{"id":43,"date":"2022-04-24T03:40:57","date_gmt":"2022-04-24T03:40:57","guid":{"rendered":"https:\/\/yassinemoumen.com\/?p=43"},"modified":"2022-04-24T17:01:44","modified_gmt":"2022-04-24T17:01:44","slug":"what-is-gitops-where-did-it-come-from-and-why-should-you-care","status":"publish","type":"post","link":"https:\/\/yassinemoumen.com\/?p=43","title":{"rendered":"What is GitOps, Where Did It Come From, and Why Should You Care?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p>\u201cWhat is GitOps?\u201d \u2013 a question which has seen increasing popularity on Google searches and blog posts in the last three years. If you want to know why then read on. In this post, we will try to discover GitOps concept, and answer this questions :What is GitOps? Where Did It Come From? and Why Should You Care? The short answers to these questions:<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Where did GitOps come from?\u00a0<\/strong><\/h4>\n\n\n\n<p><a href=\"https:\/\/www.weave.works\/\" target=\"_blank\" rel=\"noreferrer noopener\">Weaveworks<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>What does it mean?<\/strong>\u00a0<\/h4>\n\n\n\n<p>In a nutshell, GitOps is a practice (Git Operation) that allows you to use GIT and code repository as your configuration source of truth. Then, an engineer can pull the change to alter or update your system\u2019s configuration.\u00a0<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Should you care?<\/strong><\/h4>\n\n\n\n<p class=\"has-text-color\" style=\"color:#33a100\"><strong><strong>YES!!!<\/strong><\/strong><\/p>\n\n\n\n<p>So let me tell you a story about GitOps approach.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The beginning<\/h2>\n\n\n\n<p>The scene: spring 2016, a peaceful morning in London, at Weaveworks.\u00a0 The sun is shining.\u00a0 Birds tweet.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>I\u2019m about to make a change that will probably wipe out all our systems<\/em><\/p><cite>Tom<\/cite><\/blockquote>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>Tom, are you sure we want to do that?<\/em><\/p><cite>Decent person<\/cite><\/blockquote>\n\n\n\n<p class=\"has-text-color\" style=\"color:#ff0000\">**<strong>click<\/strong>**<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>Oops \u2013 I\u2019ve just deleted all our Kubernetes clusters on AWS<\/em><\/p><cite>Tom<\/cite><\/blockquote>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"580\" height=\"282\" src=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/ThisIsFine.jpg\" alt=\"\" class=\"wp-image-44\" srcset=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/ThisIsFine.jpg 580w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/ThisIsFine-300x146.jpg 300w\" sizes=\"auto, (max-width: 580px) 100vw, 580px\" \/><\/figure><\/div>\n\n\n\n<p>It took the team less than\u00a0<strong>45<\/strong>\u00a0minutes to completely rebuild our entire systems. 45 minutes was a pretty good outcome \u2013 made possible by \u201cGitOps\u201d.<br>Okay, to be fair, probably every Continuous Deployment technology promises to make deploying faster and allows you to deploy more often.<br>But here is what special about GitOps.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">GitOps is pretty Git-ty<\/h2>\n\n\n\n<p>GitOps requires the desired state of the system to be stored in version control. All changes to the desired state are fully traceable commits associated with committer information, commit IDs and time stamps. This means that both the application and the infrastructure are now versioned artifacts and can be audited using the gold standards of software development and delivery.<\/p>\n\n\n\n<p>Using Git to manage infrastructure might seem like kind of a strange hack\u2014like using a hammer to paint a wall or driving your car into the water. But when you look more closely, you realize that the practice behind GitOps makes a lot of sense:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Use Git as a source of truth<\/li><li>Drive operations through git repo<\/li><li>Get version control, history, peer review and rollback<\/li><li>Webhooks: push to trigger build\/test<\/li><li>PR\u2019s &amp; merge branch to deploy<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">GitOps in Practice<\/h2>\n\n\n\n<p><strong>The entire system is described declaratively.<\/strong>&nbsp;Declarative means that configuration is guaranteed by a set of facts instead of by a set of instructions. Kubernetes is just one example of many modern cloud native tools that are \u201cdeclarative\u201d and that can be treated as code.<\/p>\n\n\n\n<p><strong>The canonical desired system state is versioned in Git.<\/strong>&nbsp;It means, you have a single place from which everything is derived and driven.<\/p>\n\n\n\n<p><strong>Approved changes to the desired state are automatically applied to the system<\/strong>. Software agents ensure correctness and alert on divergence.<\/p>\n\n\n\n<p><strong>Software agents ensure correctness and alert on divergence.<\/strong>\u00a0The use of agents also ensures that your entire system is self-healing. And by self-healing, we don\u2019t just mean when nodes or pods fail\u2014those are handled by Kubernetes\u2014 but in a broader sense, like in the case of human error.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What happens when you adopt GitOps?<\/h2>\n\n\n\n<p>\u2981 Any developer that uses Git can start deploying new features to \u201cKubernetes\u201d<br>\u2981 The same workflows are maintained across development and operations<br>\u2981 All changes can be triggered, stored, validated and audited in Git<br>\u2981 Ops changes can be observed and monitored<br>\u2981 Ops changes can be made by pull request including rollbacks, but remember:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/chuck-norris-doesnt-rollback.jpg\" alt=\"\" class=\"wp-image-45\" width=\"548\" height=\"473\" srcset=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/chuck-norris-doesnt-rollback.jpg 1000w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/chuck-norris-doesnt-rollback-300x259.jpg 300w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/chuck-norris-doesnt-rollback-768x664.jpg 768w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/chuck-norris-doesnt-rollback-600x518.jpg 600w\" sizes=\"auto, (max-width: 548px) 100vw, 548px\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">How to adopt GitOps?<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Your everyday CI\/CD Pipeline:<\/strong><\/h4>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"901\" height=\"319\" src=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/typicCICD.png\" alt=\"\" class=\"wp-image-46\" srcset=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/typicCICD.png 901w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/typicCICD-300x106.png 300w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/typicCICD-768x272.png 768w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/typicCICD-600x212.png 600w\" sizes=\"auto, (max-width: 901px) 100vw, 901px\" \/><\/figure><\/div>\n\n\n\n<p>When you push that code to Git, the continuous integration tool kicks off unit tests that eventually build the Docker image that gets pushed to the container registry. With a typical CI\/CD pipeline, Docker images are deployed using some sort of bash script or another method of talking directly to the cluster API.<br>Security wise: you have to share your API credentials with the CI tooling. If someone breaks into your CI tool, they will have total control over your production cluster. But what happens if your cluster goes down, You would have to run all of your CI jobs to rebuild everything and then re-apply all the workloads to the new cluster.<\/p>\n\n\n\n<p>Let\u2019s see how we can improve the typical CI\/CD pipeline with GitOps.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>GitOps Deployment Pipeline:<\/strong><\/h4>\n\n\n\n<p>With this pattern, an agent acts on behalf of the cluster. It listens for events relating to custom resource changes, and then applies those changes based on a deployment policy.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"304\" src=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/gitopsCICD.png\" alt=\"\" class=\"wp-image-47\" srcset=\"https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/gitopsCICD.png 900w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/gitopsCICD-300x101.png 300w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/gitopsCICD-768x259.png 768w, https:\/\/yassinemoumen.com\/wp-content\/uploads\/2022\/04\/gitopsCICD-600x203.png 600w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/figure><\/div>\n\n\n\n<ol class=\"wp-block-list\"><li>The development team writes and then pushes code into a code repo.<\/li><li>CI\/CD tool kicks off unit tests that build the Docker image.<\/li><li>Docker images are deployed using some sort of bash script.<\/li><li>The Deployment Automator updates the YAML<\/li><li>Flux detects that the cluster is out of date, triggers deployments, and automatically updates Kubernetes<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Getting your hands dirty<\/h2>\n\n\n\n<p>You will need to have&nbsp;<a href=\"https:\/\/kind.sigs.k8s.io\/docs\/user\/quick-start\/\">Kubernetes cluster<\/a>&nbsp;set up and a&nbsp;<a href=\"https:\/\/docs.github.com\/en\/authentication\/keeping-your-account-and-data-secure\/creating-a-personal-access-token\">GitHub personal access token<\/a>&nbsp;with repo permissions. As&nbsp;<strong>agents,&nbsp;<\/strong>we will be using Flux.<\/p>\n\n\n\n<p>Flux is a tool that automatically ensures that the state of a cluster matches the config in git.<\/p>\n\n\n\n<ul class=\"wp-block-list\" id=\"block-dece1a7e-2c99-4dd2-a535-81145d0e1848\"><li>It monitors all relevant image repositories<\/li><li>Detects new images<\/li><li>Triggers deployments and updates the desired running configuration based on that<\/li><\/ul>\n\n\n\n<h5 class=\"wp-block-heading\">Installing fluxctl:<\/h5>\n\n\n\n<p><a href=\"https:\/\/fluxcd.io\/docs\/installation\/#install-the-flux-cli\">fluxctl<\/a>&nbsp;provides an API that can be used from the command line. To install the CLI with Homebrew:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>brew install fluxctl\n<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Export your credentials:<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>export GITHUB_TOKEN=&lt;your-token&gt;\nexport GITHUB_USER=&lt;your-username&gt;<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Check your Kubernetes cluster:<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>flux check --pre<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Install Flux onto your cluster:<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>flux bootstrap github \\\n  --owner=$GITHUB_USER \\\n  --repository=fleet-infra \\\n  --branch=main \\\n  --path=.\/clusters\/my-cluster \\\n  --personal<\/code><\/pre>\n\n\n\n<p>See&nbsp;<a href=\"https:\/\/fluxcd.io\/docs\/installation\/\">Installation<\/a>&nbsp;for more info.<\/p>\n\n\n\n<p>The bootstrap command above does following:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Creates a git repository&nbsp;<code><strong>fleet-infra<\/strong><\/code>&nbsp;on your GitHub account<\/li><li>Adds Flux component manifests to the repository<\/li><li>Deploys Flux Components to your Kubernetes Cluster<\/li><li>Configures Flux components to track the path<strong>&nbsp;<code>\/clusters\/my-cluster\/<\/code><\/strong>&nbsp;in the repository<\/li><\/ul>\n\n\n\n<h5 class=\"wp-block-heading\">Clone the git repository:<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>git clone https:\/\/github.com\/$GITHUB_USER\/fleet-infra\ncd fleet-infra<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Add podinfo repository to Flux:<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>flux create source git podinfo \\\n  --url=https:\/\/github.com\/stefanprodan\/podinfo \\\n  --branch=master \\\n  --interval=30s \\\n  --export &gt; .\/clusters\/my-cluster\/podinfo-source.yaml<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>git add -A &amp;&amp; git commit -m \"Add podinfo GitRepository\"\ngit push<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Deploy podinfo application:<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>flux create kustomization podinfo \\\n  --target-namespace=default \\\n  --source=podinfo \\\n  --path=\".\/kustomize\" \\\n  --prune=true \\\n  --interval=5m \\\n  --export &gt; .\/clusters\/my-cluster\/podinfo-kustomization.yaml<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>git add -A &amp;&amp; git commit -m \"Add podinfo Kustomization\"\ngit push<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Watch Flux sync the application:<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>flux get kustomizations --watch<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>kubectl -n default get deployments,services<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Further Reading<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>https:\/\/www.cloudbees.com\/gitops\/what-is-gitops<\/li><li>https:\/\/about.gitlab.com\/topics\/gitops\/<\/li><li>https:\/\/www.weave.works\/technologies\/gitops\/<\/li><li>https:\/\/searchitoperations.techtarget.com\/tutorial\/Try-out-this-GitOps-tutorial-with-Flux-and-Kubernetes<\/li><li>https:\/\/github.com\/fluxcd\/flux2-kustomize-helm-example<\/li><li>https:\/\/github.com\/fluxcd\/flux2-multi-tenancy<\/li><\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Introduction \u201cWhat is GitOps?\u201d \u2013 a question which has seen increasing popularity on Google searches and blog posts in the last three years. If you want to know why then read on. In this post, we will try to discover GitOps concept, and answer this questions :What is GitOps? Where Did It Come From? and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"full-width-page-template.php","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[6],"tags":[],"class_list":["post-43","post","type-post","status-publish","format-standard","hentry","category-devops","missing-thumbnail"],"_links":{"self":[{"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=\/wp\/v2\/posts\/43","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=43"}],"version-history":[{"count":2,"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=\/wp\/v2\/posts\/43\/revisions"}],"predecessor-version":[{"id":49,"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=\/wp\/v2\/posts\/43\/revisions\/49"}],"wp:attachment":[{"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=43"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=43"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yassinemoumen.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=43"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}