Today’s modern enterprises are spoilt for choice with technology options, services and approaches. But in order to improve organizational productivity and development velocity, considering how developer experience plays a key role in these decisions will be a huge driver of their success. DevEx is becoming increasingly critical for organizations because developers are important for building digital products and services. Organizations require developers to spend more time coding and less time working on infrastructure. Improving developer toolchains is essential for increasing productivity. But where does security sit in all of this? James Governor, Analyst and Co-Founder of RedMonk and Steve George, COO at Weaveworks (the pioneers for GitOps deployments and infrastructure management) discuss the importance of DX and security in successful organizations today. They focus on how GitOps is enabling DevOps automation and allowing traditional CICD practices to shift further left.

1. 1
DX, Guardrails, Golden
Paths, & Policy
Management in
Kubernetes
#futureofgitops

2. 2
James Governor
Analyst & Co-Founder, Redmonk
James Governor is co-founder of RedMonk, the only
developer-focused industry analyst firm. Based in London, he
advises clients on developer-led adoption, open source,
community and technology strategy.
Speaker introduction
Steve George
COO, Weaveworks
Steve joined Weaveworks in February 2017 as COO where he
leads both the Product and Commercial Teams. In a career
spanning 25 years, Steve has worked in a range of roles in the
technology sector, most recently leading Canonical’s operations
and corporate development. His interest and support for FOSS
goes back to 1997, when he got hold of his first copy of
Slackware on floppy disk.

3. 3
Confidential do not distribute 3

4. 4
Confidential do not distribute 4

5. 5
Confidential do not distribute 5

6. 6
Confidential do not distribute 6

7. 7
Confidential do not distribute 7

8. 8
Confidential do not distribute 8

9. 9
Confidential do not distribute 9

10. 10
Confidential do not distribute 10
Infra as Code

11. 11
Confidential do not distribute 11
GitOps

12. 12
Confidential do not distribute 12
From What, to Why to How

13. 13
Confidential do not distribute 13
Progressive Delivery

14. 14
Confidential do not distribute 14
Observability

15. 15
Confidential do not distribute 15
SRE

16. 16
Confidential do not distribute 16
Production Excellence

17. 17
Confidential do not distribute 17
Platform Engineering

18. 18
Confidential do not distribute 18
Compliance and Policy

19. 19
Confidential do not distribute 19

20. 20
Confidential do not distribute 20

21. 21
Confidential do not distribute 21

22. 22
Confidential do not distribute 22
● Kubernetes with control
● Multi cloud management
● Software Delivery Compliance
● Governance and Guardrails (the emergence of platform teams)
● Developer Experience
● Single source of the truth for ops and dev teams
● Testing in Production/Production Excellence
● Data Ops (supporting Kafka)
● 5G Edge Networks
GitOps Use Cases

23. 23
Confidential do not distribute 23
● Deep support for hyperscale public cloud suppliers and on prem deployments
● RBAC functionality
● Built for Observability [Prometheus support as an expectation today]
● CI/CD platform integration
● Integrated Progressive Delivery and deployment to Kubernetes clusters
● Policy management
GitOps Requirements

24. Confidential do not distribute 24
Developer Experience

25. Confidential do not distribute 25
Opaque and sharp learning curve

26. Confidential do not distribute
Complexity of Operations

27. Confidential do not distribute

28. ● Specific developer and application
operations use-cases for Weave GitOps
● Weave GitOps 2022.03 improvements
○ Dev Onramp to application
deployment in Weave GitOps
○ GitOps enabled Trusted Delivery
● Bringing GitOps to the IDE - VSCode
Extension
Weave GitOps
Dev Onramp and scaling
operations

29. 29
Confidential do not distribute 29
Continuous Application Delivery -
use GitOps to deploy and operate
applications. Automation increases
deployment velocity and developer
productivity.
Weave GitOps - Use Cases
Kubernetes Everywhere - in the
cloud or the datacenter Kubernetes
is a universal platform that’s easy to
manage with GitOps.
DevOps Automation - Lifecycle
management of the entire platform.
all clusters and services, using
automation and policy.
1
4
2
5
3
6
Self-Service Platforms - a complete
platform giving developers
autonomy while ensuring
consistency and manageability.
Trusted Delivery - shift policy and
security left - governance, risk and
compliance are non-negotiables.
Progressive Delivery - deploy
services across many environments
and regions reliably using GitOps

30. Confidential do not distribute
Scaled GitOps
● Fleet Management with MCCP
● Advanced Curated Weave Policies using tools
Enterprise GitOps
● Curated model/profiles with cluster components
● Application tenancy through workspaces
● Authorization models consistent across the environment.
Kubernetes native
Weave GitOps: Dev onramp Weave GitOps Enterprise (subscription)
Core GitOps
● Curated GitOps toolset, installer, runtime, and proven
example configurations
Prerequisites
● Infrastructure provisioner
● Source code repo platform
● Container registry
Weave GitOps Core (free and open-source)e)
30

31. 31
Confidential do not distribute 31
Challenge: Developer Velocity
● Slow feature delivery cycles
● Manual, unreliable deployments
● Bad deployments - cannot recover
Use Case: Application Deployment / Continuous Delivery
Solution: GitOps Automation
● Automate the development process
● Continuous application delivery
● Increase MTTD and decrease MTTR

32. 32
Confidential do not distribute
Code
Repo
Source Code
Build
Container
Registry
K8s
Manifest
Config
Repo
Dev Cluster
App
Deploy App
Automated
Deploy
Deploy to Dev

33. 33
Confidential do not distribute
Pull Request
Code
Repo
Source Code
Build
Container
Registry
K8s
Manifest
Config
Repo
Inspect
Prod Cluster
App App
Deploy
App Manual
Approval
K8s Manifest
Deploy to Production

34. 34
Confidential do not distribute 34
Just Add GitOps…
● Weave GitOps Core is the easiest
way to add GitOps for applications.
● Adds onto Flux our CNCF project
● Represents the repositories that store
a collection of a declarative
description of runnable units
● Shows health of the GitOps agent
and shows the status of the system
● Presents the services and the
workloads running in instances in a
specific environment, including status
● Free and Open Source - Download
from Weaveworks

35. 35
Confidential do not distribute 35
Challenge: Developer Velocity and Security
● Manual, time-consuming deployments that requires
extensive Kubernetes knowledge
● Security risks from manual checking
● Need for regulatory compliance (HITRUST,
ISO-27001, and HIPAA)
● Need for policy control, authorization
and audit
Use Case: Security shifts left with GitOps (Trusted Delivery)
Solution: Trusted Delivery with GitOps
● Guardrails for any deployment running anywhere
● Single pane of glass for policy management
● Policy coverage at commit/build time and at runtime
● Enforce environment and workload compliance with
policy as code

36. Confidential do not distribute 36
Notifications
Policy Engine
Policies & Playbooks
Reports
Dashboards
Assets & Configs
Containers
Volumes
Network Policies
K8s Configs
Service Mesh
App Components
(Dbs, cache, queues, etc)
Policies enforcements
(Stop and prevent violating
changes)
Continuous monitoring
(code, build, runtime)

37. 37
Enforcing Policies at Every Step
Commit
Using GitHub actions
Build
Using CI/CD workflows
Deploy
K8s admission controllers
Runtime
Using KubeNotifier
Prevent violating changes from being merged
Fail builds if there is a violating change
Prevent violating changes done through kubectl or APIs
Get notified and report violations as they occur

38. 38
Confidential do not distribute 38
Kubernetes Guardrails
● Policies are Dynamic:
Can be applied to new or
currently running clusters
● Policy Changes and
Updates are enabled
immediately
● Policy violation reporting
uses new and updated
policies

39. 39
Create
App
App
Cluster
App
Pull Request Management Repo
Policy
Policy
Trusted delivery flow
39

40. 40
Weave GitOps Enterprise: Policy as Code
● Enterprise version runs entirely within
the customers environment
● Enforces policy on all clusters and leaf
clusters can run in a semi-disconnected
fashion
● Application Policies are in GitOps: stores
policy with the deployment artefacts
● Cluster Policies are in GitOps: stored
with the cluster definition
● Alerts on the central management
clusters any violation across all clusters
and workloads
40

41. 41
Bringing GitOps to the IDE
● As James said - meet developers
where they are
● The GitOps Tools for VSCode
extension brings GitOps into your IDE
● Use it to iterate quickly and deploy
new versions of a service into a dev
cluster
● It can:
○ Deploy the GitOps engine onto
any Kubernetes
○ Deploy and update them onto
different clusters
● Tech preview - we’d love everyone to
try it and give feedback
https://github.com/weaveworks/vscode-gitops-tools
41

42. 42
Download Weave Core for Free
www.weave.works/core
Request a demo of Weave GitOps Enterprise
www.weave.works/contact
Thank You

43. Confidential do not distribute
Thank you
https://weave.works
43