main.tex

% Latex Beamer template following CERN template guidelines (or trying!)

\documentclass[14pt,aspectratio=169]{beamer}
\usepackage{xcolor}
\usepackage{graphicx}
\usepackage{multicol}
\usepackage{tikz}
\usepackage[utf8]{inputenc}
\usepackage{xcolor}
\usepackage{moresize}

% Code listings with syntax highlighting
%  Require Pygments
\usepackage[outputdir=build]{minted}

\usetheme{cern}

\newcommand{\interludeTitle}{Outline - We Are Here}
\AtBeginSection[] {
  \frame{
    \frametitle{\interludeTitle}
    \tableofcontents[
      currentsection,
      sectionstyle=show/shaded,
    ]
  }
}

% \AtBeginSubsection[] {
%   \frame{
%     \frametitle{\interludeTitle}
%     \begin{multicols}{2}
%       \tableofcontents[
%         currentsubsection,
%         sectionstyle=show/shaded,
%         subsectionstyle=show/shaded,
%       ]
%     \end{multicols}
%   }
% }


% Talk date
% Uncomment this to define a presentation date distinct from \today
\def\mydate{1 May 2019}

% Preamble
\title[]{Docker Image Testing in GitLab CI}
%% \subtitle{(no subtitle..)}
%\author[Author]{\texorpdfstring{\url{thomas.loekkeborg@cern.ch}}{Author}}
\author[Author]{Thomas Løkkeborg - IT-DB-DAR\\\small github.com/tholok97}

% Body
\begin{document}

\setbeamertemplate{caption}{\raggedright\tiny\insertcaption\par}

\cernSplashBlue

% Title
{
  \setbeamertemplate{footline}{}
  \setbeamertemplate{navigation symbols}{}
  \frame{\titlepage}
}
\setcounter{framenumber}{0}

% TOC
\frame{
  \frametitle{Outline}
  \tableofcontents
}

%\begin{frame}
%  \frametitle{Who am I?}
%  \begin{multicols}{2}
%    \begin{figure}
%      \includegraphics[height=0.75\textheight]{images/norway.png}
%      \caption{koko}
%    \end{figure}
%    \begin{figure}
%      \includegraphics[width=0.5\textwidth]{images/sunnmore.jpg}
%      \caption{kaka}
%    \end{figure}
%  \end{multicols}
%\end{frame}

\section{Introduction}

\subsection{Features Used}

\begin{frame}
  \frametitle{Features Used}
    \begin{itemize}
      \item GitLab CI
      \item GitLab Container Registry
      \item Private GitLab Runners
      \item GitLab Runner Exec
      \item \textbf{Docker-in-Docker}
      \item \textbf{Artifacts}
    \end{itemize}
  \begin{figure}
    \includegraphics[width=0.3\textwidth]{images/gitlab.png}
  \end{figure}
\end{frame}

\begin{frame}
  \frametitle{Features Used - Docker-in-Docker}
  \begin{figure}
    \includegraphics[width=0.4\textwidth]{images/dockerindocker.jpeg}
  \end{figure}
  \begin{itemize}
    \item Docker daemon running inside Docker daemon
    \item Access to \mintinline{bash}{docker} command in GitLab CI jobs
  \end{itemize}
\end{frame}

\begin{frame}[plain]
  \begin{figure}
    \includegraphics[height=\textheight]{images/dindexplanation.png}
  \end{figure}
\end{frame}

\begin{frame}
  \frametitle{Features Used - Artifacts}
  \begin{itemize}
    \item Images passed between jobs as artifacts
    \item \mintinline{bash}{docker save / load} - tarball
  \end{itemize}
\end{frame}

\subsection{The Pipeline}

\begin{frame}
  \frametitle{The Pipeline}
  \begin{figure}
    \includegraphics[width=0.8\textwidth]{images/pipeline_list.png}
  \end{figure}
\end{frame}

\begin{frame}
  \frametitle{The Pipeline*}
  \begin{figure}
    \includegraphics[width=\textwidth]{images/pipeline_2.png}
  \end{figure}
\end{frame}

\begin{frame}
  \begin{figure}
    \includegraphics[height=0.9\textheight]{images/pipeline_multi.png}
  \end{figure}
\end{frame}

\begin{frame}
  \frametitle{The Pipeline - Quick facts}
  \begin{itemize}
    \item Approx. duration of full pipeline: 13 minutes
    \item Jobs per pipeline: 26
    \item Total started pipelines: 362
    \item Success rate: 80\%
    \item Biggest timestealer: Passing artifacts + \mintinline{bash}{docker save/load}
  \end{itemize}
\end{frame}

\section{The Tests}

\subsection{Goss}

% fragile cause verbatim used
\begin{frame}
  \frametitle{Goss - Dgoss}
  \begin{itemize}
    \item Asserts Docker image meets requirements described in goss.yaml file
    %\item Can generate goss.yaml from running container
    \item Tests:
    \begin{itemize}
    \item \mintinline{text}{user}
    \item \mintinline{text}{file}
    \item \mintinline{text}{command}
    \item \mintinline{text}{port}
    \item \mintinline{text}{http}
    \item \mintinline{text}{...}
    \end{itemize}
  \end{itemize}
\end{frame}

% fragile cause verbatim used
\begin{frame}[fragile]
  \frametitle{Goss - goss.yaml}
  \begin{minted}[
      fontsize=\scriptsize,
      breaklines,
    ]{yaml}
user:
  tomcat:
    uid: 1000
    gid: 1000
    exists: true
    groups:
      - tomcat
    shell: /sbin/nologin
http:
  http://localhost:8080/health-check/:
    status: 200
    no-follow-redirects: true
    timeout: 5000
    body:
      - I'm running
  \end{minted}
\end{frame}

% fragile cause verbatim used
\begin{frame}[fragile]
  \frametitle{Goss - Running}
  \begin{minted}[
      fontsize=\large,
      breaklines,
    ]{bash}
    dgoss run \
     -e SOME_VAR=some-value \
     -v /mount/path/outer:/mount/path/inner \
     image-under-test:1.0
  \end{minted}
\end{frame}

% fragile cause verbatim used
\begin{frame}[fragile]
  \frametitle{Goss - Output}
  \begin{figure}
    \includegraphics[width=\textwidth]{images/goss.png}
  \end{figure}
\end{frame}


\subsection{SSO}

\begin{frame}
  \frametitle{SSO Test - Concept} 
  \begin{itemize}
    \item «Given valid webapp and Identity Provider, can a test user log in successfully?»
    \item Keycloak as containerized Identity Provider with test data from JSON
    \item Webapp that shows received information about logged-in user
    \item Steps: Setup, Execute, Teardown
  \end{itemize}
  \begin{figure}
    \includegraphics[width=0.3\textwidth]{images/keycloak_logo.png}
  \end{figure}
\end{frame}

% fragile cause verbatim used
\begin{frame}[fragile]
  \frametitle{SSO Test - Setup}

  \begin{minted}[
      fontsize=\scriptsize,
      breaklines,
    ]{bash}
docker run \
 --name=sso-test-tomcat-container \
 -d \
 -p 8080:8080 \
 -e JEEDY_TOMCAT_SSO_IDP_LOGIN_BINDING_URL=\
    http://localhost:9090/auth/realms/testrealm/protocol/saml \
 -e JEEDY_TOMCAT_SSO_ENTITY_ID=sample-webapp-entity-id \
 -v "$PWD"/tests/sso/web.xml:/srv/tomcat/webapps/sample/WEB-INF/web.xml \
 test-image

docker run \
 --name=sso-test-keycloak-container \
 -d \
 -p 9090:8080 \
 -v "$PWD"/tests/sso/testrealm.json:/tmp/testrealm.json \
 -e KEYCLOAK_IMPORT=/tmp/testrealm.json \
 -e KEYCLOAK_USER=admin \
 -e KEYCLOAK_PASSWORD=admin \
 "${KEYCLOAK_IMAGE}"
  \end{minted}
\end{frame}

\begin{frame}
  \frametitle{SSO Test - Execute}
  Flow:
  \begin{enumerate}
    \item User tries to access web application
    \item User is redirected to SSO login
    \item User logs in
    \item User is redirected back to web application
    \item Assert that web application shows information we expect
  \end{enumerate}
  \hfill\break % create one empty line
  Above can be performed with three \mintinline{text}{curl}'s and some \mintinline{text}{sed}-fu
\end{frame}

\begin{frame}
  \frametitle{SSO Test - Teardown}
  \begin{itemize}
    \item Remove containers
    \item Dump container logs
  \end{itemize}
\end{frame}

\subsection{LDAP}

\begin{frame}
  \frametitle{LDAP Test}
  \begin{itemize}
    \item Image must provide LDAP authentication
    \item Follows structure of SSO test (setup, execute, teardown)
    \item Containerized LDAP server with test data
  \end{itemize}
\end{frame}


% fragile because contains verbatim
\begin{frame}[fragile]
  \frametitle{LDAP Test - Snippet}
  \begin{minted}[
      fontsize=\scriptsize,
      breaklines,
    ]{bash}
do_curl_test_with_basic_auth \
 "fakeuser:fakepassword" \
 "401" \
 "fake user 'fakeuser' should not be able to authenticate"

do_curl_test_with_basic_auth \
 "testuser1:fakepassword" \
 "401" \
 "valid user 'testuser1' should not be able to authenticate with an invalid password"

do_curl_test_with_basic_auth \
 "testuser1:testpassword1" \
 "200" \
 "valid user 'testuser1' should be authorized to access the webapp due to nested e-groups"

do_curl_test_with_basic_auth \
 "testuser2:testpassword2" \
 "403" \
 "valid user 'testuser2' should not be authorized to access the webapp"
  \end{minted}
\end{frame}

\section{Building Multiple Versions Of Image}

% fragile cause contains verbatim
\begin{frame}[fragile]
  \frametitle{Scaling Pipeline to Multiple Versions of Image}
  \begin{itemize}
    \item GitLab CI missing "build matrix" feature
    \item Extends/Include
    \begin{itemize}
      \item Newer, not supported by GitLab Runner Exec
    \end{itemize}
    \item Anchors/References
    \begin{itemize}
      \item What we use
    \end{itemize}
  \end{itemize}
\end{frame}

% fragile cause contains verbatim
\begin{frame}[fragile]
  \frametitle{YAML Anchors/References - Concept}
  \begin{minted}[
      fontsize=\small,
      breaklines,
    ]{yaml}
.hidden: &anchor
  image: docker:18.09

my_job:
  # reference to anchor
  <<: *anchor
  script:
    - docker info
  \end{minted}
\end{frame}


% fragile cause contains verbatim
\begin{frame}[plain,fragile]
  \frametitle{YAML Anchors/References - Usage}

  \begin{minted}[
      fontsize=\small,
      breaklines,
    ]{yaml}
job_build_8_5_jdk7:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_8_5_jdk7_variables
  <<: *template_reference_build

job_build_9_0_jdk8:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_9_0_jdk8_variables
  <<: *template_reference_build
  \end{minted}
\end{frame}

\subsection{}

\section{Future Improvements}

\begin{frame}
  \frametitle{Future Improvements}
  \begin{itemize}
    \item Unprivileged runner alternatives
    \item "ContainerStructureTest" tool
    \begin{itemize}
      \item Recent Google tool similar to Goss
      \item Basic tests runnable \textbf{without} Docker daemon (!)
    \end{itemize}
    \item Docker image vulnerability scanning - "Clair"
  \end{itemize}
\end{frame}

\section{}

\cernSplashWhite

\section{References and Bonus Slides}

\begin{frame}
  \frametitle{References}
  { 
    \scriptsize
    \begin{itemize}
      \item Repository for this presentation: \url{https://gitlab.cern.ch/tloekkeb/voxxeddays-cern-docker-image-testing-in-gitlab-ci}
      \item Goss: \url{https://github.com/aelsabbahy/goss}
      \item GitLab CI vulnerability scanning docs: \url{https://docs.gitlab.com/ee/user/application_security/container_scanning/}
      \item GitLab CI Docker-in-Docker docs: \url{https://docs.gitlab.com/ee/ci/docker/using_docker_build.html}
      \item ContainerStructureTests: \url{https://github.com/GoogleContainerTools/container-structure-test}
      \item GitLab Runner Exec: \url{https://docs.gitlab.com/runner/commands/\#gitlab-runner-exec}
      \item Keycloak: \url{https://github.com/keycloak/keycloak}
      \item Travis CI build matrix: \url{https://docs.travis-ci.com/user/build-matrix/}
    \end{itemize}
  }
\end{frame}

\begin{frame}
  \frametitle{Features Used - Docker-in-Docker - Tricks}
  \begin{itemize}
    \item docker:dind as a service - \mintinline{yaml}{alias: localhost} to make \mintinline{bash}{docker run -p 8080:8080 nginx && curl localhost:8080} from the job container work as expected
    \item \mintinline{bash}{docker build --cache-from} to manually specify image to cache layers from
  \end{itemize}
\end{frame}

% fragile cause contains verbatim
\begin{frame}[fragile]
  \frametitle{YAML Anchors/References - Pitfall}
  \begin{minted}[
      fontsize=\small,
      breaklines,
    ]{yaml}
.hidden: &anchor
  image: docker:18.09
  variables:
    COMMON_VAR: ""

my_job:
  <<: *anchor
  script:
    - docker info
  # Will not work!
  variables:
    MY_JOB_VAR: ""
  \end{minted}
\end{frame}

% fragile cause contains verbatim
\begin{frame}[fragile]
  \frametitle{YAML Anchors/References - Pitfall - Solution}
  \begin{minted}[
      fontsize=\small,
      breaklines,
    ]{yaml}
.hidden_job: &anchor_job
  image: docker:18.09

.hidden_var: &anchor_var
  COMMON_VAR: ""

my_job:
  <<: *anchor_job
  script:
    - docker info
  variables:
    MY_JOB_VAR: ""
    <<: *anchor_var
  \end{minted}
\end{frame}

% fragile cause contains verbatim
\begin{frame}[fragile]
  \frametitle{YAML Template Example - Common all DinD jobs}
  \begin{minted}[
      fontsize=\scriptsize,
      breaklines,
    ]{yaml}
.template_common_all_docker_dind_jobs: &template_reference_common_all_docker_dind_jobs
  image: docker:18.09
  tags:
    - db-runner-docker-privilege
  before_script:
    - docker info
    - docker login -u gitlab-ci-token -p $CI_BUILD_TOKEN $CI_REGISTRY
    - if [ -z $RUNNING_LOCALLY ]; then ln -s "$PWD" /artifacts && echo "CREATED SYMLINK"; fi
  services:
    - name: docker:18.09-dind
      alias: localhost

.template_common_variables_docker_dind: &template_reference_common_variables_docker_dind
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_DRIVER: overlay2
  \end{minted}
\end{frame}

% fragile cause contains verbatim
\begin{frame}[fragile]
  \frametitle{YAML Template Example - Build}
  \begin{minted}[
      fontsize=\scriptsize,
      breaklines,
    ]{yaml}
.template_build: &template_reference_build
  stage: build
  <<: *template_reference_common_all_docker_dind_jobs
  script:
    - docker pull ${PUSH_IMAGE_LATEST} || true
    -> docker build
      --cache-from ${PUSH_IMAGE_LATEST}
      --build-arg TOMCAT_MAJOR_VERSION="${TOMCAT_MAJOR_VERSION}"
      --build-arg JAVA_MAJOR_VERSION="${JAVA_MAJOR_VERSION}"
      -t ${TEST_IMAGE_TAG} .
    - docker save --output /artifacts/${TEST_IMAGE_TAR} ${TEST_IMAGE_TAG}
  artifacts:
    expire_in: '1 day'
    paths:
      - ${TEST_IMAGE_TAR}
  \end{minted}
\end{frame}

% fragile cause contains verbatim
\begin{frame}[fragile]
  \frametitle{YAML Template Example - Variables}
  \begin{minted}[
      fontsize=\scriptsize,
      breaklines,
    ]{yaml}
.template_image_tag_variables: &template_reference_image_tag_variables
  TEST_IMAGE_TAG: test:${CI_COMMIT_REF}-${TOMCAT_MAJOR_VERSION}-${JAVA_MAJOR_VERSION}
  TEST_IMAGE_TAR: test:${CI_COMMIT_REF}-${TOMCAT_MAJOR_VERSION}-${JAVA_MAJOR_VERSION}.tar
  PUSH_IMAGE_LATEST: ${CI_REGISTRY_IMAGE}/${TOMCAT_FULL_VERSION}/${JAVA_FULL_VERSION}:latest

.template_tomcat_8_5_jdk7_variables: &template_reference_tomcat_8_5_jdk7_variables
  TOMCAT_MAJOR_VERSION: "8"
  JAVA_MAJOR_VERSION: "7"
  <<: *template_reference_image_tag_variables

.template_tomcat_9_0_jdk8_variables: &template_reference_tomcat_9_0_jdk8_variables
  TOMCAT_MAJOR_VERSION: "9"
  JAVA_MAJOR_VERSION: "8"
  <<: *template_reference_image_tag_variables
  \end{minted}
\end{frame}

% fragile cause contains verbatim
\begin{frame}[plain,fragile]
  \frametitle{YAML Template Example - Usage}

  \begin{multicols}{2}
    \begin{minted}[
        fontsize=\tiny,
        breaklines,
      ]{yaml}
job_build_8_5_jdk7:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_8_5_jdk7_variables
  <<: *template_reference_build

job_build_9_0_jdk8:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_9_0_jdk8_variables
  <<: *template_reference_build
    \end{minted}
    \hrule
    \begin{minted}[
        fontsize=\tiny,
        breaklines,
      ]{yaml}
job_test_8_5_jdk7_goss:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_8_5_jdk7_variables
  <<: *template_reference_test_goss
  dependencies:
    - job_build_8_5_jdk7
    \end{minted}
    \vfill\null
    \columnbreak
    \begin{minted}[
        fontsize=\tiny,
        breaklines,
      ]{yaml}
job_test_9_0_jdk8_goss:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_9_0_jdk8_variables
  <<: *template_reference_test_goss
  dependencies:
    - job_build_9_0_jdk8
    \end{minted}
    \hrule
    \begin{minted}[
        fontsize=\tiny,
        breaklines,
      ]{yaml}
job_push_8_5_jdk7:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_8_5_jdk7_variables
  <<: *template_reference_push
  dependencies:
    - job_build_8_5_jdk7

job_push_9_0_jdk8:
  variables:
    <<: *template_reference_common_variables_docker_dind
    <<: *template_reference_tomcat_9_0_jdk8_variables
  <<: *template_reference_push
  dependencies:
    - job_build_9_0_jdk8
    \end{minted}
  \end{multicols}
\end{frame}

\end{document}