Continuous Delivery Summit 2020

Container scanning in CI/CD pipelines not new, but getting real value from the scan is still really hard. Interpreting results and understanding CVEs and vulnerability sources is not easy and takes time. With containers coming from many teams and sources the variance in quality and types of problems can be huge. As a result, scanning may be relegated to a checkbox item. Or even worse, it becomes a source of noise and distraction without any
real security benefits. In building an open-source container scanner and working with users in enterprise and government teams to add scanning to their pipelines, Zach has worked through a lot of the challenges that come with container scanning. He will share these insights and pitfalls so you can get confidence and better deployments, not just a long list of issues on the backlog. You'll come away with an understanding of what to watch for, how to avoid common mistakes, and how to use your CD pipelines to improve the security of your deployments.

Spinnaker is a very powerful and friendly (once you get to know it better) CD system, but its complexity can drive people off. Infrastructural complexity is taken care of by using many pre-configured “distributions”, but what about the complexity of managed app configurations? We believe we have a solution for that as well.
GitOps has become a buzzword, and for good reason: it really helps manage systems at scale. After testing it in Spinnaker, we’re more than convinced that it’s the way to go.

In this talk, we’re going to introduce the general public to our approach to simplified Spinnaker management using our open-source tool - Floodgate and Spinnaker-provided components, such as sponnet.

Specifically, we’ll be covering:
* our idea and PoC of managed configuration for Spinnaker
* a comparison with already-existing solutions and why we think we need “another competing standard”
* our plans for upstream contributions to Spinnaker
* how we all can improve the state of things.

For an enterprise product, in every new release, the quality of features outweighs their quantity. This was our vision while shifting to a weekly sprint release instead of per changemset release. Another aspect was that time and import be given to test environment - specifically for performance testing, given the size of our enterprise products. To succeed with this new release system, we quickly realised that the CICD pipeline needed to be upgraded from a serialised system to a synchronous one. We also used a powerful combination of tools - Kubernetes cluster, Umbrella Helm chart deployment and Jenkins jobs - ensuring best quality product release. In this session, we will talk about the need and benefits of movement towards a quality-driven monolithic production environment, feature-driven development environment, and creation backup environments for testing.

CDF GB agreed to and ratified 9 strategic goals in early October 2019 and one of them is interoperability.

Recognition of the importance of interoperability and identifying it as one of the goals is a very important step for CDF to take for users since users and organizations employ various CI/CD tools & technologies depending on their needs and where they are in their CI/CD journey. However, one of the challenges users face is the fragmentation and lack of interoperability in CI/CD ecosystem, causing difficulties for them while constructing and running pipelines.

Identifying and addressing the challenges require a neutral forum for users, projects, and communities to come together, have dialog, and approach it in a collaborative manner. CDF Interoperability SIG was launched exactly for this purpose and already on its way to contribute to the domain.

In this session, we will provide updates from the SIG and share some of the ways the community can contribute to this important area.

Managing production machine learning systems as internal data science infrastructure requirements grow has uncovered new challenges which have required fundamentally different approaches to that of traditional CI/CD in software engineering. In this talk we will dive into the work we are doing at the SIG-MLOps and the CD Foundation towards developing the methodoloties that encompass best practices to continuously integrate and deploy machine learning in production at massive scale.

In this talk we'll provide insights on the core MLOps concepts, as well as a hands on coding example where we take a model through its deployment and promotion lifecycle. We will be using Jenkins X (with Prow & Tekton) to deploy/promote these models across multiple environments. We will use KIND (Kubernetes in Docker) to run integration tests in our development envionment. Finally we'll be using Seldon (with Istio) to orchestrate & monitor these models leveraging canary and shadow deployments.

In this session you'll learn about when and when not to use Tekton. Since its inception just over a year ago, developers have been kicking the tires writing all kinds of Tekton Pipelines and Tasks - ranging from the classic "git clone, build and deploy my app" to "security scan this image" and "go and make me a webhook!".

Sometimes it's best to write a short Tekton task to achieve your objective - and other times it's definitely not. Qualitative data will be presented and plenty of findings and ideas will be shared.
There are no pre-requisites for this talk but an ideal audience will be:
- Considering or already using Tekton
- Looking to evaluate performance and functional pros and cons of a cloud-native CI/CD solution
- Enthusiastic and willing to ask questions!