AWS Startup 2020 - AMIS

Transcript

1. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. @k2r2bai Customer case: AMIS 帳聯網路科技 Kyle Bai Site Reliability Engineer AMIS
2. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. About Me ⽩凱仁(Kyle Bai) • SRE at AMIS/MaiCoin. • AWS Container Hero. • OSS Contributor. • Co-organizer of Cloud Native Taiwan User Group. • Interested in emerging technologies. GitHub: kairen(k2r2.bai@gmail.com) Blog: https://k2r2bai.com
3. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AMIS 帳聯網路科技 Driving The Decentralized Future AMIS is a financial technology company creating bonds between traditional and decentralized worlds. We provide security and accessibility for blockchains as well as crypto currencies. With us, our customers are able to adopt blockchain technology with ease and confidence. Building bonds between traditional and decentralized finances https://www.am.is/
4. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AMIS + MaiCoin Group Relationship MAX Digital Asset Exchange MaiCoin AMIS Provide blockchain tech and Digital asset custody
5. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. MaiCoin / AMIS Group Timeline
6. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AMIS Quick Summary • Integrated Fintech Product Development, Financial Services & Advisory Company. • Sister Company of MaiCoin. (Taiwan’s longest running digital asset platform & brokerage service since 2014) • Developed technology for the MAX Digital Asset Exchange. (launched 2018 as leading full-function, global exchange w/ crypto-crypto & NTD-crypto trading). (asset custody) • Core Blockchain Tech Developer for corporations and major institutions. (JP Morgan’s Ethereum blockchain platform ‘Quorum’ adopted AMIS developed IBFT / Fault Tolerance Consensus Algorithm in 2017) • Founding member of the Ethereum Enterprise Alliance.
7. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Services and Products
8. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Security Usability Self Sovereignty AMIS Wallet Service
9. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
10. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. ⼀句話描述 Wallet Service 提供⾼可⽤性 API 且安全的數位資產錢包服務 (Secure cloud digital asset wallet service with highly available API)
11. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. ⼀張圖描述 Wallet Service + Node Cluster (Blockchain) Key Storage
12. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. ⼀張圖總結 Wallet Service Wallet security Reliable Developer API Professional and economical node operation
13. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Technical Architecture on AWS
14. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Our Kubernetes Decision Tree Self-Hosted on EC2 AWS EKS Spot On Demand
15. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Vishwakarma: Self-Hosted on AWS • Terraform modules to setup self-hosting Kubernetes cluster on AWS. • Can customize anything. • Align company compliance. • Cost: Clusters have different topology. • Infrastructure-as-code (IaC). • Versioning infrastructure. • Reusable modules. • With default and customized ASG. • YOU NEED TO MAINTAIN ANYTHING. • Github: https://github.com/getamis/vishwakarma • https://github.com/getamis/terraform-ignition-kubernetes • https://github.com/getamis/terraform-ignition-etcd
16. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Elastic Kubernetes Service(EKS) • Easier to create and manage. • No Control Plane to manage. • Auto Repairing / Patching of Control Plane Nodes. • Some reduction of user management requirements during node version patching/ upgrades by draining nodes of pods and replacing them. • Kubernetes assets can integrate seamlessly with AWS services using EKS. • ... AWS Managed (Control Plane) Customer Account (Worker Nodes)
17. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS EKS Amazon EC2 Auto Scaling Availability Zone 1 NAT gateway Auto Scaling group Worker Node Worker Node Availability Zone 1 NAT gateway Auto Scaling group Worker Node Worker Node AWS Fargate
18. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS EKS
19. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Tightly integrate with AWS services
20. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. ALB Ingress Controller Kubernetes Cluster kube-apiserver Update status Watch changes ALB Ingress Controller Pod B Pod A Pod B Pod A Pod C Pod D Pod B Pod A Pod C Pod D NP: A NP: B NP: A NP: B NP: A NP: B NP: Node Port Target Group: Service A (mode instance) Target Group: Service B (mode instance) Target Group: Service C (mode IP) Application Load Balancer Rule: /* Rule: /products Rule: /accounts Listener: HTTP Listener: HTTPS AWS Resources
21. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS VPC CNI ec.associatedAddress() CNI VPC Subnet: 10.0.0.0/24 instance 1 instance 2 Nginx Pod (Veth IP: 10.0.0.1) Java Pod (Veth IP: 10.0.0.2) ENI Secondary IPs: 10.0.0.1 10.0.02 Secondary IPs: 10.0.0.20 10.0.021 ENI CNI Nginx Pod (Veth IP: 10.0.0.20) Java Pod (Veth IP: 10.0.0.21) VPC
22. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. IAM Authenticator 1: Generate signed STS URL 2: Pass AWS identity 3: Verity AWS identity 4: Kubernetes action allowed / denied Kubernetes Master API Role Base Access Control(RBAC)
23. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. IAM Roles for Service Accounts(IRSA) Pod Identity Webhook kube-apiserver Apps IAM Roles (Apps roles) inject call pull AWS Resources S3 bucket (Discovery endpoint) ECR OpenID Connect Provider assume Kubernetes
24. @k2r2bai © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Thank you! Kyle Bai k2r2.bai@gmail.com