consistency 7 Source Git Repository Image Registry CI The GitOps Application Delivery Model 8 Source Git Repository Config Git Repository Image Registry Kubernetes CI CD The GitOps Application Delivery Model Pull Request Push Pull Push Pull Pull Request 9 Source Git Repository Image Registry CI The GitOps Application Delivery Model Config Git Repository Kubernetes Deploy GitOps 11 OpenShift Builds OpenShift Pipelines Source Git Repository Config Git Repository Image Registry Kubernetes The GitOps Application Delivery Model on OpenShift Pull Request Push Pull

ArgoCD Managed Deployment Pipeline Managed Deployment Pro Consistent Post-Test update of image reference Con Image reference updated in git before integration tests, manage rollback? Inconsistent Con sync Application repo Environment repo Openshift Pipeline Updates image in dev manifest Push newly built container image Apply the newly updated manifests Infrastructure repo Application Tekton catalogs ● App Services (MW) Tasks ● Community-contributions ● OCI artifacts for task distribution ● Additional Tekton resource types in Hub CORE ● Console pages for all Tekton resources ● Console

Considerations Multicluster Management Non-Declarative Infrastructure Security Base Image Selection Everything as Code Conclusion 45 About the Author The Path to GitOps | 5 Foreword controller, the Kustomize controller, the Helm controller, the notification controller, and the image automation controller. Flux was born out of the best practices and use cases from site reliability simple example of updating an image tag. The application has been built, tested, and deemed ready to go from a sandbox environment to a test environment. But updating the image tag comes with other changes

code to Git, the continuous integration tool kicks off unit tests that eventually build the Docker image that gets pushed to the container registry. With a typical CI/CD pipeline, Docker images are Runs inside the production cluster Read/Write access to configuration repository Read access to image repository Read/Write access to the production cluster GitOps separates CI from CD and is a more builds a new image and pushes the new image to a container registry. 4. Weave Cloud’s Deployment Automator watches the container registry, notices the image, pulls the new image from the registry

a continuous integration tool kicks off unit tests that eventually build the Docker container image that gets pushed to the container registry. Figure 1 BROUGHT TO YOU IN PARTNERSHIP WITH REFCARD then eventually builds a new image and deposits the new image to a registry. 5. The Deployment Automator watches the image registry, notices the image, pulls the new image from the registry, and updates the new feature to production. Figure 3: GitOps workflow in Kubernetes GITOPS SECURITY The image is pulled using read-only access to the container registry. The CI tool is not granted cluster privileges

运行命令来收集具体信息，如以下部分所述： 行命令来收集具体信息，如以下部分所述： 要收集与一个或多个特定功能相关的数据， 要收集与一个或多个特定功能相关的数据，请 请使用 使用 --image 参数和 参数和镜 镜像，如以下部分所述。 像，如以下部分所述。 示例命令 示例命令 要收集 要收集审计 审计日志， 日志，请 请使用 请使用 使用 -- /usr/bin/gather_audit_logs 参数，如以下部分所述。 参数，如以下部分所述。 $ oc adm must-gather --image=registry.redhat.io/openshift-gitops-1/must-gather- rhel8:v1.10.0 Red Hat OpenShift GitOps 1.13 了解 了解 OpenShift -5drcj must-gather-s8sdh 2/2 Running 0 72s ... $ oc adm must-gather --image=registry.redhat.io/openshift-gitops-1/must-gather-rhel8:v1.10.0 第 第 3 章 章 为 为支持收集 支持收集诊 诊断信息 断信息

the deployment was successful or not ● The pipeline(s) that were used for building the container image and deploying it ● The Kubernetes images that were affected ● The Kubernetes services/deployments is a single pipeline that: 1. Checks out the source code of the application 2. Builds a Docker image 3. Records the information for the current pull request what JIRA issue is solved 4. Creates a

配置云管服务器 hosts 文件 docker-compose.yml 文件（management-center 和 vm-service 配置部分）： management-center: image: xxx.xxx.xxx.xxx/management-center container_name: management-center environment: HOST_HOSTNAME: 2" - "ims.zwwww-1.sqga.com: 172.30.188.2" - "vpc.zwwww-1.sqga.com: 172.30.188.2" vm-service: image: xxx.xxx.xxx.xxx/vm-service containerr_name: vm-service networks: - cmp-network extra_hosts: sa-fb-1.demo.com 2. docker-compose.yml 文件示例(management-center 与 vm-service 部分)： management-center: image: xxx.xxx.xxx.xxx/management-center container_name: management-center environment: HOST_HOSTNAME:

kustomization.yaml 13 加上Patches 14 Overlay deployment kustomization.yaml 15 用patch替換dev 使用的image tag 16 Kustomize Comand •kubectl kustomize {放置 kustomization.yaml 的資料夾名稱} •生成替換掉或增加參數的yaml •kubectl