September 2021 Summaries

Helm is a package manager for Kubernetes that streamlines application deployment by packaging collections of YAML files into Helm charts, which are deployable units for Kubernetes applications. These charts contain a directory with a self-descriptor file, YAML files, and Kubernetes manifests, allowing for easy distribution via Helm repositories. Helm facilitates version tracking and rollback capabilities through Helm releases, which are instances of a chart running in a Kubernetes cluster. GitOps, a methodology that uses Git as the single source of truth for configurations, can be integrated with Helm to enhance deployment workflows, providing transparency and synchronization between the Git repository and Kubernetes clusters. Argo CD, a continuous delivery tool, exemplifies GitOps by continuously monitoring and synchronizing applications against the desired state in Git, and it supports Helm natively by rendering Helm charts with the Helm template upon deployment. This integration transforms Helm applications into Argo-managed applications, with Argo CD handling the deployment and synchronization processes, ensuring efficient and reliable application management within Kubernetes environments.

The author details their efforts to integrate Codefresh with ServiceNow's Change Management solution, driven by customer requests for such functionality. By leveraging the Table REST API, they created a mechanism to submit Change Requests without relying on ServiceNow's DevOps application, thus maintaining flexibility for users. Despite challenges in incorporating the necessary build ID within Change Requests, they devised an update set available on GitHub to facilitate callbacks between ServiceNow and Codefresh, enabling approval or denial of pipelines. The author emphasizes the customizable nature of the solution, allowing ServiceNow administrators to adapt it to their specific needs, while offering insights into aligning Codefresh pipelines with existing Change Management processes.

The article addresses challenges associated with managing Helm chart promotions and versions, offering several techniques to simplify the process. It highlights the difficulty of tracking Helm chart versions in Git and suggests using a Helm Chart Repository to make version retrieval more straightforward. To minimize version sprawl, the article recommends versioning only when structural changes occur and utilizing umbrella charts to manage related subcharts without constantly updating versions. It also proposes the use of a deployment monorepo with subdirectories for different environments instead of separate Git branches, which facilitates easier comparison and automation of environment promotions. These strategies aim to streamline Helm deployments and make them more manageable, especially in a multi-environment setup, while also integrating seamlessly with GitOps tools like Argo CD and Flux CD.

GitOps, a methodology that uses Git as the single source of truth for all aspects of a system including application code and configurations, presents challenges for managing secrets. Although storing secrets in Git might seem counterintuitive to GitOps' principles, solutions exist to manage them securely. One approach involves using the Bitnami Sealed Secrets controller, which encrypts Kubernetes secrets for Git storage and decrypts them for application use without requiring code changes. This controller handles secrets by converting them into a format safe for Git, allowing their inclusion alongside other application configurations. It employs a tool called kubeseal to encrypt secrets using a cluster-specific public key, ensuring that secrets remain secure and specific to their intended environment. While incorporating sealed secrets into a GitOps workflow offers a way to manage secrets efficiently, it requires careful consideration of secret rotation and key handling, especially in production environments.

Codefresh advocates for an "everything as code" approach, emphasizing the programmatic creation and management of resources such as infrastructure, configurations, and pipelines, all defined as code to ensure consistency and reduce drift from specifications. By using Codefresh, users can create reusable pipelines with simple YAML definitions, manage updates, and onboard new applications seamlessly through code changes. The platform allows for the decoupling from a single pipeline source, offering flexible triggers and a programmatic way to create and manage pipelines, which can be stored in a Git repository. This approach not only provides shared documentation and accountability for pipeline changes but also facilitates automation through a pipeline factory that generates or updates pipelines based on changes to their code. Overall, Codefresh's model allows for a streamlined, efficient CI/CD process where pipelines are managed as code, enhancing both reliability and maintainability.