Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Building an Enterprise-Ready Lambda Experience

Building an Enterprise-Ready Lambda Experience

To create a lambda experience is easy, to do that in a mission-critical environment is not that easy. We will talk about two parallel journies: how we implemented this at BBVA (an international 100 years old bank with more than 130 thousand employees, 10% of them being IT professionals). We´ll cover all the main decisions that we took in our path to serverless and the tradeoffs that we accepted. As a complement to this, we will implement in stage a simpler version of this experience using out of the box Kubernetes features like CRDs.

There are certain thoughts that you need to keep in mind when you are planning a serverless solution in your company: usability, extensibility, security, resiliency, to use a market solution or build our own, logs, metrics… in the end, how do we make this tool part of our toolset seamlessly and production ready from the first minute.

Alexandre González

May 21, 2019
Tweet

More Decks by Alexandre González

Other Decks in Technology

Transcript

  1. ❏ Financial services ❏ Presence in +10 countries ❏ 2

    private data centers (America, Europe) ❏ +10K IT professionals ❏ Building internal cloud services since 2014
  2. ❏ Simplified compute experiences fully integrated with Bank tools including

    (but not limited to)... ❏ Containers as a service (based on k8s/openshift) ❏ “Google App Engine/Heroku” like service (based on k8s/openshift) Our team WAS offering
  3. ❏ Simplified compute experiences fully integrated with Bank tools including

    (but not limited to)... ❏ Containers as a service (based on k8s/openshift) ❏ “Google App Engine/Heroku” like service (based on k8s/openshift) ❏ Lambdas Our team IS offering
  4. Industry constraints ❏ Financial regulated industry: Security, confidentiality, auditable, data

    location… Company constraints ❏ BBVA internal rules and tools (ex: distributed tracing collector, security and compliance checks, ... )
  5. Our API 1/2 Inspired by AWS Lambda on how to

    implement a function import io.e3r.lambda.context.Context; public class IdentityCardLetter { public String getIdentityCardLetter( String identityCardNumber, final Context context) { return “your code goes here”; } }
  6. Our API 2/2 ❏ Inspired by Google Cloud Functions on

    how to manage the functions ❏ RESTful API ❏ Function resource to create, get, update, delete a function ❏ Execute function: .../namespace/{id}/function/{id}:[call|async-call] ❏ The big difference ❏ Code is pushed to git repositories (only allowed option) ❏ After code is pushed internal pipelines do their magic (mainly security and compliance)
  7. Our API 2/2 Example: Deploy your function curl -X POST

    https://lambda.domain -d { “code”:”[codeReference]”, “entryPoint”:”mypackage.MyClass.theFunction” }
  8. State of the art 1/2 ❏ First option was to

    use an existing solution. Some evaluated: Openwhisk, Openfaas, Knative, Kubeless… ❏ Problems not solved yet (or at least when we started) ❏ Easy extension to be integrated with BBVA tools (security, logs, tracing, monitoring, …) ❏ Multi region ❏ Multitenancy (BBVA-way) ❏ Security compliance ❏ GRPC
  9. State of the art 2/2 ❏ We had an internal

    implementation of a compute service similar to Google App Engine / Heroku ❏ We had internal certified execution stacks ❏ Evolution of that service using the certified stacks was evaluated
  10. Our decisions ❏ Offer the right UX “wrapping” the real

    implementation ❏ Evolve internal “App Engine” compute service to execute functions ❏ Use certified stacks as functions execution environment ❏ Keep evaluating products (future replacement of custom development without breaking the UX)
  11. Control Plane ❏ Main control plane to manage lambda lifecycle

    ❏ Caller Manager providing access to deployed lambdas
  12. Your lambda Caller Manager Control plane admin call* manage Control

    plane Your lambda admin manage * Gateways, load balancers, firewalls… not represented here for the sake of simplicity Sync call* invokes PUB/ SUB Async call*
  13. Lambda server Context Your function goes here Lambda pod Kubernetes/OCP

    Init-container: Bootstrapper Logging, tracing, monitoring POST .../functions/[id]:call Caller Manager Control plane
  14. Execution stack ❏ Add a new language implies to build

    a new lambda server implementing the internal json rpc protocol for that language and the setup process ❏ Add the internal pipelines needed to ensure software quality and vulnerabilities checking