3 ms·

Full-disclosure: I’m a Consulting Architect for Red Hat focused on OpenShift. No. In Kubernetes and OpenShift you can control whether builds and deployments a

by oso2k 8y ago

Full-disclosure: I’m a Consulting Architect for Red Hat focused on OpenShift. No. In Kubernetes and OpenShift you can control whether builds and deployments are automatic or manual, & which events triggers them [0][1]. Combined with fact that each application’s config is an independent object, this allows an admin to host hundreds of apps on a single cluster node. Usually you’re using IaC practice and storing each app’s config in a git repo or next to the app in git. [0] https://docs.openshift.com/container-platform/3.9/dev_guide/builds/triggering_builds.html https://docs.openshift.com/container-platform/3.9/dev_guide/... [1] https://docs.openshift.com/container-platform/3.9/dev_guide/deployments/basic_deployment_operations.html https://docs.openshift.com/container-platform/3.9/dev_guide/...

snuxoll 8y ago
OpenShift has an answer to what GP was asking, but build triggers are not it. Security vulnerabilities in images is the concern, OpenShift handles this through ImageStream('s) - parent images are tracked in the integrated registry and when one is updated all dependent images are updated. Good example, the dotnet image in our OpenShift cluster was updated late last week - all of our .Net Core projects were automatically rebuilt with the latest image with no intervention from the developers. It doesn't handle your application INSIDE the container, or if you build the image yourself via Dockerfile so you'll still need some dependency scanning tools and/or release notifications to keep your own stuff up-to-date and secure. To be honest ImageStream is one of the best value-add features OpenShift has over vanilla Kubernetes, I don't have to worry if developers are keeping their images up-to-date when some vulnerability in a CentOS package or application runtime gets patched.
- erikb 8y ago
  Kubernetes itself is not a PaaS though. It won't do all of that for you, which has the advantage of being more flexible but the disadvantage that nothing happens if you don't code it.

by oso2k 8y ago

snuxoll 8y ago

OpenShift has an answer to what GP was asking, but build triggers are not it. Security vulnerabilities in images is the concern, OpenShift handles this through ImageStream('s) - parent images are tracked in the integrated registry and when one is updated all dependent images are updated. Good example, the dotnet image in our OpenShift cluster was updated late last week - all of our .Net Core projects were automatically rebuilt with the latest image with no intervention from the developers. It doesn't handle your application INSIDE the container, or if you build the image yourself via Dockerfile so you'll still need some dependency scanning tools and/or release notifications to keep your own stuff up-to-date and secure. To be honest ImageStream is one of the best value-add features OpenShift has over vanilla Kubernetes, I don't have to worry if developers are keeping their images up-to-date when some vulnerability in a CentOS package or application runtime gets patched.

erikb 8y ago
Kubernetes itself is not a PaaS though. It won't do all of that for you, which has the advantage of being more flexible but the disadvantage that nothing happens if you don't code it.