Live data from Hacker News

How We Build Code at Netflix

techblog.netflix.com

11–20 of 140 posts

Re: How We Build Code at Netflix

#11
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Can some one explain to me what immutable means in terms of "infrastructure" ?

As far as I understood it, you don't make changes to running servers. Say you need to update a package, you spin up a new server with the updated package and once the traffic is migrated to new server, you spin down the old server.

Re: How We Build Code at Netflix

#12
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Can some one explain to me what immutable means in terms of "infrastructure" ?

An example would be whenever new version of an app is deployed an entirely new EC2 instance is started from a fixed image. The app is copied onto it and then load balancers are changed etc...

The image the EC2 instance is started from is immutable while it is running. Of course the image gets updated regularly by devops with security fixes, but the running production instance(s) is/are never changed on the fly. Instead it is completely redeployed.

Re: How We Build Code at Netflix

#13
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Can some one explain to me what immutable means in terms of "infrastructure" ?

Simplified: Instead of modifying a deployment by uninstalling the old software, updating the config files and installing a new version, you create a new virtual machine image with all you need and deploy instances of that. Even if you just want to change a setting in a file you deploy new virtual machines. There are variations of this such as using Docker.

Re: How We Build Code at Netflix

#14
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Can some one explain to me what immutable means in terms of "infrastructure" ?

It means updating infrastructure by making changes to a versioned service definition instead of on running instances.

Would you fix a software bug by editing the code on a running server and tell yourself that you will add it to the repository later? Of course not. You would end up with a running instance of the code that is impossible to replicate.

Immutable infrastructure applies that same idea to running services.

Re: How We Build Code at Netflix

#15

Earlier quoted context omitted.

Can some one explain to me what immutable means in terms of "infrastructure" ?

Simplified: Instead of modifying a deployment by uninstalling the old software, updating the config files and installing a new version, you create a new virtual machine image with all you need and deploy instances of that. Even if you just want to change a setting in a file you deploy new virtual machines. There are variations of this such as using Docker.

And the next step would be moving your config to something distributed like etcd or archaius

Re: How We Build Code at Netflix

#16
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Immutable infrastructure is the future and it seems that even Netflix is planning to use containers for that: "Containers provide an interesting potential solution to the last two challenges and we are exploring how containers can help improve our current build, bake, and deploy experience."

I think that the future of deployments means that it is closely integrated with your source code management. Every new push builds a container that can go through the following steps:

1. Deployment (server with only test traffic)

2. Post-deploy test (smoke test)

3. Canary (part of the traffic)

4. Live / multiregion deploy

5. Manual overrides http://techblog.netflix.com/2015/11/global-continuous-delive... "Spinnaker also provides cluster management capabilities and provides deep visibility into an application’s cloud footprint. Via Spinnaker’s application view, you can resize, delete, disable, and even manually deploy new server groups using strategies like Blue-Green (or Red-Black as we call it at Netflix). You can create, edit, and destroy load balancers as well as security groups."

Also see https://gitlab.com/gitlab-org/gitlab-ce/issues/3286

Re: How We Build Code at Netflix

#17
post #16
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Immutable infrastructure is the future and it seems that even Netflix is planning to use containers for that: "Containers provide an interesting potential solution to the last two challenges and we are exploring how containers can help improve our current build, bake, and deploy experience." I think that the future of deployments means that it is closely integrated with your source code management. Every new push bui…

Google is actively adding Kubernetes support as well: https://github.com/spinnaker/spinnaker/issues/707

Re: How We Build Code at Netflix

#18
post #16
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Immutable infrastructure is the future and it seems that even Netflix is planning to use containers for that: "Containers provide an interesting potential solution to the last two challenges and we are exploring how containers can help improve our current build, bake, and deploy experience." I think that the future of deployments means that it is closely integrated with your source code management. Every new push bui…

> Immutable infrastructure is the future

Are there any downsides to immutable infrastructure?

Re: How We Build Code at Netflix

#19
post #16

Earlier quoted context omitted.

Immutable infrastructure is the future and it seems that even Netflix is planning to use containers for that: "Containers provide an interesting potential solution to the last two challenges and we are exploring how containers can help improve our current build, bake, and deploy experience." I think that the future of deployments means that it is closely integrated with your source code management. Every new push bui…

> Immutable infrastructure is the future Are there any downsides to immutable infrastructure?

It takes a while to bake the image, and storing thousands of images can add up. However containers can address both points.

Re: How We Build Code at Netflix

#20
post #4

Spinnaker is an amazing tool. Really makes it easy to confidently deploy applications via immutable infrastructure.

Can some one explain to me what immutable means in terms of "infrastructure" ?

The other replies here are great but let me give you the layman's version of what "immutable infrastructure" means:

If it works for me it works for everyone.

You never patch or upgrade immutable infrastructure. You just replace what you've got with a new VM or container. Containers being preferred because they can be started & stopped near instantaneously and there's nothing like a virtual BIOS that could have different configurations like with VMs.

You don't stand up a VM or container then "log in to configure it". Once the VM is "up" that's it. You're done. At that point you just need to point your load balancers/DNS at the new stuff then take down the old stuff.

One interesting aspect of immutable infrastructure such as this is that it is completely incompatible with loads of existing security policies and what would have been considered "best practices" just a few years ago. For example, you might have a security policy that states that everything must be scanned within 30 days for malware/out-of-date packages/whatever. Yet with immutable infrastructure your hosts or containers may only be up for a few days before being replaced!

So when your security team freaks out because none of your hosts/containers are showing up in their systems you'll have a lot of explaining to do =D

"We need to scan your hosts so we can ensure that you're installing security patches."

"We don't do that."

"You don't install security patches?!?"

"Yeah, well, you see..."

Trust me when I say that trying to explain how it all works and why it's more secure than old school deployments is not easy!

Post reply on HN