Hub
Taming microservices with Kubernetes Montpellier Tech Hub
Kubernetes Way more than a buzzword! Montpellier Tech Hub
Masters and nodes Montpellier Tech Hub
Some more details Montpellier Tech Hub
Desired State Management Montpellier Tech Hub
Extending Kubernetes Montpellier Tech Hub
Multi-environment made easy Dev, staging, prod, multi-cloud… Montpellier Tech Hub
Declarative infrastructure Multi-environment made easy Montpellier Tech Hub
Having identical, software defined envs Montpellier Tech Hub
I have deployed on Minikube, woah! A great fastlane into Kubernetes Montpellier Tech Hub
Running a full K8s in your laptop A great learning tool Montpellier Tech Hub
Your laptop isn’t a true cluster Don’t expect real performances Montpellier Tech Hub
Beyond the first deployment So I have deployed my distributed architecture on K8s, everything is good now, isn’t it? Montpellier Tech Hub
Minikube is only the beginning Montpellier Tech Hub
From Minikube to prod A journey not for the faint of heart Montpellier Tech Hub
Kubernetes can be wonderful For both developers and devops Montpellier Tech Hub
But it comes with a price… Montpellier Tech Hub
Describing some of those traps To ease and empower your path to production Montpellier Tech Hub
The truth is somewhere inside… Montpellier Tech Hub
The network is going to feel it… Montpellier Tech Hub
The storage dilemma Montpellier Tech Hub
The ETCD vulnerability Montpellier Tech Hub
Security Hardening your Kubernetes Montpellier Tech Hub
The security journey Montpellier Tech Hub
Kubernetes is insecure by design It’s a feature, not a bug. Up to K8s admin to secure it according to needs Montpellier Tech Hub
Not everybody has the same security needs Montpellier Tech Hub
Kubernetes allows to enforce security practices as needed Montpellier Tech Hub
Listing some good practices Montpellier Tech Hub
Close open access Close all by default, open only the needed ports Follow the least privileged principle Montpellier Tech Hub
Define and implement RBAC According to your needs Montpellier Tech Hub
Define and implement network policies Montpellier Tech Hub
Use RBAC and Network Policies to isolate your sensitive workload Montpellier Tech Hub
Always keep up to date Both Kubernetes and plugins Montpellier Tech Hub
And remember, even the best can get hacked Remain attentive, don’t get too confident Montpellier Tech Hub
Extensibility Enhance your Kubernetes Montpellier Tech Hub
Kubernetes is modular Let’s see how some of those plugins can help you Montpellier Tech Hub
Helm A package management for K8s Montpellier Tech Hub
Complex deployments Montpellier Tech Hub
Using static YAML files Montpellier Tech Hub
Complex deployments Montpellier Tech Hub
Istio A service mesh for Kubernetes… and much more! Montpellier Tech Hub
Istio: A service mesh but not only Montpellier Tech Hub
Service discovery Montpellier Tech Hub
Traffic control Montpellier Tech Hub
Encrypting internal communications Montpellier Tech Hub
Routing and load balancing Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
Rolling upgrades Montpellier Tech Hub
A/B testing Montpellier Tech Hub
Monitoring your cluster Montpellier Tech Hub
Velero Backing up your Kubernetes Montpellier Tech Hub
Kubernetes: Desired State Management Montpellier Tech Hub
YAML files allows to clone a cluster Montpellier Tech Hub
But what about the data? Montpellier Tech Hub
Velero Backup and migrate Kubernetes applications and their persistent volumes Montpellier Tech Hub
S3 based backup On any S3 protocol compatible store Montpellier Tech Hub
Backup all or part of a cluster Montpellier Tech Hub
Schedule backups Montpellier Tech Hub
Backups hooks Montpellier Tech Hub
Conclusion And one more thing… Montpellier Tech Hub
Kubernetes is powerful It can make Developers’ and DevOps’ lives easier Montpellier Tech Hub
But there is a price: operating it Lot of things to think about Montpellier Tech Hub
We have seen some of them Montpellier Tech Hub
One more thing… Who should do what? Montpellier Tech Hub
Different roles Each role asks for very different knowledge and skill sets Montpellier Tech Hub
Most companies don’t need to operate the clusters As they don’t build and rack their own servers! Montpellier Tech Hub
If you don’t need to build it, choose a certified managed solution You get the cluster, the operator get the problems Montpellier Tech Hub
Like our OVH Managed Kubernetes Made with 💗 by the Platform team Montpellier Tech Hub
Do you want to try? Send me an email to get some vouchers… horacio.gonzalez@corp.ovh.com Montpellier Tech Hub
Thank you for listening Montpellier Tech Hub
Montpellier - 2020-12-18 GraalVM & Quarkus Horacio Gonzalez @LostInBrittany Montpellier Tech Hub
GraalVM An alternative JVM with a twist Montpellier Tech Hub
What’s GraalVM? A standalone Java Development Kit to execute: ● JVM-based languages ● Dynamic languages ● LLVM-based languages Montpellier Tech Hub
What’s GraalVM? Montpellier Tech Hub
What’s GraalVM? Montpellier Tech Hub
GraalVM Features GraalVM lets you: ● Run your code faster and more efficiently ● Interoperate directly with most modern programming languages ● Embed languages with the GraalVM SDK ● Create compiled native images ● Use a single set of tools to monitor, debug, and profile all your code Montpellier Tech Hub
GraalVM base package The base installation includes: ● The JVM ● The GraalVM compiler ● The LLVM bitcode interpreter ● The JavaScript runtime Montpellier Tech Hub
Why GraalVM? For Java programs: ● Run Java faster ● Make Your Application Extensible ● Create a Native Image Montpellier Tech Hub
Why GraalVM? For JavaScript programs: ● Reuse Libraries from Java, R, or Python ● Run with Large Heaps ● Define Data Structures in C/C++ Montpellier Tech Hub
Why GraalVM? GraalVM native images reduce: ● Runtime memory footprint ● Startup time Montpellier Tech Hub
And how does it compile ? Dead code elimination Closed world assumption Montpellier Tech Hub
Adding some limitations… Montpellier Tech Hub
Quarkus Supersonic Subatomic Java Montpellier Tech Hub
What’s Quarkus? ● A Kubernetes Native Java stack ● Tailored for OpenJDK HotSpot and GraalVM ● Crafted from the best of breed Java libraries and standards Montpellier Tech Hub
Container first Montpellier Tech Hub
Unifies imperative and reactive Combine imperative code and the non-blocking reactive style Montpellier Tech Hub
By developers, for developers ● Unified configuration ● Zero config, live reload in the blink of an eye ● Streamlined code for the 80% common usages, flexible for the 20% ● No hassle native executable generation Montpellier Tech Hub
Leveraging the ecosystem Over fifty best-of-breed libraries wired on a standard backbone Montpellier Tech Hub
Thank you for listening Montpellier Tech Hub
Judging by the buzz it has created, this last year has been the year of Kubernetes. It is everywhere, and as usual with such popular subjects, there is a huge stash of content about it: tutorials, blog posts, talks by the dozen, everybody seems to be speaking about Kubernetes… So everything is good in All is well in the best of worlds, right?
Well, to be sincere, I wouldn’t say so… Most of those tutorial, posts and talks stop just after they have guided you to do the “Hello Kube”, when you have a handful of applications deployed on a local Minikube on your laptop. But that is not the end, it’s more of the true beginning of the path…
In this talk I’m going to speak about the gap between Minikube and a production-ready Kubernetes infrastructure, about the dozens of “small details” that become show stoppers the first time you try to deploy your production Kubernetes, about the usefulness of managed Kubernetes solutions, about vendor locking, about multicloud and Kubernetes federation. In brief, about what to do after you have deployed on your Minikube…
In the second part of the presentation, I will address a different public, the Montpellier JUG (Java User Group) attendees.
What does a Java developer can do in a world where containers and Kubernetes seems to have replaced traditional Java and JEE stacks? How can the JVM compete with the blazing fast and light containers from other stacks? Is Java doomed to become the next COBOL?
Fear no more, the Java community has well understood this brave new world, and solutions are available.
In this talk I will talk about GraalVM, a blazing fast, polyglot, lightweight, compiling to native JVM giving you the capacity to compile your Java applications to small native binaries easy and painless to deploy in containers and able to compete with any other Cloud Native stack.
And then I will talk of Quarkus, and how you can combine it with GraalVM to create powerful Java applications, in a modern way.
