Skip to content

Latest commit

 

History

History
89 lines (66 loc) · 4.03 KB

GitopsFAQ.md

File metadata and controls

89 lines (66 loc) · 4.03 KB
Raw

Frequently Asked Questions

What is Gitops?

GitOps is a way to do operations, by using Git as a single source of truth, and updating the state of the operating configuration automatically, based on a Git repository.

How does GitOps differ from Infrastructure as Code?

GitOps builds on top of Infrastructure as Code, providing application level concerns, as well as an operations model.

Can I use a CI server to orchestrate convergence in the cluster?

You could apply updates to the cluster from the CI server, but it won’t continuously deploy the changes to the cluster, which means that drift won’t be detected and corrected.

Should I abandon my CI tool?

No, you'll want CI to validate the changes that GitOps is applying.

Why choose Git and not a Configuration Database instead? / Why is git the source of truth?

Git has strong auditability, and it fits naturally into a developer's flow.

How do you keep my tokens secret in the Git repository?

We are going with Sealed Secrets because of it's low-maintenance, and because it requires little investment to get going, you need to consider that anything you put into Git might get leaked at some point, so if you’re keeping secrets in there, they might be made publicly available.

How do I get started?

Add some resources to a directory, and git commit and push, then ask ArgoCD to deploy the repository, change your resource, git commit and push, and the change should be deployed automatically.

How are OpenShift pipelines used?

They are used in the default setup to drive the CI from pushes to your application code repository.

How is GitOps different from DevOps?

GitOps is a subset of DevOps, specifically focussed on deploying the application (and infrastructure) through a Git flow-like process.

How could small teams benefit from GitOps?

GitOps is about speeding up application feedback loops, with more automation, it frees up developers to work on the product features that customers love.

I have a non-globally trusted certificate in front of my private GitHub/GitLab installation, how do I get it to work?

You'll need to reconfigure the automatically generated PipelineRuns.

In file config/cicd/base/07-templates/app-ci-build-from-push-template.yaml

      pipelineRef:
        name: app-ci-pipeline
      resources:
      - name: source-repo
        resourceSpec:
          params:
          - name: revision
            value: $(params.io.openshift.build.commit.id)
          - name: url
            value: $(params.gitrepositoryurl)
          type: git

This requires an additional parameter:

      pipelineRef:
        name: app-ci-pipeline
      resources:
      - name: source-repo
        resourceSpec:
          params:
          - name: revision
            value: $(params.io.openshift.build.commit.id)
          - name: url
            value: $(params.gitrepositoryurl)
          - name: sslVerify
            value: "false"
          type: git
          - name: sslVerify
            value: "false"

This additional parameter configures the TLS to be insecure, i.e. it will not do any validation of the TLS certificate that the server presents, so yes, the data is encrypted, but you don't know who you are sending it to.

The config/cicd/base/07-templates/app-ci-build-from-push-template.yaml template will need the same change applied.

You will also need to configure ArgoCD to fetch your data insecurely.

$ argocd repo add https://gitlab.example.com/my-org/my-gitops-repo.git --username git --password <auth token> --insecure-skip-server-verification

Also, if you're using the optional commit-status-tracker controller, please see the documentation for further help, if you're getting an error x509: certificate signed by unknown authority.

The secrets in my Git repository are encrypted, how do I backup the key?

https://github.com/bitnami-labs/sealed-secrets#how-can-i-do-a-backup-of-my-sealedsecrets