up a Kubernetes Cluster Part 2: Fork the Sock Shop Repository Part 3: Setup CI and Connect a Container Registry Part 4: Let’s Get Started with GitOps Further Resources 11 14 21 23 integration tool kicks off unit tests that eventually build the Docker image that gets pushed to the container registry. With a typical CI/CD pipeline, Docker images are deployed using some sort of bash CONTINUOUS INTEGRATION CONTINUOUS DEPLOYMENT Write Code VCS Code Base Unit Tests Integ Tests Container Registry DEPLOY eBook 8 Security and the Typical CI/CD Pipeline How secure is the typical CI/CD

服务能力 处理服务 告警服务 检测服务 日志服务 告警通知 告警收敛聚合 故障自动处理 告警人工工单 静态阈值 动态阈值 日志分析 日志检索 指标服务 指标组合 指标管理 IT监控功能示例 Apache监控 Nginx监控 MySQL监控 故障自愈功能示例 3、自动化运维的演进路径 手工操作 无人值守 脚本自动化 web自动化 调度自动化 作业平台 跨系统流程编排服务

GITOPS？ GitOps 是为云原生应用程序实施持续部署的一种声明方式。您可以使用 GitOps 创建可重复进程，用于在 多集群 Kubernetes 环境间管理 OpenShift Container Platform 集群和应用程序。GitOps 以快速的速度处 理和自动化复杂部署，节省部署和发行周期期间的时间。 GitOps 工作流通过开发、测试、临时和生产环境来推送应用程序。GitOps Red Hat OpenShift Container Platform 中，以及 Red Hat OpenShift Container Platform 的好处，以及 Red Hat Enterprise 支持、质量保证并专注于企业安全性。 注意 注意 因为 Red Hat OpenShift GitOps 的发行节奏与 OpenShift Container Platform 不同，所以 Red 此，ArgoCD 可让您提供全局自定义资源，如用于配置 OpenShift Container Platform 集群的资源。 2.1. 主要特性 Red Hat OpenShift GitOps 可帮助您自动执行以下任务： 确保集群具有类似的配置、监控和存储状态 对多个 OpenShift Container Platform 集群应用或恢复配置更改 将模板配置与不同环境关联 在集群间（从调试到生产阶段）推广应用程序。

Test Security Checks Release Deploy Stage Deploy Prod OpenShift Build Automate building container images using Kubernetes tools OpenShift Pipelines Kubernetes-native on-demand delivery pipelines OpenShift Builds 12 Automate building container images using Kubernetes tools GENERAL DISTRIBUTION 13 OpenShift Builds A Kubernative-native way to building container images on OpenShift which is portable with microservices and distributed teams in mind OPENSHIFT PIPELINES Containers Built for container apps and runs on Kubernetes Serverless Runs serverless with no CI/CD engine to manage and

components Handles Custom Resources Handles actual traffic Can be standalone or sidecar Other Container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd Istio Operator istio-operator Multicluster First Demo About GitOps Second Demo What’s next? Control Plane Data Plane istiod Some container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd DestinationRule ServiceEntry Multicluster First Demo About GitOps Second Demo What’s next? Control Plane Data Plane istiod Some container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd DestinationRule ServiceEntry

many open-source communities that made it what it is today. Kubernetes brings much-needed container orchestration capabilities like: • Automated rollouts and rollbacks of deployments • Service continuous integration tool kicks off unit tests that eventually build the Docker container image that gets pushed to the container registry. Figure 1 BROUGHT TO YOU IN PARTNERSHIP WITH REFCARD | GITOPS KUBERNETES REFCARD | SEPTEMBER 2022 6 With this typical CI/CD push-based pipeline, Docker container images are then deployed to the actual cluster using some sort of bespoke bash scripts or through

Kubernetes [1.5] container platform, in particular, has fostered a whole new way of thinking about application deployment, because con- figuration files are used to declare the creation of container instances the Agile Manifesto changed the game for developers and administrators, Kuber- netes and other container technologies have changed the game for DevOps practi- tioners. The ways in which Kubernetes and autohealing. Kubernetes can achieve autohealing because containers are fungible and immutable. A container can be restarted or scaled at will, making it easy to manage workloads in this model. It is important

and allow for all traffic (ingress and egress) to flow through them before reaching or leaving a container. This greatly improves security as bad actors cannot easily hide their actions from the sidecar sidecar model is, because it is injected alongside and not inside a container, you can independently update the sidecar or the container. The second benefit is that sidecars are injected automatically,

Repository 分⽀策略、Flow、Workflow 7. Agile & Iteration ⼩粒度、多迭代 Tools VCS CI CD Container Registry CM IaC Container orchestration Yes Yes Yes Yes 透過 Runner 間接運⽤ 透過 Runner 間接運⽤ 可整合 Photo

Service) Serverless ≈ CaaS + BaaS 用户运维 Serverless 介绍 Physical Machine vs. Virtaul Machine vs. Container vs. Serverless Hardware Virtualization O/S Containers Runtime Applications Functions Physical Virtual Machine Hardware Virtualization O/S Containers Runtime Applications Functions Container Hardware Virtualization O/S Containers Runtime Applications Functions Serverless Hardware