Airship Making Lifecycle Management for Open Infrastructure Repeatable

Airship: Making Lifecycle Management for Open Infrastructure Repeatable and Predictable Rodolfo Pacheco | AT&T Alan Meadows | AT&T Seungkyu Ahn | SKTelecom 5/21/2018 3 © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

AGENDA WHAT IS AIRSHIP? 2 THE SUBPROJECTS AIRSHIP UNDERCLOU D HOW DOES IT WORK PROJECT ADOPTION © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

WHAT IS AIRSHIP? Security Containerizati on Quality We have chosen the name Airship for the nautically themed collection of interoperable opensource tools/services that provide for automated cloud provisioning and management by establishing an under cloud platform (UCP) leveraging Kubernetes. The focus of this project is the implementation of a declarative platform to introduce Open. Stack on Kubernetes (OOK), and the lifecycle management of the resulting cloud, with the scale, speed, resiliency, flexibility and operational predictability demanded of Network Clouds. 8 © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

WHY AIRSHIP? DECLARATIVE Security Containerizati on Quality To evolve how we deliver our cloud platform as well as manage the lifecycle of the software running there – including Open. Stack -- we created Airship. Sites are declared using YAML. This includes both hard assets such as network configuration and bare metal hosts as well as soft assets like helm charts, their overrides, and container images. You manage the document and Airship implements it. CONTAINERS AS THE NEW UNIT OF SOFTWARE DELIVERY Containers are the unit of software delivery for Airship. Everything is a container. This allows us to progress environments from development, to testing, and finally to production with confidence. ONE WORKFLOW FOR LIFE CYCLE MANAGEMENT We needed a system that was predictable with life cycle management at its core. This meant ensuring we had one workflow that handled both initial deployments as well as future site updates. In other words, there should be virtually nothing different when interacting with a new deployment or providing an an update to an existing site. FLEXIBLE FOR DIFFERENT ARCHITECTURES AND SOFTWARE Airship is delivering environments both very small and large with a wide range of configurations. We use Airship to manage our entire cloud platform, not just Open. Stack. 8 © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

Security THE OPEN SOURCE PROJECTS AIRSHIP LEVERAGES OR INTEGRATES WITH Containerizati on Open. Stack-Helm: Barbican: is a Open. Stack project to provide a collection of Helm charts that simply, resiliently, and flexibly deploy Open. Stack and related services on Kubernetes. Barbican is a REST API designed for the secure storage, provisioning and management of secrets. Kubernetes Helm: Quality * = Future Keystone: is a tool for managing Kubernetes charts. Charts are packages of pre-configured Kubernetes resources. Keystone provides authentication, authorization and service discovery mechanisms via HTTP primarily for use by projects in the Open. Stack family. Kubernetes (K 8 s): *Ironic: is a open-source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. Ironic consists of an API and plug-ins for managing and provisioning physical machines in a security-aware and fault-tolerant manner. *Mogan: 8 Mogan is an Open. Stack project which offers bare metals as first class resources to users, © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. supporting variety of bare metal provisioning

THE AIRSHIP SUB-PROJECTS Containerizati on Treasure Map: Divingbell: is the documentation project that outlines a reference architecture for automated cloud provisioning and management, leveraging the Airship interoperable opensource tools. is a lightweight solution for 1) Bare metal configuration management for a few very targeted use cases and 2) Bare metal package manager orchestration Shipyard: is the directed acyclic graph controller for Kubernetes and Open. Stack control plane life cycle management, and a component of the Undercloud Platform (UCP). Drydock: is a python REST orchestrator to translate a YAML host topology to a provisioned set of hosts and provide a set of postprovisioning instructions. 8 Security Quality Deckhand: is a storage service for YAML-based configuration documents, which are managed through version control and automatically validated. Deckhand provides users with a variety of different document types that describe complex configurations using the features listed below. © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

THE AIRSHIP SUB-PROJECTS (Continued) Containerizati on Armada: Promenade : is a tool for managing multiple Helm charts with dependencies by centralizing all configurations in a single Armada YAML and providing life-cycle hooks for all Helm releases. is a tool for bootstrapping a resilient Docker, and Kubernetes cluster and managing its lifecycle via Helm charts. Note: Armada is an enhancement to the helm client. Still using the helm tiller service, we deploy multiple charts with data-driven yamls. Pegleg: Berth: is a deliberately minimalist VM runner for Kubernetes. 8 Security Quality Pegleg is a document aggregator that provides early linting and validations via Deckhand for documents that can be consumed by Airship. © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

Security AIRSHIP - AN UNDERCLOUD PLATFORM (UCP) ENABLED NETWORK CLOUD Ranger Barbican Heat Cloud Platform Monitoring & Alerting Open. Stack-Helm (OSH) Ceph Calico Divingbe ll Drydock Shipyard Deckhan d OCI Compliant Container Runtime | Kubelet Host OS Baremetal 8 Promena de Berth Underclou d Platform (UCP) Runtime End to End CI/CD Logging Cinder Neutron Nova Horizon Glance Swift VNF SDN Controller Armada Helm Kubernetes Security & Operations Keystone ONAP Containerizati on Quality The blue highlights the Airship projects that facilitate the creation and life-cycle management of an undercloud platform that is used to enable a Open. Stack based Network Cloud with the scale, speed, flexibility and operational predictability this infrastructure must deliver. The green highlights the Open Source projects that Airship leverages/ integrates with to deploy the undercloud platform. © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

How do we use Airship| swift Nova compute horizon prometheus O S H Kubernetes OSH LOGGING MONITORING ALARMING AIRSHIP CNI CALICO – DNS - NTP SDS CEPH Fluentd Ingress IAM Hardware (Keystone) Chart mariadb lnfo Kibana Chart Shipyard Baremetal keystone Chart Elastic. Search Chart nova Deckhand Network Chart Fluentd horizon Chart Drydock Network Collector Chart cinder Chart Link Prometheus Chart memcached Armada Host Profile Chart etcd Chart Promenade Grafana Chart’s Chart swift Chart Kubernetes Diving. Bell Chart Kube Exporter glance Chart neutron Node SDS (Ceph) Chart rabbitmq Exporter Chart Nova Alert. Mgr CNI(Calico) Chart compute Chart Coredns Chart Openvswitch Chart ntpd Chart Libvirt Chart chart What do we mean by declarative IAM cinder grafana deckhand exporter ingress fluentd SWITCH FABRIC shipyard promenade divingbell calico node VF(s) calico VF(s) etcd ceph rbd NIC etcd k 8 s api File System / Partitions ceph mon Docker CORE Kubelet NUMA OS Host ntpd ceph osd k 8 s controller ceph rgw NIC k 8 s scheduler File System / Partitions CORE etcd alert mgr. armada drydock core dns rabbitmq neutron libvirt ceph mgr cephfs mariadb keystone nova K 8 s proxy kibana elasticsrch collector glance openvswitch memcached CORE VF(s) NIC

How do we use Airship| How do we bootstrap the cloud? Hardware IAM lnfo keystone (Keystone) nova Chart horizon Chart Elastic. Sear Chart Fluentd ch (Ceph) SDS Collector CNI(Calico) Chart Baremetal Chart iam Build Genesis. sh deckhand Diving bell drydock armada Calico Ge ne ra te genesis. sh Prepare Manifest Ceph osd shipyard Calico etcd K 8 s contrl Ceph rbd tiller K 8 s sched Ceph mon Retrieve images Hardware lnfo. IAM keystone (Keystone) nova Chart horizon Chart Elastic. Search Fluentd Chart Collector SDS (Ceph) Chart CNI(Calico) Baremetal Chart Kubelet armada Docker Hardware lnfo. IAM keystone (Keystone) nova Chart horizon Chart Elastic. Search Fluentd Chart Collector SDS (Ceph) Chart CNI(Calico) Baremetal Chart genesis. sh promen ade armada Hardware lnfo. IAM keystone (Keystone) nova Chart horizon Chart Elastic. Search Fluentd Chart Collector SDS (Ceph) Chart CNI(Calico) Baremetal Chart pegleg Kubernetes TE U EC X E Hardware lnfo. IAM keystone (Keystone) nova Chart horizon Chart Elastic. Search Fluentd Chart Collector SDS (Ceph) Chart CNI(Calico) Baremetal Chart genesis. sh Kubernetes Hardware lnfo. IAM keystone (Keystone) nova Chart horizon Chart Elastic. Search Fluentd Chart Collector SDS (Ceph) Chart CNI(Calico) Baremetal Chart Deliver Boostrap manifest K 8 s api armada genesis. sh Artifactory Jenkins Docker Kubelet Armada Apply genesis. sh Docker Kubelet OS Docker Host OS Press the button Host Cloud Harbour(**) Cloud Genesis Done – Airship available

How do we use Airship| How do we deploy a cloud? Hardware IAM lnfo keystone (Keystone) nova Deploy Chart horizon Chart Strategy Elastic. Sear Chart Fluentd ch (Ceph) SDS Collector CNI(Calico) Chart Baremetal Chart keystone Authenticate deckhand cinder promenade drydock armada. Calico Gather Manifest For Cloud Hardware IAM lnfo keystone (Keystone) nova Chart horizon Chart Elastic. Search Chart Fluentd Chart SDS (Ceph) Collector Chart CNI(Calico) Chart Baremetal Chart Kubernetes Artifactory OS Docker Kubelet Hardware IAM keystone lnfo (Keystone) nova Chart horizon Chart Elastic. Sear Fluentd Chart SDS ch (Ceph) Collector CNI(Calico) Chart Baremetal Chart Kubernetes Jenkins pegleg Press to deploy Hardw IAM keysto are nova (Keyst horizo ne Elastic lnfo Chart Fluent one) n SDS Chart Search d. CNI(Ca Chart Barem (Ceph) Chart lico) Collect etal Chart or Chart Kubernetes Docker Kubelet Trigger Deliver Deploy Manifest Action documents Hardw IAM keysto are nova (Keyst horizo ne Elastic lnfo Chart Fluent one) n SDS Chart Search d. CNI(Ca Chart Barem (Ceph) Chart lico) Collect etal Chart or Chart mariadb Calico etcd K 8 s api OS Docker Kubelet K 8 s api Kubernetes Docker Cloud Harbour (**) Fluentd collect Calico Nova compute K 8 s proxy Kubernetes Kubelet Docker Kubelet OS OS OS Host Compute Host OS Host Diving bell nova prometheus Ceph osd K 8 s sched Ceph mon Kubernetes libvirt Diving bell ingresskibana Ceph osd shipyard Calico etcd K 8 s contrl Ceph rbd tiller OS Deploy Compute Host groups K 8 s Scheduler Balance POD’s glance Commit Docs fluentd neutron rabbitmqiam Cloud

How do we use Airship| How do we update a cloud? Hardware IAM lnfo keystone (Keystone) nova Update Chart horizon Chart Docs (*) Elastic. Sear Chart Change Fluentd ch (Ceph) SDS Configuration Collector Add new CNI(Calico) Chart Baremetal documents Chart keystone Authenticate rabbitmq iam neutron cinder glance deckhand promenade Hardw IAM keysto are nova (Keysto horizon ne lnfo Elastic. S Chart ne) Fluentd Chart SDS Chartearch Collect CNI(Cali (Ceph) Barem Chart or co) Chart etal Chart drydock armada. Calico Gather updated Manifest Press to Update Hardware IAM lnfo keystone (Keystone) nova Chart horizon Chart Elastic. Search Chart Fluentd Chart SDS (Ceph) Collector Chart CNI(Calico) Chart Baremetal Chart Artifactory Jenkins pegleg Hardw IAM keysto are nova (Keyst horizo ne Elastic lnfo Chart Fluent one) n SDS Chart Search d. CNI(Ca Chart Barem (Ceph) Chart lico) Collect etal Chart or Chart Kubernetes Docker Hardw IAM keysto are nova (Keysto horizon ne lnfo Elastic. S Chart ne) Fluentd Chart SDS Chartearch Collect CNI(Cali (Ceph) Barem Chart or co) Chart etal Chart Trigger Update Action nova prometheus Ceph osd K 8 s sched Ceph mon mariadb Calico etcd K 8 s api Kubernetes Docker Kubelet K 8 s api Kubernetes Docker Cloud Harbour (**) Diving bell Fluentd collect Nova compute Calico Nova compute K 8 s proxy Kubernetes Kubelet Docker Kubelet OS OS OS Host Compute Host OS Host libvirt Diving bell ingresskibana Ceph osd shipyard Calico etcd K 8 s contrl Ceph rbd tiller Hardware IAM keystone lnfo (Keystone) nova Chart horizon Chart Elastic. Sear Fluentd Chart SDS ch (Ceph) Collector CNI(Calico) Chart Baremetal Chart fluentd neutron Cloud

HOW DO WE USE AIRSHIP | REPOSITORY Do cuments, how are they managed? documents LAYERS type global software schemas charts osh profiles host hardware secrets passphrase sites cruiser unicycle software certs airship charts Cloud(X) profiles host osh Pegleg + Cloud(Y) software charts osh Deckhand profiles host physical baremetal network

THE CONTRIBUTORS Security Containerizati on Quality The Airship sub-projects started in the open through active collaboration both in the CNCF and Open. Stack communities. An initial collaboration with SK telecom and Intel is growing. 14 © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

SK Telecom Case Study: TACO (SKT All Container TACO = Open. Stack-Helm + Armada + SKT All-Flash Ceph + SKT In. Open. Stack) House Tools Asset Management (SKT Tool) Baremetal Provisioning (SKT Tool) Network Configuration (SKT Tool) Open. Stack-Helm (Open. Stack) Kubernetes Deployment (Kubespray) SKT AF-Ceph Deployment 15 Armada (Unified Manifest & Life Cycle Hooks) Open. Stack-Helm (Logging & Monitoring) SKT Helm Chart (SKT Internal Ops Tools)

SK Telecom Case Study: How do we use Armada (a subproject of Airship) CI Pipeline “A” manifest CD Pipeline “B” manifest “C” manifest 16 Openstack-helm Chart A Production B Production C

SK Telecom Case Study: TACO (Open. Stack-Helm & Armada) Adoption SKT Private Cloud Service : Infrastructure Service for Dev & QA (3 Q 2018) VDI Service : Internal VDI Service (4 Q 2018), Public VDI Service (2019) Big Data & Analytics Service : Development (2018), Production (2019) NFV (Telco Infra) : Green Field Production (2019) Important Things are • Working together in the community to enhance Armada and Open. Stack. Helm • Keeping “Upstream First” strategy for mutual benefits • Going a step further to review other sub-projects in Airship to boost possible collaboration Reference Implementation Information • TACO All In One Deployment Script with Armada • https: //github. com/sktelecom-oslab/taco-scripts

Containerizati on Security HOW TO GET STARTED Quality WHERE TO GO Visit https: //airshipit. org TRY IT OUT https: //github. com/openstack/airship-in-a-bottle CI/CD STATUS 8 Project Pep 8/Flake 8 Bandit Docs Coverage Unit Tests Shipyard Yes Yes 55% 234 Drydock Yes Yes 43% 126 Armada Yes Yes 65% 134 Deckhand Yes Yes 76% 257 Promenade Yes Yes 64% 3 © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

CALL TO ACTION Security Containerizati on Quality • USER FEEDBACK • HELP WITH OS API ALIGNMENT AND FEEDBACK • TEMPEST INTEGRATION • OPENSTACK/REQUIREMENTS WORK • IRONIC DRYDOCK INTEGRATION • KUBERNETES BACKED BY KEYSTONE 8 © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.

Questions? Alan Meadows (alan. meadows@att. com) Rodolfo Pacheco (rodolfo. pacheco@att. com) LINKS TO AIRSHIP SUB-PROJECT CODE & DOCUMENTATION Treasure Map (http: //treasuremap. readthedocs. io/en/latest/) (GITHUB) Shipyard (https: //github. com/openstack/airship-shipyard) Drydock (https: //github. com/openstack/airship-drydock) Divingbell (https: //github. com/openstack/airship-divingbell) Deckhand (https: //github. com/openstack/airship-deckhand) Armada (https: //github. com/openstack/airship-armada) Promenade (https: //github. com/openstack/airship-promenade) Three Ways to Learn More - https: //airshipit. org - IRC: #airshipit - Mailing List: lists. airshipit. org Berth (https: //github. com/openstack/airship-berth) Pegleg (https: //github. com/openstack/airship-pegleg) 20 © 2018 AT&T Intellectual Property. All Rights Reserved. AT&T, the Globe logo, Mobilizing Your World and Direc. TV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners.