Cloud Foundry Summit Europe 2017

Do you love how simple and easy it is to push your application to Cloud Foundry but want to know what really happens to your app instances under the hood? Do you operate a Cloud Foundry deployment and need to understand how all its different components work together to keep applications running?

After years of development, Diego has now replaced the previous DEA system as the official container runtime at the heart of Cloud Foundry, capable of managing even the largest CF deployments. In this talk, the project lead for the Diego team will survey how the Diego components interact inside of CF to run application instances and tasks and then dive into how those interactions have evolved over the past year to improve system stability, security, and scale. This talk will also review how recent work in Diego supports powerful platform features such as isolation segments, zero-downtime application updates, and application-identity TLS certificates, how to use tooling such as the CF Diego Operator Toolkit ("cfdot") to inspect the app instances and CF components in a deployment, and other features that the core Cloud Foundry teams are working on or considering for development today.

After attending this talk, you'll be ready to operate your Diego-supported CF deployment with confidence and to take advantage of the powerful features it provides for your users and their applications.

Welcome to the Cloud Foundry community! This talk is designed for people who are new to the Cloud Foundry community or existing community members who haven't come in contact with core developers and the development practices of Cloud Foundry.

Cloud Foundry is proudly open source, and our open source contribution model is a little different from most other open source projects. In this talk, you'll learn about how the Cloud Foundry teams are structured, how they operate, and what a day in the life of a Cloud Foundry core developer looks like. Even if you don't plan to get involved with core development yourself, this talk will help you understand the perspective and terminology of the developers and product managers you may be interacting with. If you do plan on getting involved with core development, this talk will serve as an overview and introduction of what to expect when joining a team or making a pull request.

The Garden Windows team has been working hard to bring Windows Server Containers to Cloud Foundry. We'll be providing an update on our progress in implementing Windows Server Containers support, and discuss the architecture of this implementation. We'll assess the new file-system and network isolation provided by Windows Server Containers, and cover some of the differences between Windows Server 2012R2 "containers" and the Windows Server Containers offered in Windows Server 2016. We'll also touch on the concept of HyperV isolation, which is new in Windows Server 2016.

Is your network admin losing sleep over whitelisting your entire deployment? Worried about public routes to your backend apps? Can’t tell which application is hammering your production database?

Worry no more! Cloud Foundry has a brand new container networking stack, that enables application level policies and direct container-to-container communication. Join us for an overview of the new feature set and the use cases it solves. See it how it works through a demonstration and learn about where we plan to go next.

Cloud Foundry supports a rich ecosystem of plugins and extension points at various levels of the stack. This modularity enables rapid development and deployment of new features. Garden-runC, the Linux container engine used by Cloud Foundry, adopted this kind of modular philosophy by introducing new exciting forms of extensibility in its core.

In this talk, members of three core engineering teams (Garden, GrootFS, and Container Networking) will introduce the APIs that enable pluggable filesystems and networking stacks, including support for the industry-standard Open Container Initiative (OCI) image format and the Container Networking Interface (CNI) specification. With these extension points, Cloud Foundry users and operators gain access to a rapidly-growing ecosystem of 3rd party features which can enable new use cases for the platform.

The benefits of using BUCC (BOSH, UAA, Credhub and Concourse) will be demonstrated, by creating a real world concourse pipeline to deploy a production Cloud Foundry, using the cf-deployment repository. Topics which will be discussed include: cloud-config, config-server, credhub, Concourse Credhub integration, variables in deployment manifests.

Do you want to learn more about the Cloud Foundry Runtime PMC? Dieu will give an overview of the 17 projects in the PMC, and briefly describe how they coordinate to ship compatible combinations of releases underlying the core of Cloud Foundry. Additionally, Dieu will give an overview of recent accomplishments and upcoming areas of investment in Developer Happiness, Security, Performance, and Stability.

Cloud Foundry UAA has been continually expanding its horizons to secure not just the core CF platform but also Apps and APIs running on and off the platform. In this talk we will start off with a brief overview of UAA in the CF ecosystem followed by feature highlights including:

OpenID Connect Enhancements:
Multiple enhancements around OpenID Connect have been introduced for UAA as an Identity Provider and Relying Party including support for discovery profile, custom user claims in id_token and /userinfo , account chooser, authentication method reference and much more.

Keys and Secrets Rotation:
At last year’s CF Summit Justin Smith introduced his vision for Cloud Native Security with three R’s(https://www.youtube.com/watch?v=NUXpz0Dni50). Now UAA supports canary style rotation of signing keys and OAuth clients secrets and will soon add support for rotation of SAML Keys.

Opaque Tokens:
UAA since its inception has supported JSON Web Tokens which has the advantage of offline validation. However with the the addition of stateful opaque tokens UAA now supports on-demand token revocation.

In addition to this we will also provide a sneak peek of the UAA roadmap with features like Multi-Factor Authentication, additional token exchange flows and fine grained authorization support.

The Buildpacks Team just wrapped work on multiple buildpack support and we want to share the good news!

This latest Cloud Foundry feature allows applications to leverage a mixture of different technologies in one `push`, permitting strategic use of multiple languages in one app or app-embedded additional processes. This will come as welcome news to users interested in building apps of this type in the future, or to users who already have but had to switch to Docker containers or custom buildpacks to achieve these ends.

Attend this talk if you’d like to learn more about what multi-buildpacks do under the hood, how they differ from their predecessor the multi-buildpack buildpack, or where this feature might come in handy in the future. As an added bonus for the uninitiated, we’ll even provide a bit of insight into what exactly happens when you `cf push`. Appropriate for all experience levels.

Are you reluctant to share traffic across your applications? Is compute layer isolation not enough? Cloud Foundry’s newest feature, routing isolation segments are here to protect your apps.

Swetha and Shash will demonstrate how to secure apps' traffic through routing isolation segments and better guide operators on how to effectively set up their preferred IAAS to completely isolate application traffic. They will demonstrate how this feature will guard against header spoofing and other attacks.

This talk will introduce the BOSH team’s latest and greatest tool for bootstrapping BOSH to any target infrastructure - bosh-deployment - and will ask the perennially toughest question once more: is bootstrapping BOSH incredibly simple yet?

This session will highlight how to apply Site Reliability Engineering practices to operating the Loggregator system. In addition to promoting a new Loggregator playbook (work in progress) this presentation will walk through the process the Loggregator team used to define and measure service level indicators. It will also build on Adam's previous talk about improving message reliability and help Operators define Service Level Objectives for their development teams that makes sense.

We’ve made some great strides in CF Volume Services since our last EMEA talk in October.

We’ll start with a quick reminder of what Volume Services support means, and how it works in CloudFoundry. We will then highlight some of the new support we’ve added, including:
- Support for existing NFS shares, with userapp mapping to control app identity on the NFS server
- Support for LDAP authentication
- Support for Volume Services in PCFDev for easy ramp-up
- Easier deployment of volume drivers using BOSH runtime-configuration and BOSH operations
- Dell EMC Elastic Cloud Storage (ECS) service broker support for volume services & BOSH deployment of ECS Community Edition.

Finally we’ll do a 0-60 live demo showing how easy it can be to get started with shared filesystems in your own CF applications.

Have you ever spent all day trying to deploy open source Cloud Foundry and thought there must be a better way? Want to deploy Cloud Foundry from scratch in no time as the core development teams do? Core CF teams have been enjoying a new world where they don’t have to waste days figuring out how to manually deploy BOSH and CF. Now Christian and Angela want to share it with you! In the past year, major inroads have been made to create new tools that automate much of the process of deploying BOSH and CF. Using new tools, BOSH-Bootloader, BOSH 2.0 and CF-Deployment, developed and used by core Cloud Foundry teams, attendees will learn how to deploy Cloud Foundry in an automated, reproducible, and user-friendly way!