ContainerDays 2019, Hamburg: Talk by Tobias Placht (@knacht, Senior Software Engineer at QAware) & Nicolai Rybnikar (DG-i) Abstract: This talk provides an overview on usage of the Open Service Broker API in practice. We show the fundamental concepts how to develop, publish and consume services using a service broker. We report from our experience and present lessons learned based on a real-world project.

1. INTRODUCTION TO THEINTRODUCTION TO THE
OPEN SERVICE BROKEROPEN SERVICE BROKER
APIAPI
1

2. WHO ARE WE?WHO ARE WE?
Working at QAware in Munich
Dev, Ops, YAML Engineer
Twitter: @knacht
tobias.placht@qaware.de
2 . 1

3. WHO ARE WE?WHO ARE WE?
Working at DG-i in Cologne
Sysadmin ("Cloud Platform Engineer")
Twitter: @rybnico
nr@dg-i.net
2 . 2

4. Source: https://dilbert.com/strip/2011-01-07
3 . 1

5. Bryan Friedman
@bryanfriedman
Building a platform is not a good use of developer time.
Kubernetes is not the platform - it’s a platform on which you
build your platform. Getting the right level of abstraction means
you can focus on building custom software better. So says
@jessitron at #VelocityConf
38 6:54 PM - Jun 12, 2019
See Bryan Friedman's other Tweets
3 . 2

6. Robert
@robhoffmax
Replying to @bryanfriedman @jessitron
Totally agree but this has been said for two years now? Where is
that platform?
5:16 AM - Jun 13, 2019
See Robert's other Tweets
3 . 3

7. 3 . 4

8. 3 . 5

9. 3 . 6

10. 3 . 7

11. You can’t go Cloud Native without
proper CI and CD
4 . 1

12. ENTERPRISE CUSTOMERS ARE SUBJECT TOENTERPRISE CUSTOMERS ARE SUBJECT TO
STRICT REGULATIONS…STRICT REGULATIONS…
Deployed Artifacts must be avilable for 10 years
Authentication and Authorization
Audit Log
Four Eyes Principle
Many many more
4 . 2

13. … LEADING TO A COMPLEX AND HIGHLY… LEADING TO A COMPLEX AND HIGHLY
OPINIONATED TOOLCHAINOPINIONATED TOOLCHAIN
4 . 3

14. IN THE BEGINNING THERE WAS ONLY PLAININ THE BEGINNING THERE WAS ONLY PLAIN
HELM AMD SOME BASH MAGICHELM AMD SOME BASH MAGIC
5 . 1

15. 5 . 2

16. AT LEAST FOR SOME TIMEAT LEAST FOR SOME TIME
Static configuration
Nearly impossible to maintain
Long round trip times
Strong dependency to helm
5 . 3

17. IT ALL COLLAPSED WHEN SOMEONE ASKEDIT ALL COLLAPSED WHEN SOMEONE ASKED
IF ITS POSSIBLE TO CHANGE ARTIFACTORYIF ITS POSSIBLE TO CHANGE ARTIFACTORY
5 . 4

18. BACK TO THE DRAWING BOARDBACK TO THE DRAWING BOARD
6 . 1

19. WE HAD THE FOLLOWING REQUIREMENTSWE HAD THE FOLLOWING REQUIREMENTS
Allow flexible deployment mechanisms
Support complex scenarios
Generic approach for different Services
Based on existing Open Source Standards
6 . 2

20. THE OPEN SERVICE BROKER APITHE OPEN SERVICE BROKER API
7 . 1

21. THE PROMISETHE PROMISE
API Specification for building Service Brokers
Service Brokers provide lifecycle methods for
deploying and connecting services
Independent of the technology or infrastructure
7 . 2

22. AVAILABLE SERVICE BROKERSAVAILABLE SERVICE BROKERS
Oracle Cloud Infrastructure
Huawei Cloud
Automation Broker
Azure
AWS
7 . 3

23. Kubernetes Special Interest Group -
Extension API to list, bind and provisio external
Services
Filling the Gap between a Kubernetes Cluster
and multiple Service Brokers
https://svc-
cat.io/
7 . 4

24. BIG PICTUREBIG PICTURE
7 . 5

25. SERVICE CATALOG RESOURCE TYPESSERVICE CATALOG RESOURCE TYPES
7 . 6

26. ClusterServiceBroker / NamespacedServiceBroker
A server running somewhere that offers various
services, e.g. MySQL Broker
7 . 7

27. ClusterServiceClass / NamespacedServiceClass
A category of services offered by a Broker, e.g.
MySQL Databases
7 . 8

28. ClusterServicePlan / NamespacedServicePlan (and
namespaced ServicePlan)
A specific type of a Service that a Broker offers, e.g.
100 MB MySQL Databases
7 . 9

29. ServiceInstance
A single instantiation of a Service/Plan, e.g. 100 MB
MySQL Database
7 . 10

30. ServiceBinding
A unique set of creds to access a specific Instance,
e.g. username/password for Jonathan’s 100 MB
MySQL Database
7 . 11

31. PROVISIONPROVISION
When the Service Broker receives a provision request from the Pla
it MUST take whatever action is necessary to create a new resourc
7 . 12

32. EXAMPLEEXAMPLE
- name: Install Helm Chart
include_role:
name: helm-chart
vars:
helm_values_file: "templates/sonarqube-values.yaml"
7 . 13

33. EXAMPLEEXAMPLE
- hosts: database
roles:
- role: geerlingguy.postgresql
7 . 14

34. DEPROVISIONDEPROVISION
When a Service Broker receives a deprovision request from a Platf
it MUST delete any resources it created during the provision.
7 . 15

35. EXAMPLEEXAMPLE
- name: Uninstall Helm Chart
include_role:
name: helm-chart
7 . 16

36. BINDBIND
Simply put, a binding is an ordinary K8s secret
7 . 17

37. EXAMPLE: WHAT THE USER DOESEXAMPLE: WHAT THE USER DOES
svcat bind artifactory -p maven
7 . 18

38. WHAT HAPPENS IN THE BACKGROUNDWHAT HAPPENS IN THE BACKGROUND
1. Create a new repository using the REST API
2. Create a technical user with limited access
3. Add permission target
4. Set permissions for technical user
5. Create K8s secret which can be used by the
application
7 . 19

39. DEMODEMO
8 . 1

40. 8 . 2

41. SUMMARYSUMMARY
9 . 1

42. LESSONS LEARNEDLESSONS LEARNED
Building a Platform is hard ;)
Plain Helm is often not enough
Not everything need to run in your Cluster
Not the most active SIG
The community is focusing on Operators
9 . 2

43. QUESTIONS?QUESTIONS?
10