TechPrufer
Get started
Grab
Grab logoGrab · Feature trail

macOS CI/CD Infrastructure Migration

4 posts · Apr 2017 – Nov 2025

What this trail covers

Grab has evolved its CI/CD infrastructure by developing Khone, an in-house GitOps solution. Khone enhances security, simplifies user experience, and promotes the DRY principle by automating Terraform resource provisioning. It includes a multi-stage pipeline with robust validation, security checkpoints, and remote pipeline configuration to prevent tampering. The solution supports infrastructure beyond Kubernetes and has achieved 100% uptime. This post details the iOS team's approach to continuous delivery automation by migrating macOS CI/CD infrastructure from a cloud vendor to a colocation cluster in Southeast Asia, significantly reducing network latency, improving performance by 20-40%, and achieving substantial cost savings. The migration involved a progressive rollout and rigorous comparison of job failure rates, performance, and reliability between the old and new clusters.

All Grab trails
  1. Grab's Mac Cloud Exit supercharges macOS CI/CDThis post details Grab's migration of its macOS CI/CD infrastructure from a US-based cloud vendor to a colocation cluster in Southeast Asia. The primary drivers were to reduce network latency, improve performance, and cut operational costs. The migration involved a detailed cost-benefit analysis comparing cloud, colocation, and on-premises options, leading to the selection of bare-metal Mac minis in a Malaysian data center. The execution involved a progressive migration strategy, monitoring job failure rates, performance, and reliability. The results show significant performance improvements (20-40%) and projected cost savings of over $2.4 million USD over three years. The post also touches upon the challenges of macOS compute costs, Apple's EULA, and the trade-offs between virtualization and bare-metal setups.
  2. An elegant platformThis post details the evolution of Grab's data streaming platform (Coban) from a pure Infrastructure-as-Code (IaC) approach using Terraform and Atlantis to a three-tier control plane (Coban UI, Heimdall, Khone). The new system addresses the limitations of IaC by providing a user-friendly UI (Coban UI) for resource creation, a Go backend (Heimdall) to translate UI actions into IaC, and a Git repository (Khone) for storing Terraform code and CI pipelines. This enhances stability, scalability, security, and user adoption by abstracting away the complexity of IaC tools and providing a controlled self-service experience.
  3. Securing GitOps pipelinesThis post introduces Khone, an in-house GitOps solution developed by Grab's Coban team to manage infrastructure-as-code (IaC) for streaming infrastructure like Flink pipelines, Kafka topics, and Kafka Connectors. Khone replaces Atlantis by offering enhanced security through custom validation scripts and workflows, a simplified user experience, and adherence to the DRY principle by minimizing boilerplate code. Key features include a three-stage pipeline (Initialization, Terraform, Metric) with detailed security checks like code inspection using python-hcl2, resource validation based on path, and linting. It also implements remote pipeline configuration and script storage in a separate admin repository to prevent tampering, and uses a dedicated dev repository for testing.
  4. How we reduced our CI YAML files from 1800 lines to 50 linesThis post details the Cauldron ML Platform team's adoption of GitLab's dynamic child pipelines to manage complex CI configurations. They transitioned from nested child files and large, inlined CI YAML files to a dynamic generation approach. This involved using a Rust-based utility with stop patterns to parse Git diffs and template necessary stages on the fly, reducing a 1800-line CI file to 50 lines. This improved scalability, maintainability, and developer productivity by adhering to DRY principles.
  5. Deep Dive into iOS Automation at Grab - Continuous DeliveryThis post details the iOS team's approach to continuous delivery, including the setup of four build configurations (Adhoc QA, Hot Dogfood, Dogfood, Testflight) distributed via Fabric and iTunes Connect. It explains the migration away from Fastlane to custom bash scripts for archiving due to simpler needs and greater flexibility. A server-side Swift application, Irisbot, is introduced to trigger these build scripts via Slack commands, enabling self-service builds. Deployment of Irisbot is managed using Capistrano, with configurations for application, repository URL, deployment path, and linked files like config.json.