IPF Containerization Service Selection Guide.docx

UNCLASSIFIED

IPF Containerization Service Selection Guide Purpose The purpose of this guide is providing high level information about the containerization service options available within the NGA/AWS Cloud environments and use cases that support each strategy.

Goal The goal is to help the key decision makers determine the best containerization strategy for their container-based solutions within their cost, schedule and performance constraints.

CORE OpenShift (KubIC):

KubIC ("Kubernetes for the IC") is NGA CORE's Platform-as-a-Service (PaaS) offering for the development and deployment of enterprise mission applications. The service is based on a cloud instantiation of RedHat's OpenShift Container Platform (OCP) managed by TEGM. OCP is a container orchestration platform based on Kubernetes to build, deploy, and manage applications at scale. Because KubIC acts as a Common Control Provider (CCP), mission owners can accelerate authorization to deploy their application(s) by inheriting security controls from the platform as required by NGA's Assessment & Authorization (A&A) process. Certain applications may also be eligible for TESR's ATO in a Day (AiaD) program to further streamline the A&A process.

Use case:

· Developer have an application/microservice they’d like to containerize within the NGA/AWS cloud environment, but they don’t want to manage AWS resources and/or you don’t have an AWS account. With NGA’s PaaS OpenShift offering, managing resources is done in the KubIC environment.

· Developer wants to speed up the path to ATO. Utilizing OpenShift within KubIC offers a path to ATO in a Day (AiaD) by assuming security controls already in place.

· Developer would like to expand their CORE footprint/compliance to better align with NGA’s Software Way. OpenShift is a part of the expanded CORE toolset.

· Developer wants to accelerate the containerization deployment and CI/CD process. NGA CORE team provides approved base containers and Gitlab CI/CD templates that are customed to its OpenShift deployment.

Things to consider:

· Getting familiar/onboarded with KubIC/OpenShift and best practices within the environment can be cumbersome and frustrating. KubIC does provide a lot of documentation, but sometimes that documentation may not be up to date, and steps can be confusing.

· Even though the KubIC/OpenShift environment is a PaaS, it is not free. Some research needs to be done on the front end to estimate costs using the KubIC chargeback model.

· Not all applications/microservices meet the requirements for AiaD, and research will need to be done up front to see if those requirements can be met.

· Operational support is not as robust with KubIC as it is with AWS. CORE Ask and Expert channels are not efficient, and Service+ support is not mature.

AWS Elastic Container Service (ECS):

Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service that helps you easily deploy, manage, and scale containerized applications. As a fully managed service, Amazon ECS comes with AWS configuration and operational best practices built-in. It's integrated with both AWS and third-party tools, such as Amazon Elastic Container Registry and Docker. This integration makes it easier for teams to focus on building the applications, not the environment. You can run and scale your container workloads across AWS Regions in the cloud, without the complexity of managing a control plane.

Use case:

· Developer has an AWS account and they’d like to containerize an application/microservice but don’t have extensive knowledge about containerization. The AWS ECS service is designed with simplicity in mind. It is advantageous for quick deployments or when a more straightforward approach suffices vice EKS which requires a higher learning curve. Documentation is robust and complete.

· Developer would like to explore the possibility of a serverless option so they don’t have to manage resources within the environment. AWS offers the use of Fargate with ECS which is a serverless option so you don’t have to manage cloud infrastructure within the environment. It will also be more cost effective in most cases.

· Developer wants to take advantage of other AWS services within the environment while using ECS. ECS is deeply integrated with AWS services.

Things to consider:

· With ECS being based on a ‘simplicity’ approach, so there’s not much flexibility when it comes to fine-tuned control.

· ECS’s proprietary nature makes it less suited for hybrid or multi-cloud strategies which are on NGA’s roadmap moving forward.

· Benefits from strong support within the AWS ecosystem.

· ATO and cybersecurity review process will take longer.

· Operational support is more robust with Enterprise support from AWS and the NGA Cloud Operations teams. AWS support cases and NGA Service+ incident tickets have well defined SLA’s.

AWS Elastic Kubernetes Service (EKS):

Amazon Elastic Kubernetes Service (Amazon EKS) is a managed service that eliminates the need to install, operate, and maintain your own Kubernetes control plane on Amazon Web Services (AWS). Kubernetes is an open-source system that automates the management, scaling, and deployment of containerized applications.

Use case:

· Developer has an existing Kubernetes workload that they’d like to migrate into the AWS environment. A self-managed Kubernetes deployment can become quite cumbersome, and migrating to AWS EKS offers benefits like a managed control plane, security compliance, scalability, and reliability.

· Developer wants the ability to build in a hybrid and/or a multi-cloud environment, and have deeper control. Kubernetes offers high flexibility, a robust ecosystem and community, and consistent open standards, which offer extensibility and portability.

· Developer would like to explore the possibility of a serverless option so they don’t have to manage resources within the environment. AWS offers the use of Fargate with EKS which is a serverless option so you don’t have to manage cloud infrastructure within the environment.

Things to consider:

· EKS has higher operational overhead due to Kubernetes’ complexity, with a higher learning curve and deeper understanding of Kubernetes being required.

· EKS pricing includes charges for the managed Kubernetes control plane and is often more expensive than ECS.

· Better suited for more complex, microservices-oriented architectures.

· ATO and cybersecurity review process will take longer.

· Operational support is more robust with Enterprise support from AWS and the NGA Cloud Operations teams. AWS support cases and NGA Service+ incident tickets have well defined SLA’s.

Summary:

All new applications/microservices shall evaluate deployment into AWS containerization services (with or without utilizing Fargate as a serverless option) as a first choice with justification required to not develop in AWS Containers. For programs comfortable with the complexity/flexibility of EKS, utilize that service. If simplicity is preferred, utilize the ECS. It is understood that not all software solutions are well-suited for this approach and require a different containerization strategy. If an OpenShift deployment is desired, a meeting with the IPF Transition & Integration Team to discuss requirements and the benefits/drawbacks is required. IPF Transition & Integration Team written approval is required to move forward with an Open Shift Deployment or a non-containerized development. Additionally, migration of existing systems from non-container based solutions to container based solutions is desired for systems that will endure in the long term.

Resources:

CORE OpenShift ‘KubIC Quick Start’ - Here KubIC ‘ATO in a Day’ - Here Chargeback FAQ - Here AWS ECS ‘Getting started’ - Here AWS EKS ‘Getting started’ - Here