How grant a set of internal rules for entire company? this slides explain how we create and execute this project: https://github.com/NeowayLabs/packer-images

1. Automating Image build to
ensure security compliance,
metrics, and auditing in Multi
Cloud environments
Luciano Faustino & Evaldo Felipe @ Neoway

2. Luciano A. B. Faustino
BlackOps @ Neoway
lucianoborguetti@gmail.com
@lborguetti
Evaldo Felipe
BlackOps @ Neoway
contato@evaldofelipe.com
@evaldofelipe

3. Florianópolis
São Paulo
New York
Startup Culture
GPTW
=)
Big Data
Sales Intelligence
Risk and Compliance
Agile Culture
High degree of testing
High degree of automation
Neoway

4. Challenges, Motivations and
Goals

5. Challenges, Motivations and
Goals
● Overview tech
● BlackOps team
● Goals

6. Tech Overview
● ~90 people (Devs, QAs, POs, DS, ... )
● Distributed in 14 teams
● Service ownership from design to operations

7. Cloud Overview
● Azure & AWS & GCP
● +500 Instances
● +5000 vcpus
● +8 Terabytes Ram
● +300 Terabytes SSD

8. Challenges

9. Challenges
Compliance requirements
● Logs and audit
● Hardening
● Monitoring

10. Toil

11. BlackOps Team

12. No?

13. BlackOps vs DevOps
● DevOps = Culture
● BlackOps Team empower software engineer
to succeed.
https://martinfowler.com/bliki/DevOpsCulture.html

14. How?

15. How?
● Culture
● Support
● DevOps Maturity
● Training
● Talks
● Tools

16. Goals

17. Goals
“Automate the creation and provision
of virtual machine images that meet
security, basic metrics, and auditing
requirements defined by Neoway”

18. Base images

19. Macro
Template
Snapshot
Virtual Machine
Cloud Provider

20. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss

21. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● CI/CD
● SCM

22. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● CI/CD
● SCM

23. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Container

24. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Container

25. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Infrastructure as code

26. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Infrastructure as code

27. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Infrastructure as code

28. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Infrastructure as code

29. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● VHD as code

30. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● VHD as code

31. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● VHD as code

32. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Config as code

33. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Config as code

34. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Tests for Ansible

35. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Tests for Ansible

36. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Tests for Ansible

37. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Tests for infrastructure

38. Tools
● Github
● Travis CI
● Docker
● Terraform
● Packer
● Ansible
● Molecule
● Goss
● Tests for infrastructure

39. CIS Controls

40. CIS Controls

41. CIS Controls

42. NeowayLabs/goss-cis-benchmark
1. Travis CI
2. CIS Controls + Neoway rules/compliances
3. Testes
3.1. yamllint
3.2. Goss
274 Security Recommendations
https://github.com/NeowayLabs/goss-cis-benchmark

43. goss-cis-benchmark
Lint
Render
Build
Pass

44. NeowayLabs/ansible-role-ubuntu-hardening
1. Travis CI
2. Ansible
3. Testes
3.1. Molecule
■ Lint
■ Converge
■ Idempotence
■ Verify
■ Scenario
https://github.com/NeowayLabs/ansible-role-ubuntu-hardening/

45. ansible-role-ubuntu-hardening
Molecule
Lint
Destroy
Create VM-
tester
Converge
Idempo-
tence
Verify Goss
Ansible
Ansible
Build
Pass

46. NeowayLabs/packer-images
1. Travis CI
2. Docker
3. Terraform (environment Builder)
4. Packer
4.1. Ansible
5. Testes
5.1. Terraform (environment Tester)
5.2. Goss (ToDo)
6. Publicação
https://github.com/NeowayLabs/packer-images

47. Travis CI Docker Terraform Packer
VM-
builder
Snapshot
Cloud
Provider
Terraform VM-
Tester
Travis CI
Travis CI Goss
Ansible

48. NeowayLabs/ansible-role-pcp
1. Travis CI
2. Ansible
3. Testes
3.1. Molecule
■ Lint
■ Converge
■ Idempotence
■ Verify
https://github.com/NeowayLabs/ansible-role-pcp/

49. Results

50. Google Cloud

51. Azure

52. Digital Ocean

53. Reflections

54. Reflections
● Goals before tools
● Separated projects
● Tests before code
● OpenSource

55. Thanks!
Doubts?
@lborguetti
@evaldofelipe

56. Join us! Follow us!
devopsfloripa.herokuapp.com @DevOpsDaysFLN