1 November 16, 2022 Flux Security & Scalability using VS Code GitOps Extension Juozas Gaigalas Developer Experience Engineer, Weaveworks Tamao Nakahara VP of Developer Experience, Weaveworks
2 Weaveworks is founded on open source ● Flux & Flagger (CNCF): GitOps and Progressive Delivery for k8s ● EKSctl: Create an Amazon EKS cluster with one command ● (and many many more projects!) And now … Weave GitOps......Built on Flux! weave.works
3 Speakers Help/Support Juozas Gaigala DX Engineer Tamao Nakahara VP of Developer Experience,Weaveworks Duration 30-60 Minutes Browser Safari copy/paste shortcuts may not work Using Zoom Questions? • Use chat (button: top left corner of screen) • Escape to exit full screen • “To Everyone” or “To all panelists and attendees” Support: https://support.zoom.us/hc/ en-us/articles/206175806-T op-Questions Troubleshooting Use chat If the issue is not easily resolved, we ask that you follow along as we demo the sample app. Intro to GitOps & Flux
4 WOUG: Flux’s Security & Scalability with OCI & Helm (Part 2) (Nov 29) HashiCorp User Group Luxembourg (virtual) (Nov 30) WOUG: Implementing Flux for Scale with Soft Multi-tenancy (Dec 13) Upcoming Events
5 5 ● Operating model for cloud native applications such as Kubernetes ● Utilizes a version controlled system (Commonly Git) as the “single source of truth” ● Enables continuous delivery through automated deployment, monitoring, and management by a version controlled system ● Managing your infrastructure and applications declaratively What is GitOps
6 Source: GitOps Working Group https://opengitops.dev/
7 7 Individuals, teams, and organizations who implement GitOps experience many benefits, including: ● Stronger Security Guarantees ● Increased Developer & Operational Productivity ● Enhanced Developer Experience ● Improved Stability ● Higher Reliability ● Consistency and Standardization Why GitOps
8 8 ● A git centric package manager for your applications ● A set of continuous and progressive delivery solutions for Kubernetes What is Flux fluxcd.io
9 9 🤝 Flux provides GitOps for both apps and infrastructure 🤖 Just push to Git and Flux does the rest 🔩 Flux works with your existing tools ☸ Flux works with any Kubernetes and all common Kubernetes tooling 🤹Flux does Multi-Tenancy (and “Multi-everything”) 📞 Flux alerts and notifies 👍 Users trust Flux 💖 Flux has a lovely community that is very easy to work with! Flux in Short
10 10 ● Reduces developer burden ● Extensible ● Comes with out of the box support for Kustomize and Helm ● Designed For Kubernetes Benefits of Flux fluxcd.io
11 11 Overview of Flux Source controller Kustomize controller Helm Controller Notification Controller Image Reflector & Automation Controller Flux Flux is a set of Kubernetes Controllers fluxcd.io
12 What Flux’s Controllers do Source Controller - Fetch resources and store as artifacts Kustomize Controller - Apply manifests, Run manifest generation using kustomize Helm Controller - Deployment of Helm Charts Notification Controller - Notification Dispatch Image Reflector Controller - Reflects Image metadata for Automation Controller Image Automation Controller - Updates YAML when new container images are available fluxcd.io
13 13 GitOps Tools for Flux Visual Studio Code Extension ● An extension to enhance the developer experience ● An intuitive way to manage, troubleshoot and operate your Kubernetes environment following the GitOps operating model ● Accelerate your development lifecycle and simplify your continuous delivery pipelines ● GitOps Tools Visual Studio Code on GitHub: https://github.com/weaveworks/vscode-gitops-tools ● GitOps Tools for Flux in Visual Studio Marketplace: https://marketplace.visualstudio.com/items?itemName=Weavework s.vscode-gitops-tools
14 14 ● Open Container Initiative: https://opencontainers.org/ ● Founded in 2015 by Docker and others ● Part of Linux Foundation ● Specifies image format, distribution and execution for containers ● Supports non-container data ○ Layers of TAR files with metadata ● Becoming standard application delivery format (image+configuration) What is OCI
15 15 Flux Added OCI Support! OCI + Flux == GitOps ● Git is still the source of truth ● Before: ○ Git => Flux ● After: ○ Git => OCI registry => Flux
16 16 Security & Scalability ● Pulling an OCI image is much less resource-intensive compared to a full or shallow Git clone ● High available registries are available everywhere ● Flux leverages Kubernetes workload identity and IAM when pulling OCI artifacts from managed registries ○ => No more key management ○ => No more SSH keys to generate ○ => No more proprietary API usage for token generation ○ => same mechanism that’s used for pulling container images ● Image verification with cosign
17 17 ● Software supply chain attacks ● OCI Artifact authenticity ● Sigstore cosign ○ Sponsored by Open Source Security Foundation (OpenSSF) ○ OpenID Connect, Root CA and Public Ledger ○ Keys: text-based, cloud KMS, Kubernetes Secret ● Container registry must support signed images ○ GitHub offers a simple way to get started with OCI and cosign Image Verification with cosign
18 18 Demo Time!
19 19 Weave GitOps ● Adds a web UI that surfaces key information to help application operators easily discover and resolve issues ● An intuitive interface that provides a guided experience to build understanding and simplify getting started for new users; they can easily discover the relationship between Flux objects and navigate to deeper levels of information as required ● GitOps Tools Visual Studio Code on GitHub: https://github.com/weaveworks/weave-gitops ● Weave GitOps Documentation: https://docs.gitops.weave.works/docs/intro/
20 WOUG: Flux’s Security & Scalability with OCI & Helm (Part 2) (Nov 29) HashiCorp User Group Luxembourg (virtual) (Nov 30) WOUG: Implementing Flux for Scale with Soft Multi-tenancy (Dec 13) Upcoming Events
21 ● Join us on Flux discussions if you have more questions: https://github.com/fluxcd/flux2/discussions ● Flux Community: https://fluxcd.io/community/ ● Join the GitOps Community Group: https://www.meetup.com/GitOps-Community/ ● More info on GitOps? Visit www.gitops.community/ ● Join the GitOps Community LinkedIn Group: https://www.linkedin.com/groups/13914610/ ● VS Code Extension: https://code.visualstudio.com/ Next Steps
Confidential do not distribute 2 2 weave.works Thank you

Flux Security & Scalability using VS Code GitOps Extension

  • 1.
    1 November 16, 2022 FluxSecurity & Scalability using VS Code GitOps Extension Juozas Gaigalas Developer Experience Engineer, Weaveworks Tamao Nakahara VP of Developer Experience, Weaveworks
  • 2.
    2 Weaveworks is foundedon open source ● Flux & Flagger (CNCF): GitOps and Progressive Delivery for k8s ● EKSctl: Create an Amazon EKS cluster with one command ● (and many many more projects!) And now … Weave GitOps......Built on Flux! weave.works
  • 3.
    3 Speakers Help/Support Juozas Gaigala DXEngineer Tamao Nakahara VP of Developer Experience,Weaveworks Duration 30-60 Minutes Browser Safari copy/paste shortcuts may not work Using Zoom Questions? • Use chat (button: top left corner of screen) • Escape to exit full screen • “To Everyone” or “To all panelists and attendees” Support: https://support.zoom.us/hc/ en-us/articles/206175806-T op-Questions Troubleshooting Use chat If the issue is not easily resolved, we ask that you follow along as we demo the sample app. Intro to GitOps & Flux
  • 4.
    4 WOUG: Flux’s Security& Scalability with OCI & Helm (Part 2) (Nov 29) HashiCorp User Group Luxembourg (virtual) (Nov 30) WOUG: Implementing Flux for Scale with Soft Multi-tenancy (Dec 13) Upcoming Events
  • 5.
    5 5 ● Operating modelfor cloud native applications such as Kubernetes ● Utilizes a version controlled system (Commonly Git) as the “single source of truth” ● Enables continuous delivery through automated deployment, monitoring, and management by a version controlled system ● Managing your infrastructure and applications declaratively What is GitOps
  • 6.
    6 Source: GitOps WorkingGroup https://opengitops.dev/
  • 7.
    7 7 Individuals, teams, andorganizations who implement GitOps experience many benefits, including: ● Stronger Security Guarantees ● Increased Developer & Operational Productivity ● Enhanced Developer Experience ● Improved Stability ● Higher Reliability ● Consistency and Standardization Why GitOps
  • 8.
    8 8 ● A gitcentric package manager for your applications ● A set of continuous and progressive delivery solutions for Kubernetes What is Flux fluxcd.io
  • 9.
    9 9 🤝 Flux providesGitOps for both apps and infrastructure 🤖 Just push to Git and Flux does the rest 🔩 Flux works with your existing tools ☸ Flux works with any Kubernetes and all common Kubernetes tooling 🤹Flux does Multi-Tenancy (and “Multi-everything”) 📞 Flux alerts and notifies 👍 Users trust Flux 💖 Flux has a lovely community that is very easy to work with! Flux in Short
  • 10.
    10 10 ● Reduces developerburden ● Extensible ● Comes with out of the box support for Kustomize and Helm ● Designed For Kubernetes Benefits of Flux fluxcd.io
  • 11.
    11 11 Overview of Flux Source controller Kustomize controller Helm Controller Notification Controller ImageReflector & Automation Controller Flux Flux is a set of Kubernetes Controllers fluxcd.io
  • 12.
    12 What Flux’s Controllersdo Source Controller - Fetch resources and store as artifacts Kustomize Controller - Apply manifests, Run manifest generation using kustomize Helm Controller - Deployment of Helm Charts Notification Controller - Notification Dispatch Image Reflector Controller - Reflects Image metadata for Automation Controller Image Automation Controller - Updates YAML when new container images are available fluxcd.io
  • 13.
    13 13 GitOps Tools forFlux Visual Studio Code Extension ● An extension to enhance the developer experience ● An intuitive way to manage, troubleshoot and operate your Kubernetes environment following the GitOps operating model ● Accelerate your development lifecycle and simplify your continuous delivery pipelines ● GitOps Tools Visual Studio Code on GitHub: https://github.com/weaveworks/vscode-gitops-tools ● GitOps Tools for Flux in Visual Studio Marketplace: https://marketplace.visualstudio.com/items?itemName=Weavework s.vscode-gitops-tools
  • 14.
    14 14 ● Open ContainerInitiative: https://opencontainers.org/ ● Founded in 2015 by Docker and others ● Part of Linux Foundation ● Specifies image format, distribution and execution for containers ● Supports non-container data ○ Layers of TAR files with metadata ● Becoming standard application delivery format (image+configuration) What is OCI
  • 15.
    15 15 Flux Added OCISupport! OCI + Flux == GitOps ● Git is still the source of truth ● Before: ○ Git => Flux ● After: ○ Git => OCI registry => Flux
  • 16.
    16 16 Security & Scalability ●Pulling an OCI image is much less resource-intensive compared to a full or shallow Git clone ● High available registries are available everywhere ● Flux leverages Kubernetes workload identity and IAM when pulling OCI artifacts from managed registries ○ => No more key management ○ => No more SSH keys to generate ○ => No more proprietary API usage for token generation ○ => same mechanism that’s used for pulling container images ● Image verification with cosign
  • 17.
    17 17 ● Software supplychain attacks ● OCI Artifact authenticity ● Sigstore cosign ○ Sponsored by Open Source Security Foundation (OpenSSF) ○ OpenID Connect, Root CA and Public Ledger ○ Keys: text-based, cloud KMS, Kubernetes Secret ● Container registry must support signed images ○ GitHub offers a simple way to get started with OCI and cosign Image Verification with cosign
  • 18.
  • 19.
    19 19 Weave GitOps ● Addsa web UI that surfaces key information to help application operators easily discover and resolve issues ● An intuitive interface that provides a guided experience to build understanding and simplify getting started for new users; they can easily discover the relationship between Flux objects and navigate to deeper levels of information as required ● GitOps Tools Visual Studio Code on GitHub: https://github.com/weaveworks/weave-gitops ● Weave GitOps Documentation: https://docs.gitops.weave.works/docs/intro/
  • 20.
    20 WOUG: Flux’s Security& Scalability with OCI & Helm (Part 2) (Nov 29) HashiCorp User Group Luxembourg (virtual) (Nov 30) WOUG: Implementing Flux for Scale with Soft Multi-tenancy (Dec 13) Upcoming Events
  • 21.
    21 ● Join uson Flux discussions if you have more questions: https://github.com/fluxcd/flux2/discussions ● Flux Community: https://fluxcd.io/community/ ● Join the GitOps Community Group: https://www.meetup.com/GitOps-Community/ ● More info on GitOps? Visit www.gitops.community/ ● Join the GitOps Community LinkedIn Group: https://www.linkedin.com/groups/13914610/ ● VS Code Extension: https://code.visualstudio.com/ Next Steps
  • 22.
    Confidential do notdistribute 2 2 weave.works Thank you