Search

CERN hosts more than 1200 websites essential for the mission of the Organization, both for internal and external collaboration and communication, as well as public outreach. The complexity and scale of CERN’s online presence is very diverse with some websites, like home.cern, accommodating more than one million unique visitors in a day. However, regardless of their diversity, all websites are created using the Drupal content management system (CMS), and are self-hosted directly in the CERN Data Center on a dedicated infrastructure that runs on Kubernetes. Workflows like provisioning, deleting, cloning, upgrading, and similar are fully automated and managed by a customized Kubernetes controller. By leveraging the custom controller, the infrastructure has proven highly reliant with minimal, manual intervention necessary. In order to further automate deployments and improve governance, a customized version of Drupal called the CERN Drupal Distribution is implemented. Supported by end-to-end integration tests and automated browser simulation, this setup enables the propagation of security and feature updates seamlessly to all websites without any downtime. This paper outlines the architecture which allows building, testing, and distributing updates to a large number of websites without any downtime. Furthermore, it presents experiences and learnings from managing such a service at CERN with limited resources.

The infrastructure behind home.cern and 1000 other Drupal websites serves more than 15,000 unique visitors daily. To best serve the site owners, a small engineering team needs development speed to adapt to their evolving needs and operational velocity to troubleshoot emerging problems rapidly. We designed a new Web Frameworks platform by extending Kubernetes to replace the ageing physical infrastructure and reduce the dependency on homebrew components. The new platform is modular, built around standard components and thus less complex to operate. Some requirements are covered solely by upstream open source projects, whereas others by components shared across CERN’s web hosting platforms. We leverage the Operator framework and the Kubernetes API to get observability, policy enforcement, access control and auditing, and high availability for free. Thanks to containers and namespaces, websites are isolated. This isolation clarifies security boundaries and minimizes attack surface, while empowering site owners. In this work we present the new system’s open-source design contrasted with the one it replaces, demonstrating how we drastically reduced our technical debt.