SlideShare a Scribd company logo
Building Developer Pipelines
with PKS, Harbor, Claire, and Concourse
Merlin Glynn
Thomas Kraus
Cloud Native Apps Business Unit
• This presentation may contain product features that are currently under development.
• This overview of new technology represents no commitment from VMware to deliver these
features in any generally available product.
• Features are subject to change, and must not be included in contracts, purchase orders, or
sales agreements of any kind.
• Technical feasibility and market demand will affect final delivery.
• Pricing and packaging for any new technologies or features discussed or presented have not
been determined.
Disclaimer
2
Agenda
3
1 Context
2 PKS and its components
3 Developer Solution based on PKS
4 Demo !
4
Analytics Automation
SecurityOperations
MonitoringLogging
Physical Infrastructure
Container
Registry
vSphere vSAN
Kubernetes on BOSH (Kubo/CFCR)
NSX-T
BOSH
GCP
Service
Broker
masteretcd workermasteretcd worker
Pivotal Container Service (PKS)
PKS Control Plane
Agenda
5
1 Context
2 PKS and its components
3 Developer Solution based on PKS
4 Demo !
PKS
BOSH
K8S-1
Work
er
Worker
K8S-2
BOSH
Agent
BOSH
Agent
K8s-api
Team A
K8s-api
KUBO
BOSH
Release
(tgz)
DAY 2 Ops
- Auto/Manual Rebuild
- Auto/Manual Repair
- Manual Scale
- Patch & Upgrade
- Control & Audit OPS Events
NAMESPACE_1: TEAM A
NAMESPACE_2: TEAM B
Team C
Team B
NAMESPACE_1: DEFAULT
DAY 1 Ops
DEPLOY
OperateK8s+RunApps/Containers
UI
&
API
Worker
Application
Dev/Ops Owner
Application
Dev/Ops Owner
Application
Dev/Ops Owner
Work
er
MASTER
WorkerMASTER
ETCD
WorkerMASTER
ETCD
MASTER
MASTER
ETCD
Platform
Reliability Engineer
Self Service K8s
PKS Technical Overview
1.7 -> 1.8
1.7 -> 1.8
PKS Controller
6
Ops
Manager
(OVA)
7
Harbor – Enterprise Grade Private Registry
CONFIDENTIAL
Development
Team
Image
Registry
Clair Notary
Build Image Push Image
Scan Image
For CVEs
Sign Trusted
Image
Harbor
Project(s)
RBAC
UAA
AUTH
REPL
‘kubectl run’
Image PullImage Push
8CONFIDENTIAL
Harbor – Image Vulnerability Scanning Details (Clair)
CVE
Datasources
Clair
Harbor
Notifications
Postgres
Debian Sec Bug Tracker
Ubuntu CVE Tracker
Red Hat Security Data
Oracle Linux Sec Data
Alpine SecDB
NIST NVD
ubuntu:trusty
nginx:latest
layer1 03ac7b930e4b
layer2 fc4540b46019
layer3 225948c9a8b1
9
Harbor – Image Signing (Content Trust)
When Enabled Un-signed Images Can’t Be Pulled
CONFIDENTIAL
Agenda
10
1 Context
2 PKS and its components
3 Developer Solution based on PKS
4 Demo !
Dockerfile
Dev Host
(Laptop/VM)
Putting it all together
11
K8s Cluster
Worker
kubectl apply –f myapp.yml
Worker
POD POD
Developer
CONFIDENTIAL
$ docker build
$ docker tag
$ docker push
clair notary
PKS
scan sign
Agenda
12
1 Context
2 PKS and its components
3 Developer Solution based on PKS
4 Demo !
DEMO Recording
CONFIDENTIAL 13
Reference
CONFIDENTIAL 14
• Hugo – website framework template and instructions
• https://github.com/tkrausjr/my-conference
• Example Conference Go Application
• https://github.com/tkrausjr/go-http
• Concourse Pipeline
• https://github.com/virtmerlin/spring1-goapp-ci
• Kubernetes Resource Type for Concourse
• https://github.com/virtmerlin/concourse-kubernetes-resource
Lessons Learned / Enhancements
CONFIDENTIAL 15
• Enhance Security - Notary Image Signing right now has signing keys in the pipeline
for updating an existing image which has initially been signed and pushed.
• Create a Harbor and Notary Resource Type for Concourse instead of using clairctl
and Docker Cli to increase reusability.
• Consider using separate Docker Images for Build and Run and add in artifact
repository like Nexus or Artifactory to store build artifacts. Right now the same Base
Docker Image is used for both the Application Build and the Application run via
Kubernetes.
• Concourse or any other CI / Automation tool is almost required for a solutions like this
and removes the human element and creates a version controlled and tracked
location for everything from your Application and
@cloudnativeapps
#vmwcna
#vmwpks
vmware.github.io
Thank You!
VMware Pivotal Container Services (PKS)
blogs.vmware.com/cloudnative
16
BACKUP SLIDES
CONFIDENTIAL 17
• BACKUP SLIDES
18
Need Harbor screenshot
• Authentication & Authorization
• AD/LDAP integration
• Security vulnerability scanning
(Clair)
• content trust - image signing
• policy based image replication
• audit and logs
• Restful API
• open-source under Apache 2
license
Harbor – Enterprise Grade Private Registry (WIP)
CONFIDENTIAL
19CONFIDENTIAL
Harbor – Image Vulnerability Scanning Details (Clair)

More Related Content

What's hot (20)

PDF
Automating CICD Pipeline with GitLab and Docker Containers for Java Applications
Jelastic Multi-Cloud PaaS
 
PDF
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
kanedafromparis
 
PDF
Multi-cloud Kubernetes BCDR with Velero
Kublr
 
PDF
Red Hat OpenShift on Bare Metal and Containerized Storage
Greg Hoelzer
 
PDF
An Architectural Deep Dive With Kubernetes And Containers Powerpoint Presenta...
SlideTeam
 
PDF
Developing Microservices Directly in AKS/Kubernetes
Chakradhar Rao Jonagam
 
PDF
Kubecon US 2019: Kubernetes Multitenancy WG Deep Dive
Sanjeev Rampal
 
PDF
Open shift 4 infra deep dive
Winton Winton
 
PPTX
12 Factor App
Erkan Erol
 
PDF
DCEU 18: Docker Container Networking
Docker, Inc.
 
PDF
PCF: Platform for a New Era - Kubernetes for the Enterprise - London
VMware Tanzu
 
PPTX
Introduction to openshift
MamathaBusi
 
PDF
Openstack days sv building highly available services using kubernetes (preso)
Allan Naim
 
PPTX
DevOps Best Practices with Openshift - DevOpsFusion 2020
Andreas Landerer
 
PPTX
Delivering Cloud Native Batch Solutions - Dodd Pfeffer
VMware Tanzu
 
PDF
DevSecOps: Bringing security to the DevOps pipeline
Aarno Aukia
 
PPTX
Application Modernization with PKS / Kubernetes
Paul Czarkowski
 
PPTX
Kubernetes day 2 Operations
Paul Czarkowski
 
PDF
Kubernetes: one cluster or many
cornelia davis
 
PDF
Red hat cloud platforms
Giovanni Galloro
 
Automating CICD Pipeline with GitLab and Docker Containers for Java Applications
Jelastic Multi-Cloud PaaS
 
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
kanedafromparis
 
Multi-cloud Kubernetes BCDR with Velero
Kublr
 
Red Hat OpenShift on Bare Metal and Containerized Storage
Greg Hoelzer
 
An Architectural Deep Dive With Kubernetes And Containers Powerpoint Presenta...
SlideTeam
 
Developing Microservices Directly in AKS/Kubernetes
Chakradhar Rao Jonagam
 
Kubecon US 2019: Kubernetes Multitenancy WG Deep Dive
Sanjeev Rampal
 
Open shift 4 infra deep dive
Winton Winton
 
12 Factor App
Erkan Erol
 
DCEU 18: Docker Container Networking
Docker, Inc.
 
PCF: Platform for a New Era - Kubernetes for the Enterprise - London
VMware Tanzu
 
Introduction to openshift
MamathaBusi
 
Openstack days sv building highly available services using kubernetes (preso)
Allan Naim
 
DevOps Best Practices with Openshift - DevOpsFusion 2020
Andreas Landerer
 
Delivering Cloud Native Batch Solutions - Dodd Pfeffer
VMware Tanzu
 
DevSecOps: Bringing security to the DevOps pipeline
Aarno Aukia
 
Application Modernization with PKS / Kubernetes
Paul Czarkowski
 
Kubernetes day 2 Operations
Paul Czarkowski
 
Kubernetes: one cluster or many
cornelia davis
 
Red hat cloud platforms
Giovanni Galloro
 

Similar to Building Developer Pipelines with PKS, Harbor, Clair, and Concourse (20)

PDF
The App Developer's Kubernetes Toolbox
Nebulaworks
 
PDF
Kubermatic CNCF Webinar - start.kubermatic.pdf
LibbySchulze
 
PDF
Kubermatic.pdf
LibbySchulze
 
PPTX
IBM MQ in containers MQTC 2017
Robert Parker
 
PDF
給 RD 的 Kubernetes 初體驗
William Yeh
 
PDF
Kubernetes extensibility
Docker, Inc.
 
PDF
Hybrid and Multi-Cloud Strategies for Kubernetes with GitOps
Sonja Schweigert
 
PDF
Hybrid and Multi-Cloud Strategies for Kubernetes with GitOps
Weaveworks
 
PDF
stackconf 2020 | The path to a Serverless-native era with Kubernetes by Paolo...
NETWAYS
 
PDF
The path to a serverless-native era with Kubernetes
sparkfabrik
 
PDF
VMworld Europe 2014: A DevOps Story - Unlocking the Power of Docker with the ...
VMworld
 
PPTX
CI/CD Development in Kubernetes - Skaffold
Suman Chakraborty
 
PDF
Effective Building your Platform with Kubernetes == Keep it Simple
Wojciech Barczyński
 
PDF
Kubernetes in kubernetes 搭建高可用環境
inwin stack
 
PPTX
Virtual Flink Forward 2020: Integrate Flink with Kubernetes natively - Yang Wang
Flink Forward
 
PPTX
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
Robert van Mölken
 
PPTX
01 - VMUGIT - Lecce 2018 - Fabio Rapposelli, VMware
VMUG IT
 
PDF
OSO Confluent GitOps Demo
Sion Smith
 
PPTX
Demystifying Application Connectivity with Kubernetes in the Docker Platform
Nicola Kabar
 
PDF
CI/CD Across Multiple Environments
Karl Isenberg
 
The App Developer's Kubernetes Toolbox
Nebulaworks
 
Kubermatic CNCF Webinar - start.kubermatic.pdf
LibbySchulze
 
Kubermatic.pdf
LibbySchulze
 
IBM MQ in containers MQTC 2017
Robert Parker
 
給 RD 的 Kubernetes 初體驗
William Yeh
 
Kubernetes extensibility
Docker, Inc.
 
Hybrid and Multi-Cloud Strategies for Kubernetes with GitOps
Sonja Schweigert
 
Hybrid and Multi-Cloud Strategies for Kubernetes with GitOps
Weaveworks
 
stackconf 2020 | The path to a Serverless-native era with Kubernetes by Paolo...
NETWAYS
 
The path to a serverless-native era with Kubernetes
sparkfabrik
 
VMworld Europe 2014: A DevOps Story - Unlocking the Power of Docker with the ...
VMworld
 
CI/CD Development in Kubernetes - Skaffold
Suman Chakraborty
 
Effective Building your Platform with Kubernetes == Keep it Simple
Wojciech Barczyński
 
Kubernetes in kubernetes 搭建高可用環境
inwin stack
 
Virtual Flink Forward 2020: Integrate Flink with Kubernetes natively - Yang Wang
Flink Forward
 
Hitchhiker's guide to Cloud-Native Build Pipelines and Infrastructure as Code
Robert van Mölken
 
01 - VMUGIT - Lecce 2018 - Fabio Rapposelli, VMware
VMUG IT
 
OSO Confluent GitOps Demo
Sion Smith
 
Demystifying Application Connectivity with Kubernetes in the Docker Platform
Nicola Kabar
 
CI/CD Across Multiple Environments
Karl Isenberg
 
Ad

More from VMware Tanzu (20)

PDF
Spring into AI presented by Dan Vega 5/14
VMware Tanzu
 
PDF
What AI Means For Your Product Strategy And What To Do About It
VMware Tanzu
 
PDF
Make the Right Thing the Obvious Thing at Cardinal Health 2023
VMware Tanzu
 
PPTX
Enhancing DevEx and Simplifying Operations at Scale
VMware Tanzu
 
PDF
Spring Update | July 2023
VMware Tanzu
 
PPTX
Platforms, Platform Engineering, & Platform as a Product
VMware Tanzu
 
PPTX
Building Cloud Ready Apps
VMware Tanzu
 
PDF
Spring Boot 3 And Beyond
VMware Tanzu
 
PDF
Spring Cloud Gateway - SpringOne Tour 2023 Charles Schwab.pdf
VMware Tanzu
 
PDF
Simplify and Scale Enterprise Apps in the Cloud | Boston 2023
VMware Tanzu
 
PDF
Simplify and Scale Enterprise Apps in the Cloud | Seattle 2023
VMware Tanzu
 
PPTX
tanzu_developer_connect.pptx
VMware Tanzu
 
PDF
Tanzu Virtual Developer Connect Workshop - French
VMware Tanzu
 
PDF
Tanzu Developer Connect Workshop - English
VMware Tanzu
 
PDF
Virtual Developer Connect Workshop - English
VMware Tanzu
 
PDF
Tanzu Developer Connect - French
VMware Tanzu
 
PDF
Simplify and Scale Enterprise Apps in the Cloud | Dallas 2023
VMware Tanzu
 
PDF
SpringOne Tour: Deliver 15-Factor Applications on Kubernetes with Spring Boot
VMware Tanzu
 
PDF
SpringOne Tour: The Influential Software Engineer
VMware Tanzu
 
PDF
SpringOne Tour: Domain-Driven Design: Theory vs Practice
VMware Tanzu
 
Spring into AI presented by Dan Vega 5/14
VMware Tanzu
 
What AI Means For Your Product Strategy And What To Do About It
VMware Tanzu
 
Make the Right Thing the Obvious Thing at Cardinal Health 2023
VMware Tanzu
 
Enhancing DevEx and Simplifying Operations at Scale
VMware Tanzu
 
Spring Update | July 2023
VMware Tanzu
 
Platforms, Platform Engineering, & Platform as a Product
VMware Tanzu
 
Building Cloud Ready Apps
VMware Tanzu
 
Spring Boot 3 And Beyond
VMware Tanzu
 
Spring Cloud Gateway - SpringOne Tour 2023 Charles Schwab.pdf
VMware Tanzu
 
Simplify and Scale Enterprise Apps in the Cloud | Boston 2023
VMware Tanzu
 
Simplify and Scale Enterprise Apps in the Cloud | Seattle 2023
VMware Tanzu
 
tanzu_developer_connect.pptx
VMware Tanzu
 
Tanzu Virtual Developer Connect Workshop - French
VMware Tanzu
 
Tanzu Developer Connect Workshop - English
VMware Tanzu
 
Virtual Developer Connect Workshop - English
VMware Tanzu
 
Tanzu Developer Connect - French
VMware Tanzu
 
Simplify and Scale Enterprise Apps in the Cloud | Dallas 2023
VMware Tanzu
 
SpringOne Tour: Deliver 15-Factor Applications on Kubernetes with Spring Boot
VMware Tanzu
 
SpringOne Tour: The Influential Software Engineer
VMware Tanzu
 
SpringOne Tour: Domain-Driven Design: Theory vs Practice
VMware Tanzu
 
Ad

Recently uploaded (20)

PPTX
From Sci-Fi to Reality: Exploring AI Evolution
Svetlana Meissner
 
PPTX
Q2 FY26 Tableau User Group Leader Quarterly Call
lward7
 
PDF
Blockchain Transactions Explained For Everyone
CIFDAQ
 
PDF
NewMind AI - Journal 100 Insights After The 100th Issue
NewMind AI
 
PDF
DevBcn - Building 10x Organizations Using Modern Productivity Metrics
Justin Reock
 
PDF
Bitcoin for Millennials podcast with Bram, Power Laws of Bitcoin
Stephen Perrenod
 
PDF
The Rise of AI and IoT in Mobile App Tech.pdf
IMG Global Infotech
 
PDF
"AI Transformation: Directions and Challenges", Pavlo Shaternik
Fwdays
 
PDF
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
PDF
IoT-Powered Industrial Transformation – Smart Manufacturing to Connected Heal...
Rejig Digital
 
PDF
Agentic AI lifecycle for Enterprise Hyper-Automation
Debmalya Biswas
 
PPTX
WooCommerce Workshop: Bring Your Laptop
Laura Hartwig
 
PDF
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
PDF
CIFDAQ Market Wrap for the week of 4th July 2025
CIFDAQ
 
PDF
July Patch Tuesday
Ivanti
 
PDF
Fl Studio 24.2.2 Build 4597 Crack for Windows Free Download 2025
faizk77g
 
PDF
New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
PDF
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
PPTX
OpenID AuthZEN - Analyst Briefing July 2025
David Brossard
 
PDF
CIFDAQ Weekly Market Wrap for 11th July 2025
CIFDAQ
 
From Sci-Fi to Reality: Exploring AI Evolution
Svetlana Meissner
 
Q2 FY26 Tableau User Group Leader Quarterly Call
lward7
 
Blockchain Transactions Explained For Everyone
CIFDAQ
 
NewMind AI - Journal 100 Insights After The 100th Issue
NewMind AI
 
DevBcn - Building 10x Organizations Using Modern Productivity Metrics
Justin Reock
 
Bitcoin for Millennials podcast with Bram, Power Laws of Bitcoin
Stephen Perrenod
 
The Rise of AI and IoT in Mobile App Tech.pdf
IMG Global Infotech
 
"AI Transformation: Directions and Challenges", Pavlo Shaternik
Fwdays
 
Empower Inclusion Through Accessible Java Applications
Ana-Maria Mihalceanu
 
IoT-Powered Industrial Transformation – Smart Manufacturing to Connected Heal...
Rejig Digital
 
Agentic AI lifecycle for Enterprise Hyper-Automation
Debmalya Biswas
 
WooCommerce Workshop: Bring Your Laptop
Laura Hartwig
 
Building Real-Time Digital Twins with IBM Maximo & ArcGIS Indoors
Safe Software
 
CIFDAQ Market Wrap for the week of 4th July 2025
CIFDAQ
 
July Patch Tuesday
Ivanti
 
Fl Studio 24.2.2 Build 4597 Crack for Windows Free Download 2025
faizk77g
 
New from BookNet Canada for 2025: BNC BiblioShare - Tech Forum 2025
BookNet Canada
 
How Startups Are Growing Faster with App Developers in Australia.pdf
India App Developer
 
OpenID AuthZEN - Analyst Briefing July 2025
David Brossard
 
CIFDAQ Weekly Market Wrap for 11th July 2025
CIFDAQ
 

Building Developer Pipelines with PKS, Harbor, Clair, and Concourse

  • 1. Building Developer Pipelines with PKS, Harbor, Claire, and Concourse Merlin Glynn Thomas Kraus Cloud Native Apps Business Unit
  • 2. • This presentation may contain product features that are currently under development. • This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. • Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. • Technical feasibility and market demand will affect final delivery. • Pricing and packaging for any new technologies or features discussed or presented have not been determined. Disclaimer 2
  • 3. Agenda 3 1 Context 2 PKS and its components 3 Developer Solution based on PKS 4 Demo !
  • 4. 4 Analytics Automation SecurityOperations MonitoringLogging Physical Infrastructure Container Registry vSphere vSAN Kubernetes on BOSH (Kubo/CFCR) NSX-T BOSH GCP Service Broker masteretcd workermasteretcd worker Pivotal Container Service (PKS) PKS Control Plane
  • 5. Agenda 5 1 Context 2 PKS and its components 3 Developer Solution based on PKS 4 Demo !
  • 6. PKS BOSH K8S-1 Work er Worker K8S-2 BOSH Agent BOSH Agent K8s-api Team A K8s-api KUBO BOSH Release (tgz) DAY 2 Ops - Auto/Manual Rebuild - Auto/Manual Repair - Manual Scale - Patch & Upgrade - Control & Audit OPS Events NAMESPACE_1: TEAM A NAMESPACE_2: TEAM B Team C Team B NAMESPACE_1: DEFAULT DAY 1 Ops DEPLOY OperateK8s+RunApps/Containers UI & API Worker Application Dev/Ops Owner Application Dev/Ops Owner Application Dev/Ops Owner Work er MASTER WorkerMASTER ETCD WorkerMASTER ETCD MASTER MASTER ETCD Platform Reliability Engineer Self Service K8s PKS Technical Overview 1.7 -> 1.8 1.7 -> 1.8 PKS Controller 6 Ops Manager (OVA)
  • 7. 7 Harbor – Enterprise Grade Private Registry CONFIDENTIAL Development Team Image Registry Clair Notary Build Image Push Image Scan Image For CVEs Sign Trusted Image Harbor Project(s) RBAC UAA AUTH REPL ‘kubectl run’ Image PullImage Push
  • 8. 8CONFIDENTIAL Harbor – Image Vulnerability Scanning Details (Clair) CVE Datasources Clair Harbor Notifications Postgres Debian Sec Bug Tracker Ubuntu CVE Tracker Red Hat Security Data Oracle Linux Sec Data Alpine SecDB NIST NVD ubuntu:trusty nginx:latest layer1 03ac7b930e4b layer2 fc4540b46019 layer3 225948c9a8b1
  • 9. 9 Harbor – Image Signing (Content Trust) When Enabled Un-signed Images Can’t Be Pulled CONFIDENTIAL
  • 10. Agenda 10 1 Context 2 PKS and its components 3 Developer Solution based on PKS 4 Demo !
  • 11. Dockerfile Dev Host (Laptop/VM) Putting it all together 11 K8s Cluster Worker kubectl apply –f myapp.yml Worker POD POD Developer CONFIDENTIAL $ docker build $ docker tag $ docker push clair notary PKS scan sign
  • 12. Agenda 12 1 Context 2 PKS and its components 3 Developer Solution based on PKS 4 Demo !
  • 14. Reference CONFIDENTIAL 14 • Hugo – website framework template and instructions • https://github.com/tkrausjr/my-conference • Example Conference Go Application • https://github.com/tkrausjr/go-http • Concourse Pipeline • https://github.com/virtmerlin/spring1-goapp-ci • Kubernetes Resource Type for Concourse • https://github.com/virtmerlin/concourse-kubernetes-resource
  • 15. Lessons Learned / Enhancements CONFIDENTIAL 15 • Enhance Security - Notary Image Signing right now has signing keys in the pipeline for updating an existing image which has initially been signed and pushed. • Create a Harbor and Notary Resource Type for Concourse instead of using clairctl and Docker Cli to increase reusability. • Consider using separate Docker Images for Build and Run and add in artifact repository like Nexus or Artifactory to store build artifacts. Right now the same Base Docker Image is used for both the Application Build and the Application run via Kubernetes. • Concourse or any other CI / Automation tool is almost required for a solutions like this and removes the human element and creates a version controlled and tracked location for everything from your Application and
  • 16. @cloudnativeapps #vmwcna #vmwpks vmware.github.io Thank You! VMware Pivotal Container Services (PKS) blogs.vmware.com/cloudnative 16
  • 18. 18 Need Harbor screenshot • Authentication & Authorization • AD/LDAP integration • Security vulnerability scanning (Clair) • content trust - image signing • policy based image replication • audit and logs • Restful API • open-source under Apache 2 license Harbor – Enterprise Grade Private Registry (WIP) CONFIDENTIAL
  • 19. 19CONFIDENTIAL Harbor – Image Vulnerability Scanning Details (Clair)

Editor's Notes

  • #5: Goals of PKS GOAL – Bring the release engineering, deployment, and lifecycle management qualities of BOSH to Kubernetes (K8s) clusters. Provide Day 1 and Day 2 Deployment, and Operations of Enterprise Grade Prod ready K8s Fully Supported Kubernetes Better Operational experience running K8s in Production especially Day 2(upgrades, HA, deployment, Scaling, self healing, life-cycle management) Deep Integration with NSX Hardened, Production-grade Runs on vSphere and VMC HA, Security, Multi-tenancy, Tools Bosh – Open Source software that delivers the capability to deploy complex distributed software (Day1) and keep it healthy (Day2) 1 – CPI Is how BOSH can deploy software across many clouds. PKS will support GCP & vSphere at GA 2 – BOSH Stemcells allow BOSH to abstract the OS image from the software being deployed. Stemcells for PKS 1.0 will be Ubuntu based VMDKs with a minimal OS and a BOSH agent 3 – BOSH Releases are collections of software and the metadata require to tell BOSH how to deploy that software. KUBO (Now Called CFCR) is literally a BOSH release to deploy Kubernetes 4 – BOSH Manifest is a set of YAML (which also uses another set of global YAML called a cloud-config, which is not pictured above). The Manifest will define which Stemcellls, releases, configuration options for the releases, and number of instances should be deployed. The manifest is then given to BOSH 5 – BOSH deployments is a given instantiation of a BOSH Deployment manifest PKS 3 Key components of PKS PKS Controller : The API that will allow self service KUBO : CFCR BOSH Releases BOSH HARBOR role-based access control w/ AD/LDAP integration Security vulnerability scanning (Clair) content trust - image signing policy based image replication audit and logs open-source under Apache 2 license
  • #7: This image is the first ‘introduction’ to to what PKS actually provides. At it heart PKS provides a self service API for development teams to consume container services, while still allowing the PRE (or Operator) the ability to control the environment for the enterprise. The animations will play thru to demonstrate key Day 1 & Day 2 capabilities; 3 Key components of PKS PKS Controller : The API that will allow self service KUBO : CFCR BOSH Releases BOSH *** Manual scale is intended to denote that BOSH scale ops of each K8s cluster is not automated. While various K8s mechanisms can be used to auto scale pod workloads, K8s itself is not auto scaled in 1.0
  • #8: I have had a lot of experience w/ large scale deployment of Container Orchestration systems like Mesos or Kubernetes and on of the often overlooked aspects of these projects is the Container Registry and the Enterprise Control over both Container Images and SW artifacts used in the build process. Harbor addresses this problem. Harbor – Open Source Docker v2 Registry fronted by a Reverse Proxy and automatically included Clair & Notary. *** Harbor provides Authentication & Authorization with AD/LDAP integration Security vulnerability scanning (Clair) and content trust - image signing policy based image replication audit and logs Restful API open-source under Apache 2 license
  • #9: Clair CVE scanning. Clair is a French word which translates to clear, bright, transparent. Clair API, Scanning Engine for scanning Docker Images Layer by Layer for CVE vulnerabilities. Returns a list of all files and packages in use by a particular LAYER and compares those files against the files in the CVE database that is stored in Postgres.  Clair API Allows for Creation, Put and Deletes of existing vulnerabilities BUT if you are using a FETCHER to obtain vulnerabilities (CVE) the vulnerabilities may be re-inserted when the next scheduled fetch occurs.
  • #10: Image signing Curated Images is kind of a big thing. Picture this - - Dev on laptop pulls git repo modifies a Dockerfile and copies binaries or packages (vulnerable) into the Docker container and builds an image. - Dev has permissions to push to your registry REPO or REPO is PUBLIC. - You now have vulnerable images in your registry which can be deployed 100's of times and exploited. UNLESS 1) You enable Notary (DTR) , so you cant pull or push without correctly signing the image first. 2) You si
  • #12: From the Developer point of view: I check my code in just like if I were pushing to PCF But in addition to application artifacts, the pipeline is going to build an image for me … In this visual we have a K8S cluster already running docker as the backend container engine, so our CI/CD pipeline will build a docker image for us and post it to a registry, in this case VMware Harbor Afterwhich, the pipeline will instantiate a K8S deployment to run our docker image based application as a set of pods in a replica set in case a worker note goes offline. The developer can than create a ‘service’ that gives worker nodes (or any external node) running the kube-proxy service the ability to route to where those pods are and access the apps/microservices running in them. Ingress routing from external is similar to that of CF with an external DNS map being required to forward requests to 1 or more worker nodes running kube-proxy One of the key differences is that Kubernetes isn’t opinionated on how the container image should be built, this give more flex to the developers but in some cases can make things more difficult for operators as we’ll see later on in the presentation Agility is why developers want it 
  • #19: Harbor Core Features avail to PKS deployed clusters *** Harbor will ship (as in will be packaged with and entitled with PKS)
  • #20: Clair CVE scanning