Challenges of Infrastructure as Code Containers Change the Game Argo CD Flux Open Cluster Management Other GitOps Tools PipeCD Keptn Pulumi Kubernetes Operator GitOps CI and CD Can Be Decoupled Integrating Synchronous and Asynchronous Tools CI Managed Benefits Drawbacks CI Owned and CD via GitOps Benefits Drawbacks refined way to manage configurations and declare the state of everything in a given Kubernetes cluster called GitOps is something that Christian embraced wholeheartedly. Fast forward again to 2020,

and pull-requests” GitOps Benefits 5 GitOps is for Everyone Developers Operations Kubernetes Cluster Node 1 Kubernetes (K8s) is an open-source system for automating deployment, scaling, and management applications OpenShift and GitOps - A Perfect Match ● OpenShift is a declarative environment ○ Cluster configuration is declared and Operators make it happen ○ Application deployments are declared and environment minimizes or eliminates this need ● Declarations are yaml files which are easily stored and managed in git OpenShift GitOps Principles ● Separate application source code (Java/.Net/etc) from manifests

deploy both application and infrastructure changes to Kubernetes. With the entire state of your cluster kept under source control, diff tools and synchronization agents can compare what’s running in two, an alert can be sent, effectively creating a feedback and control loop for managing your cluster. PRINCIPLES OF GITOPS GitOps is based on several core tenets: DECLARATIVE DESCRIPTION Thanks your desired state in Git results in system instability for your actual state present in the cluster. For example, let’s say you have stored your current system state with version number 1.0.0 (semantic

request Specifically for Kubernetes, GitOps says that you must not use `kubectl` to change the cluster state in an ad hoc manner. Instead, the desired state should be defined within GitOps tools at any on the deployment part of an application and nothing else. They solve the “I want to put in my cluster what is described in Git” problem, but all other aspects of software development are NOT covered: Git repository and takes care of the actual deployment by pulling changes in your cluster (and thus making the cluster state the same as the Git state). This scenario is great in theory and is certainly

published by the GitOps Working Group: The desired state of a GitOps managed system must be: 1. Declarative A system managed by GitOps must have its desired state expressed declaratively infrastructure and application configuration in the repository to detect when the Kubernetes cluster resources should automatically update based on config changes. GitOps Operator Infrastructure checks to ensure optimal performance and security. Push vs. Pull-Based Architecture Kubernetes Cluster Git Repository Bi-Directional gRPC Developer gRPC REST API | 09 3 KEY ELEMENTS FOR YOUR

continuous deployment through the tools they work in everyday. Changes are automatically applied to the cluster once a Pull Request is approved and merged. Changes are handled by reconcilers that look for discrepancies the Git repo and reconcile any changes or divergences from inside the cluster. 1 3 2 4 GitOps doesn’t require cluster credentials or manual intervention to make a change to the system. As a fork in the case of a catastrophic event. Meet compliance requirements Build an audit log of all cluster changes and attribution that meets SOC 2 compliance just by using Git. Standardize workflows

verified by your peers and automatically tested before it is deployed. Your platform should not be managed by one single person. It’s a bad idea to have one person who deploys code without anyone else knowing manual changes to production - changes can only be applied through a reviewed change in Git. In the cluster, in the infrastructure, in your identity service, you do everything in Git. Drift detection doesn’t these configurations and to introduce controls through pull requests. The result is a standard cluster development platform that spans environments with security guardrails and a common set of cloud-

of Privileges 03 04 05 06 07 10 GitOps Hands On Tutorial Part 1: Spin up a Kubernetes Cluster Part 2: Fork the Sock Shop Repository Part 3: Setup CI and Connect a Container Registry and rolled back to and from Kubernetes. And even more importantly, when disaster strikes, your cluster’s infrastructure can also be dependably and quickly reproduced. --------------- --- The canonical be automatically applied to your system. What’s significant about this is that you don’t need cluster credentials to make a change to your system. With GitOps, there is a segregated environment that

into some cluster ● Tweak some simple configuration ● Add / remove offerings you are keen to test and see in action ● Add custom configuration on top of simple setup ● Install in cluster with other Multicluster First Demo About GitOps Second Demo What’s next? @rytswd Proof of Concept ● Install in cluster with other business applications, where there is some specific limitation, security requirements what business requires ● Break, debug, pinpoint, and fix Getting Started ● Install into some cluster ● Tweak some simple configuration ● Add / remove offerings you are keen to test and see in action

Familiar tools and Git workflows from application development teams Standard Workflow Multi-cluster consistency 7 Source Git Repository Image Registry CI The GitOps Application Delivery Model Kubernetes-native on-demand delivery pipelines OpenShift GitOps Declarative GitOps for multi-cluster continuous delivery Ecosystem Integrations OpenShift GitOps 11 OpenShift Builds OpenShift GitOps Declarative GitOps for multi-cluster continuous delivery 27 OpenShift GitOps Declaratively manage cluster and application configurations across multi-cluster OpenShift and Kubernetes infrastructure