大卫Sumsky

客户需要生产就绪, scalable Kubernetes infrastructure to host a mobile application API layer. 它运行在由Terraform模块提供的AWS EKS服务上，并通过Terraform企业平台交付.

Based on load-testing performed with Artillery and performance metrics analysis, the infrastructure was tuned with cloud-native auto-scaling, 水平吊舱缩放, and cluster over-provisioning to mitigate cluster auto-scaling latencies. Further recommendations were given on how to optimize the application itself.

Finally, 我们改进了CircleCI CI/CD管道(为应用程序提供Docker镜像)，实现了Docker镜像漏洞扫描和Dockerfile检测，以提高基础设施的整体安全性.

客户需要一种解决方案，该解决方案可以根据最佳实践和建议的护栏快速设置多账户AWS环境. It provided a baseline configuration to get started with a multi-account architecture, identity, 访问管理, governance, 数据安全, 网络设计, and logging. 该解决方案克服了以前基于多租户帐户的AWS解决方案的局限性.

该环境是一组相互连接的AWS帐户，托管应用程序和工具，具有以下设置:
• AWS VPC with the network setup including VPC Peering connections, subnets, SGs and NACLs
• AWS CloudTrail and Config with visibility into users and resources activity
• AWS IAM with a set of roles and policies and identity federation
• AWS Organizations to manage accounts creation and their cost
•与第三方工具(如obvious)集成.Okta的云健康公司
• Centralized shipping logs to a central logging account
•应用程序配置界面
•资源标记

框架的特点:
• Scalable and delivers an environment in a few minutes
• Automated with Sceptre, AWS CloudFormation, Python/Boto 3, and Jenkins pipelines
•遵循IaC模式
•可复制和可扩展

To increase the stability of multi-account AWS environments, 客户需要一个测试框架，在将新设置的环境交付给最终用户之前对其执行冒烟测试.

The framework is based on AWS Lambda and Step Functions services, 是谁策划了烟雾测试的执行. A smoke test is represented by a CloudFormation template, which is declaring execution of related "atomic" tests (e.g., 通过HTTP代理访问互联网, VPC内的连通性, AWS CloudTrail/VPC Flow日志事件, 允许所需连接的安全组, and more).

当从模板创建堆栈时, 启动一个AWS EC2实例, or an AWS Lambda function is invoked to initiate smoke testing. 测试结果由CloudFormation信号和测试依赖项报告，其状态由AWS步骤函数驱动. Notifications are sent to SQS queues, processed, and forwarded to Slack channels.

框架的特点:
•完全无服务器
• Automated with AWS CloudFormation, Step Function, Lambda, and Python/Boto 3
• Plugged into multi-account AWS environment delivery pipelines

客户需要一个合适的配置管理系统来简化AWS云中基于Linux和windows的应用程序部署.

When the evaluation phase was finished and SaltStack was chosen, 客户需要构建一个可以在每个云环境中运行的高弹性的SaltStack基础设施. 基础设施在主模式和无主模式下管理数千个盐仆从/EC2实例.

整个基础设施提供了
•高度可用的SaltStack主机的自动化
• Standardized provisioning and configuration of salt minions on EC2 instances
•自定义状态、执行和支柱模块

基础设施使用AWS CloudFormation和Python/Boto 3实现自动化，并利用AWS的EC2等服务, ASG, S3, 和DynamoDB.

客户需要一个全面的AWS服务限制和使用情况监控和报告工具. 本机AWS工具(如Trusted Advisor)提供AWS限制的子集，并且只提供每周警报.

该解决方案基于一组用Python编写的AWS Lambda函数，通过“awslimitchecker”工具监控AWS服务限制. This tool takes care of hard-coded limits, API-based limits and data from Trusted Advisor.

它提供了:
•更细粒度的警报
•基于AWS sns的警报
•限制跟踪AWS DynamoDB数据后端
• Automatic support cases opening to increase some limits

客户需要一个定制的解决方案来构建Linux黄金映像并将其分发到客户的云环境中.

The solution defines automated build process of AMIs for CentOS and OEL which includes:
•自定义系统和服务配置
•安装预定义的和自定义的软件包
•安装安全补丁
•基于CIS基准的安全加固
•安装ENI驱动程序
•生成HVM/PV ami
• AMIs distribution from the build environment to the rest of the environments

整个过程是通过SaltStack和Jenkins管道自动化的，其中任何代码更改提交都会触发一个dry-run构建来验证构建过程. Once a month, a full build is executed to build new AMIs and to distribute them.

客户需要我们在AWS中设计并实现一个基于java的中间件系统的云就绪自动部署，该中间件系统运行在Windows和Linux上.

最终的解决方案定义:
•基于AWS CloudFormation的基础设施即代码
•基于AWS自动伸缩组和具有深度健康检查的弹性负载平衡器的高Availability和可扩展基础设施
•安装和配置过程是抽象的SaltStack和一组PowerShell脚本
• Patches and updates are distributed with AWS CodeDeploy
• Logging and monitoring facilities are integrated with Sumo Logic