1 of 11

Shift left fail fast�with�K8s IAC

​

​

​

by�Shankar Ramanathan

​

​

​

​

​

​

​

VONAGE CONFIDENTIAL

2 of 11

Who we are

VONAGE CONFIDENTIAL

3 of 11

​

​

​

​

​

Are up for a Lucky Trivia Game?

​

​

​

​

VONAGE CONFIDENTIAL

4 of 11

What’s new with NS in K8s

  • ipc/uts/net ns are shared by default.. ??�
  • pause containers?? �docker ps -a | grep -I pause�
  • What abt pid & use NS?? Can we share

​

��

  • Ephemerals are coming. WIST?.. Debugging elixir��kubectl debug -it <pod> --image=busybox �--share-processes --copy-to=debug-pod

VONAGE CONFIDENTIAL

5 of 11

Accomplishments

​

​

  • 39 atmos-git repos (env specific branches)
  • Provisioned 144 unique accounts
  • 1050 delivery pipelines (CI/CD)
  • 945 VPC’s
  • Pre-reqs and dependencies pushed and maintained across all aws accounts.
    • centralized logging
    • SSM
    • AWS Shield
    • Guard Duty
  • TGW Reduced routing complexity as each VPC has a single route to the in-region TGW

​

​

​

​

​

​

5

VONAGE CONFIDENTIAL

VONAGE CONFIDENTIAL

6 of 11

Tooling stack

VONAGE CONFIDENTIAL

7 of 11

IAC for Cluster Bootstrapping

  • Terragrunt Service repo which feeds the �parameter for bootstrapping�
  • Terraform module which builds the variable�map & creates App of App project for each�helm chart defined�
  • Bootstrap repo which host the Argo App proj�definition along with custom values�for each env/service�

VONAGE CONFIDENTIAL

8 of 11

Template Nightmare

Problem

Solution

  • Hard to assemble a complete picture of final manifest with tools kustomize(patch/overlays, Helm)
  • Easy to understand manifest is git
  • Follows Gitops principle of being declarative
  • Can work with pure yaml for transformation?
  • Essentially inplace transformation than out of place transformation
  • Transformation with a different approach i.e inplace.. no patches WYSIWYG
  • kpt represents Configuration as Data i.e. configuration as YAML or JSON objects with clients manipulating configuration
  • supports static analysis and validation & supports programmatic modification via functions
  • Supports other templating solution via functions
  • Follows Gitops principle of being declarative
  • Refactoring is easy with most common use case addressed via function

VONAGE CONFIDENTIAL

9 of 11

Tooling Best Practice

  • Actions/Pre-commit hooks.. Extensively used in our terraform modules & k8s repo
  • Datree Runtime Schema validator, Template scanner, CI tool (pre-commit/pull validation via actions)
  • Renovate for version management
  • Kyverno Policy Manager for your cluster. Use it with Policy Reporter tool
  • Argo for App & Cluster bootstrapping
  • Karpenter/NodeTermHandler.. Node consolidation(0.15)
  • K9s Swiss army knife of debugging

In-pipeline

  • Docker build X Cross platform image builder. You just need Qemu(true KVM), kernel > 4.9,
  • Jsonnet for complex schema which requires logic (🙅‍♂️variable/text manipulation)
  • Kubevious helps in identifying config issue with apps quickly & set policies

VONAGE CONFIDENTIAL

10 of 11

Cerebro Platform

10

Infrastructure

Platform

Toolkit

______________________

______________________

VONAGE CONFIDENTIAL

11 of 11

Focus on High-Leverage Activities

Leverage = Impact Produced� Time Invested

�• Focus on what generates the highest� return on investment for your time�

• Find ways to get an activity done more� quickly, or shift

​

• Time is your most limited asset. Identify� the habits that produce disproportionately

high impact for the time you invest.

​

VONAGE CONFIDENTIAL