Zalandos Open Source Infrastructure on AWS with Docker - PowerPoint PPT Presentation

Zalando’s Open Source Infrastructure on AWS with Docker bernd.herding@zalando.de GOTO Con Berlin 2015, 2015-12-04 @01k

One of Europe’s largest online Fashion Retailers 15 countries 3 fulfillment centers 17+ million active customers 2.2+ billion € revenue 2014 135+ million visits per month 10.000+ employees in DE

A BRIEF HISTORY ON ZALANDO TECHNOLOGY

Deployment; ancient deploy request servers Platform Platform Team

Deployment; recent 70+ Dev Teams deploy request servers request storage Platform Platform Team

Deployment; the Truth 70+ Dev Teams deploy request servers request storage Platform Platform Team

RADICAL AGILITY AUTONOMY MASTERY PURPOSE TRUST

Compliance Innovation

STUPS To Unleash Penguin Swarms

A Platform on Top of Amazon Web Services DOCKER SSH AUDIT FULL AWS DEPLOY ACCESS REPORTS ACCESS STUPS AWS

Isolated AWS Accounts & OAUTH 2.0 & Security Public Internet *.a.example.org LB Data Center *.b.example.org Team A ELB Team B ELB AWS

DEPLOYMENT

Immutable Stacks myapp.example.org 100% ELB myapp-v1 EC2 + EC2 + EC2 + Docker Docker Docker

Immutable Stacks myapp.example.org $ senza traffic myapp v2 10 90% 10% ELB myapp-v1 ELB myapp-v2 EC2 + EC2 + EC2 + EC2 + EC2 + Docker Docker Docker Docker Docker

Immutable Stacks myapp.example.org $ senza traffic myapp v2 100 0% 100% ELB myapp-v1 ELB myapp-v2 EC2 + EC2 + EC2 + EC2 + EC2 + Docker Docker Docker Docker Docker

Deployment with Senza Pier One docker push Senza CLI docker pull AWS Taupage

SENZA: DEFINITION YAML SenzaInfo : StackName : hello-world Parameters : - ImageVersion : Description : "Docker image version of Hello World." SenzaComponents : - Configuration : Type : Senza::StupsAutoConfiguration # auto-detect network setup - AppServer : # will create a launch configuration and ASG with scaling triggers Type : Senza::TaupageAutoScalingGroup InstanceType : t2.micro SecurityGroups : [app-hello-world] ElasticLoadBalancer : AppLoadBalancer TaupageConfig : runtime : Docker source : "stups/hello-world:{{Arguments.ImageVersion}}" ports : 8080: 8080

The STUPS.io Stack Immutable ✓ … Image Immutable AMI ✓ Docker Runtime Ubuntu ✓ ✓ Application Managed SSH access OpenJDK ✓ ✓ Zalando CA Audit Logging ✓ ✓ Isolated certificate Log Collection ✓ ✓ Docker Container Monitoring Metrics team scm-source ✓ ✓ KMS encrypted vars accounts ✓ Created by Reviewed security ✓ ✓ Taupage AMI senza additions through Cloud AWS EC2 Formation

LOGGING

REMOTE ACCESS

Remote SSH Access ● Mostly for Debugging ● Audit Logging ● più granting Access

MONITORING

ZMON - our monitoring Solution TODO: Screenshot

ZMON Appliance ZMON KairosDB Controller *.foo.example.org *.bar.example.org Team “Foo” Team “Bar” ELB ELB ZMON ZMON EC2 EC2 EC2 Instance EC2 Appliance Appliance Instance EC2 Instance EC2 Instance Instance Instance

SECURITY

DISTRIBUTION OF CREDENTIALS OVER S3 BUCKETS WEB UI rotate OAuth passwords Provider Mint Rotator save request passwords OAuth2 token AWS S3 read password Taupage

STUPS in a Nutshell ➊ Isolated AWS account per Team ➋ Deployment with Docker STUPS ➌ Managed SSH Access ➍ REST/OAuth 2.0 mandatory ➎ Traceability of changes

What you might find valuable ● Taupage AMI with Docker runtime ● Senza to manage Cloud Formation ● Pier One Docker Registry with S3 http://docs.stups.io/en/latest/user-guide/standalone-deployment.html

Questions? STUPS Homepage stups.io GitHub Repositories github.com/zalando-stups tech-stups-pr@zalando.de