DockerCon SF 2015: How to Build a Secure DevOps Environment for the Government
4 likes4,078 views
The document discusses how Booz Allen is helping the General Services Administration (GSA) Integrated Award Environment (IAE) transition to a secure DevOps environment using Docker. Specifically: - The IAE currently has 10 separate monolithic applications that are difficult to manage, so Booz Allen is helping them build a common service platform abstracted from business applications using Docker. - This will provide foundational capabilities like identity and access management for future IAE applications to be developed upon, replacing the current siloed environment. - Booz Allen is using tools like Docker, Jenkins, Chef, AWS, and Consul to automate the build and deployment of containers, improve security, and allow
DockerCon SF 2015: How to Build a Secure DevOps Environment for the Government
- 1. How to Build a Secure DevOps Environment for the Government @Normalfaults #Dockercon
- 2. • The current application development cycle is very long and cumbersome due to large monolithic application stacks • The new IAE Common Service Platform (CSP) focuses on building business specific applications that is abstracted from the platform • Booz Allen is using docker to drive abstraction between business specific applications and the platform • Specific numbers of repeated VMs in each current application • The solution eliminates configuration drift, and reduces attack surface area from developers Using Docker to Drive Transformation for General Services Administration (GSA) - Integrated Award Environment (IAE)
- 3. Navin Vembar Director of the GSA IAE
- 5. Current State – Monolithic, Stand alone application The current IAE environment has 10 Free-standing web-based systems Running in silos and different environments IAM RDMS API Analytic s App- Business Logic LB IAM RDMS API Report IAM RDMS API Search IAM RDMS API Analytic s Application 1 Application 2 Application 3 Application 4 BusinessLogic App- Business Logic LB App- Business Logic LB App- Business Logic LB Services
- 6. Target State – Business focused abstracted from the common platform The CSP will provide the foundational capability upon which the future IAE Core Applications will be developed IAM API Analytics Data Services Search/Reports Security Cloud Infrastructure Business Logic Platform Application 1 BusinessLogicServices Business Logic Application 2 Business Logic Application 3 Business Logic Application 4
- 7. Partners and Technologies Together driving innovation forward
- 8. Demo Flow Github Enterprise Jenkins Project Jellyfish/ Portal Chef AWS/EC2 RHEL 7.1 SWARM Interlock HAPROXY Container(s ) Consul Git Push Docker Trusted Registry Docker Trusted Registry
- 9. Benefits • Improved customer-centric services • Increased time-to-market • Reduced cost • Creates opportunities for new business • Target state of 2 week production sprints for platform and new applications • Decrease time for security review
- 10. Lessons Learned • Docker Bench CIS to ensure secure dockerhost baseline • Keep environment simple and build up with ingredients (Swarm, Machine, Compose) • Simplifying Security Process by focus on building small base images • Automated Certificate management for TLS is still a challenge (machine) • Rolling container updates on hosts
- 12. Next Steps • Image Governance through provenance • Inserting secrets in containers with Keywhiz - https:// square.github.io/keywhiz/ • Check out DIOGO MÓNICA and NATHAN MCCAULEY Dockercon talks • Container Networking
- 13. Links • GSA IAE http://gsa.github.io/openIAE/ • Interlock - https://github.com/ehazlett/ interlock • Conduit - https://github.com/ehazlett/ conduit • Consul.io - https://www.consul.io/ • Project Jellyfish – https:// projectjellyfish.org • Umbrella API – http://apiumbrella.io • Bot.io – Booz Allen Open Tech