and Security Summary 25 Chapter 5–Repository and Directory Structures Best Practices DRY Parameterize Where You Need To Repository Considerations Monorepo Polyrepo workflow. Continuous integration builds and tests new code changes and merges them into a shared repository on a regular basis. CI is a form of rapid development that emerged as a result of the Agile Manifesto commit directly to your state store or to mark that the change is ready for deployment in a Git repository. In other Chapter 1 – What is GitOps? The Path to GitOps | 13 words, if you’re in GitHub [1

instead of a deployment. The Git commit is picked up by a deployment solution that monitors the Git repository and takes care of the actual deployment by pulling changes in your cluster (and thus making the want to promote a release to one after the other. What is the GitOps solution? ● A single repository with 10 branches. This means that you need to open/close 10 pull requests each time you do a copies commits between the repositories (or uses Pull Requests between them). ● A single Git repository with 10 subfolders. Again you need an external solution to make sure that changes are propagated

10 GitOps Hands On Tutorial Part 1: Spin up a Kubernetes Cluster Part 2: Fork the Sock Shop Repository Part 3: Setup CI and Connect a Container Registry Part 4: Let’s Get Started with the cluster Runs outside the production cluster Read access to the code repository Read/Write access to container repository Read/Write access to the continuous integration environment Runs inside inside the production cluster Read/Write access to configuration repository Read access to image repository Read/Write access to the production cluster GitOps separates CI from CD and is a more secure

process. Simply: Add the infrastructure code into the Git repository. 1. Configure the CI/CD pipeline to include the infrastructure repository as a part of the delivery 2. pipeline. On the other hand from scratch, the first thing to consider is the Git repository. As GitOps is platform-agnostic, users can utilize any local or cloud-based Git repository such as: GitHub BitBucket Azure Repos GitLab Etc preferred and familiar platform tools. Tools like Jenkins and CircleCI can be used with any git repository. BitBucket Pipeline and GitLab Pipelines prefer their own code repositories. Whatever the selected

Multi-cluster consistency 7 Source Git Repository Image Registry CI The GitOps Application Delivery Model 8 Source Git Repository Config Git Repository Image Registry Kubernetes CI CD The Push Pull Push Pull Pull Request 9 Source Git Repository Image Registry CI The GitOps Application Delivery Model Config Git Repository Kubernetes Deploy Monitor Detect drift Take action Integrations OpenShift GitOps 11 OpenShift Builds OpenShift Pipelines Source Git Repository Config Git Repository Image Registry Kubernetes The GitOps Application Delivery Model on OpenShift Pull

application code. In GitOps, the desired state of the system is versioned and stored in a Git repository, and a reconciliation loop continuously monitors and enforces that desired state. GitOps takes operator, or agent, to evaluate both the infrastructure and application configuration in the repository to detect when the Kubernetes cluster resources should automatically update based on config ensure optimal performance and security. Push vs. Pull-Based Architecture Kubernetes Cluster Git Repository Bi-Directional gRPC Developer gRPC REST API | 09 3 KEY ELEMENTS FOR YOUR GITOPS STRATEGY

your declarative configuration files and application code should be stored together in the Git repository. This is what we call the “desired state of your system”. Once you deploy all of this into simple: The auditor can analyze the desired state by observing and focusing on the source code repository. They can also determine the current state of the system by reviewing the underlying infrastructure entire environment and components we would have present are declaratively defined in our Git repository. So disaster recovery in case of such events becomes as easy as simply reapplying the configuration

DevOps 講師 2 GitOps •雲原生 Continuous Deployment •所有部署都使用聲明式(declarative)腳本 •所有部署環境yaml皆存放至Git repository 3 GitOps •所有對環境的調整，皆應由調整Git repostiroy來進行觸發 •需確保環境與Git上的腳本為一致 4 GitOps優點 •可以經由git commit •https://github.com/demoyuw/k8s-summit- cd-repository.git •Git clone https://github.com/demoyuw/k8s-summit- cd-repository.git •cd k8s-summit-cd-repository 9 10 kustomization.yaml 定義四個類別 •resources:

infrastructure and/or application state is fully represented by the contents of a git repository. Any changes to the git repository are reflected in the corresponding state of the associated infrastructure and the app in a declarative manner ● Application definition includes: ○ Name ○ Cluster ○ Git repository ○ Synchronization Policy ● Applications can be deployed from Argo CD GUI or CLI (argocd or /taxi-config-test.git /taxi-config-prod.git /taxi-config-dev.git /taxi.git Approach 2 : Single Repository ├── apps │ └── app-1 │ ├── base │ │ └── kustomization.yaml │ └── dev │

Pipeline GitLab Runner 執⾏ Job CI Job 回傳 Logs 顯⽰於 Pipeline Terraform Ansible Cloud Vault Repository Cloud Cloud App Infra GitLab Runner 1. App 有更新嗎？ 2. infra 有更新嗎？ 3.有！執⾏異動！ Worker Build GitOps 1. IaC 2. Automation 3. Code Review & Approve 4. Multi environment 5. CI/CD 6. Use Repository 7. Agile & Iteration DevOps 1. IaC 讓⼀切都成為 Code 2. Automation 盡可能⾃動化 如果不成，就紀錄它！ 3. Code Code Review & Approve 審查、複閱、檢查、稽核 4. Multi environment 運⽤在所有的環境！ 5. CI/CD ⾃動化的唯⼀觸發點！ 6. Use Repository 分⽀策略、Flow、Workflow 7. Agile & Iteration ⼩粒度、多迭代 Tools VCS CI CD Container Registry