Deep Dive
Why did Marc Boorshtein's team initially struggle with implementing Docker containers in 2015?
The implementation was a cluster, and they decided not to touch Kubernetes until they could use a managed service.
What was the primary reason for the move to Kubernetes in 2021?
The team needed to move to Azure, and once on Azure, they felt ready to adopt Kubernetes as a managed service.
How did the team automate their monitoring and infrastructure updates?
They used Azure DevOps to automate builds, deployments, and monitoring, with a Rube Goldberg-like system that included webhooks and automated testing.
Why did the team switch to GitOps?
They needed to maintain configuration manifests between two different clusters for redundancy, and GitOps allowed them to manage this more efficiently.
What challenges did the team face when integrating with Azure AD for SSO?
Azure AD required going through the public internet for authentication, which conflicted with security policies, and they had to create an email forwarding service to handle external users.
How did the team handle email forwarding for external users in Azure?
They ran an email forwarding service in a container within their Kubernetes cluster, forwarding emails through AWS SES to avoid being blocked by email providers.
What is the next major project for the team's infrastructure?
They plan to convert OpenUnison configurations to use CRDs dynamically, move to the External Secrets Operator, and revamp their user interface using React and Material Design.
Why did the team choose Argo for GitOps over Flux?
Marc Boorshtein prefers Argo because of its GUI features, which he finds more user-friendly for enterprise use.
What was the impact of COVID on the team's identity infrastructure?
COVID accelerated the need for identity infrastructure as work-from-home became prevalent, highlighting the importance of SSO and cloud-based identity solutions.
How did the team handle security vulnerabilities in Azure?
They were mostly insulated from Azure-specific vulnerabilities because they didn't use the services that were affected, but they did face challenges with log4j due to their Java-based systems.
Shownotes Transcript