Continuous Delivery Best Practices

P U B L I C S E C T O R
S U M M I T
C anb er r a, AC T

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C T O R
S U M M I T
Continuous Delivery Best Practices
John Hyland
Senior Cloud Architect
AWS Professional Services

S U M M I T
What are we going to learn today?
Some of the continuous deployment best practices of Amazon
How and why you should employ these practices yourself
Some steps toward continuous deployment nirvana

S U M M I T
What is continuous delivery?
Source Build
Pre-
test
Deploy
Post-
test

S U M M I T
Tools used in this talk
Developer tooling and CI/CD
Amazon CloudWatch Amazon Simple
Notification Service
(Amazon SNS)
AWS CodeBuildAWS CodeCommit AWS CodeDeploy AWS CodePipeline
Monitoring and notifications

S U M M I T
Basic continuous delivery best practices
• Versioned source
• Automated build
• Automated deployments
• Deploy to > one instance
• Unit tests
• Integration tests
• Continuous delivery
• Operations dashboard
Source
Build
Deploy to
integration stack
Integration tests
Deploy to
production
MyApp
CodeCommit
Source
Build
CodeCommit
Build
DeployToInteg
CodeDeploy
Integration
IntegTest
End2EndTester
DeployToProd
CodeDeploy
Production

S U M M I T

S U M M I T
An automated pipeline should be…
• Defined as code
• Version controlled
• Extensible
• Providing FAST feedback
• Secured

S U M M I T
Opportunities for automation
• Continuous integration processes
• Health checks
• Application tests
• Notifications and alerts
• Infrastructure as code

S U M M I T
Step 2: Notify on failed build and test
Tests
Source
MyAppSource
CodeCommit
Build
BuildAndUnitTests
CodeBuild
IntegrationDeploy
TestOnChrome
CodeBuild
TestOnChrome
CodeBuild
IntegTest
End2EndTester
CloudWatch
Events
(failed action)
AWS Lambda function
NotifySlackOnPipelineActionFailure()

S U M M I T
CodeDeploy – Amazon ECS blue-green deployments
• Provision “green” tasks
• Validate using “hooks”
• Flip traffic at load balancer
• Fast rollback
• Monitor
• How?
• “CodeDeploy-Amazon ECS” deploy action in CodePipeline
• “aws Amazon ecs deploy” command in Jenkins

S U M M I T
CodeDeploy-Amazon ECS appspec
version: 1.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
- TaskDefinition: "my_task_definition:8"
LoadBalancerInfos:
- ContainerName: "SampleApp"
ContainerPort: 80
Hooks:
- BeforeInstall: "LambdaFunctionToExecuteAnythingBeforeNewRevisionInstalltion"
- AfterInstall: "LambdaFunctionToExecuteAnythingAfterNewRevisionInstallation"
- AfterAllowTestTraffic: "LambdaFunctionToValidateAfterTestTrafficShift"
- BeforeAllowTraffic: "LambdaFunctionToValidateBeforeTrafficShift"
- AfterAllowTraffic: "LambdaFunctionToValidateAfterTrafficShift"

S U M M I T
CodeDeploy-Amazon ECS blue-green deployment
100%
Prod
traffic

S U M M I T
Test traffic
listener
(port 9000)
Target
group two
100%
Prod
traffic

S U M M I T
Green tasks:
v2 code
100%
Prod
traffic
Provision green tasks

S U M M I T
100%
Test
traffic
100%
Prod
traffic
Run hook against test endpoint before green tasks receive prod traffic

S U M M I T
100%
Prod
traffic
Flip traffic to green tasks, rollback in case of alarm
0%
Prod
traffic

S U M M I T
100%
Prod
traffic
Drain blue tasks

S U M M I T
Container image tagging for deployments

S U M M I T
Build pushes new “latest” image
Image: sha256@22222... (“latest”)

S U M M I T
Service scales up, launching new tasks
Image: sha256@22222... (“latest”)

S U M M I T
Deploy using immutable tags
{
"name": "sample-app",
"image": "amazon/amazon-ecs-
sample@sha256:3e39d933b1d948c92309bb583b5a1f3d28f0119e1551ca1fe538ba414a41af48d"
}
{
"name": "sample-app",
"image": "amazon/amazon-ecs-sample:build-b2085490-359f-4eaf-8970-6d1e26c354f0"
}
SHA256 Digest
Build ID

S U M M I T
Compute immutable tags during build
SHA256 Digest
export IMAGE_URI=`docker inspect --format='{{index .RepoDigests 0}}' my_image:$IMAGE_TAG
Example Result:
amazon/amazon-ecs-sample@sha256:3e39d933b...
Build ID
export IMAGE_TAG=build-`echo $CODEBUILD_BUILD_ID | awk –F":" ‘{print $2}'`
Example Result:
build-b2085490-359f-4eaf-8970-6d1e26c354f0

S U M M I T
Build pushes new image tagged with new build ID
Image: sha256@22222... (“build-22222”)

S U M M I T
Service scales up, launching new tasks
Image: sha256@22222... (“build-22222”)

S U M M I T
Image: “build-22222” tag
Deployment updates service’s task definition, replacing tasks
Image: sha256@22222... (“build-22222”)

S U M M I T
Adding safety with AWS Config rules
• Build AWS Config rules
• Block non-compliant pipelines
• Provide examples

S U M M I T
Approval action-based pipeline safety check
Source
MyAppSource
CodeCommit
Build
MyAppBuild
Build
Deploy
safetyCheck
Approval
ProductionDeploy
CodeDeploy
Amazon
SNS topic
AWS Lambda function
safetyCheck
AWS Config

S U M M I T
AWS Config rules-based pipeline safety check

S U M M I T
AWS Config
AWS Config rules-based pipeline safety check
Source
MyAppSource
CodeCommit
Build
MyAppBuild
Build
DeployToProd
MyApp
CodeDeploy
AWS Lambda function
disablePushtoProduction
CloudWatch
event (event-
based)

S U M M I T
What we’ve learned
Goal: Make your pipeline safer
1. Identify production issues quickly
2. Safely deploy changes
3. Automatically decide when to block changes

Continuous Delivery Best Practices

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Continuous Delivery Best Practices

Similaire à Continuous Delivery Best Practices (20)

Plus de Amazon Web Services

Plus de Amazon Web Services (20)

Continuous Delivery Best Practices