GitOpsCon North America 2022

GitOps might sound like a self-explanatory term, but it is not as easy as it sounds. Many think this just means to store your Infrastructure-as-Code in Git, then have a pipeline run the code, but it is actually much more complicated than that. True GitOps takes the deployment out of CI/CD, and the most popular solutions are using Kubernetes controllers to do all the heavy lifting. Ensure what you’ve defined in Terraform is what’s always running and available. Flux continuously looks for changes and reconciles with the desired state. Take advantage of all the benefits of GitOps: streamlined and secure deployments, quicker time to market, and more time to concentrate on app development! Pinky will provide an in-depth look at the new Flux Terraform Controller, which enables Terraform deployments to be done the GitOps Way. They’ll end with a demo of a common use case implementation.

Deploying, securing, and managing a service mesh multicluster environment can be a complex process. Furthermore, enforcing your organization’s security policies and procedures can be a challenge when you start scaling your environment when things like drift and cluster sprawl come into play. In this presentation we will go over how to manage a production Istio deployment in a secure way with policy enforcement using Argo CD and enable a Developer self service by integrating Argo Rollouts for progressive delivery.

Flux is a CNCF tool that enables users to adopt the GitOps methodology for continuous deployment. Flux reconciles your workload from different sources: Git, Helm repository, an S3 bucket, and now Flux maintainers have added support for OCI registries. Not only can Helm charts be stored as OCI artifacts, but also your Kubernetes desired state in plain YAML and other popular formats like Kustomize and Terraform. We will demonstrate how to use OCI registries as a source to deploy workloads using flux: - Deploy charts and Kubernetes manifests from an OCI registry - Sign and verify the workloads - Automatically update configuration repository and observer automatic upgrades We will also present the Flux OCI as source architecture so users can better understand what's going on under the hood when they use OCI registries for their GitOps source.

Fast iteration is enabled by GitOps, but when things don't work you are going to want access to a dashboard that provides rich granular information from various sources. Flux's guide to Prometheus Monitoring is presented here with a VPN solution that provides routed access to the cluster's service and pod subnets, with simple service discovery through kube-dns extended to the developer's laptop. How to expose it to our developers without "exposing" it to the world without compromising anything? We will use Tailscale, a free and open source VPN solution. The new Flux VS Code extension provides the basest form of Cloud-Native observability: Flux resources report their own status and condition in the Kubernetes way, as CRD resources, and the editor extension makes quick work of interpreting them and displaying the important parts, which makes diagnosing delivery issues in your GitOps pipeline fast and easy. And when the problem is not in a GitOps pipeline, or anything that is exported to Prometheus, but some performance issue in the deliverable software: Pixie provides a super-modern spin on observability with eBPF scripts that work in an agentless way without app configuration.

You might have heard about Cue (https://cuelang.org) -- an open source language for defining, generating, and validating all kinds of data. Wait, Kubernetes configuration is data! You also probably heard about Carvel (https://carvel.dev) -- a set of composable tools that embrace GitOps principles and help with building, configuring, and deploying applications to Kubernetes. So... what happens when we try to use these two projects together for GitOps? In this session we'll explore (and run through some live demos): - Why would you want to use Cue to define your Kubernetes configuration - How does Carvel tools help with managing deployed Cue configuration - How we can safely adopt Cue configuration in our existing environments