►
From YouTube: The New Stack Makers Virtual Pancake Breakfast + Podcast: Securing GitOps: Self-Healing Through O...
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
The New Stack Makers Virtual Pancake Breakfast + Podcast: Securing GitOps: Self-Healing Through Open Source - Speakers: Katie Gamanji, Alex Williams, Om Moolchandani, Cindy Blake, Frank Kim, Sanjeev Sharma
GitOps is as hot as a campfire griddle! So cook up some hot cakes as we discuss GitOps and all that makes it hot, hot, hot! Join us for a short stack with The New Stack and sponsor Accurics to get all of your questions answered about GitOps — the movement that is defining how teams are achieving the world of desired state.
TNS Founder and Publisher Alex Williams will moderate an expert panel and take as many questions as we can answer from you and our worldwide virtual audience. Our panelists will offer their explanation and analysis about how pull request automation practices have emerged, why Infrastructure as Code is integral to GitOps practices, and how open source projects are emerging. Argo CD, Flux, Atlantis, Tekton, Kaniko, Skaffold and Terrascan can be used to create GitOps workflows with security and compliance baked in. Bring your questions for a chance to win a custom TNS spatula!
A
Hey
it's
alex
williams
here
for
our
pancake
breakfast,
the
virtual
europe
edition,
and
I
have
some
guests
here.
I
want
to
introduce
them
right
away.
I'm
ashandani,
co-founder
and
ciso
is
cto
at
accuracy.
How
are
you
doing
good,
alex
great
wonderful,
cindy,
blake
senior
security,
evangelist
at
git
lab
frank
kim
fellow
at
the
sands
institute.
B
C
A
A
A
Oh
okay,
there
we
go.
Oh
nice,
nice
yeah.
That
was
flawless
right.
I
was
reading
jokes
beforehand
of
pancake
jokes.
You
know
there
was
one
about
a
god
dad
who
who
was
telling
saying
this
kid
yeah
I
had
his
friend's
name
was
his
last
name
was
up
and
he
got
knighted
in
england
because
he
was
such
a
hero
and
they
said
when
the
queen
gave
him
gave
him
his.
You
know
his
sword
or
whatever
they
do.
He
said
I
I
I
I
I
now
bequeath
thee.
Sir
up.
Oh.
A
A
Okay,
well,
let's
just
get
started
right
into
our
discussion.
It's
on
secure,
get
ops
and
I
want
to
go
right
to
om
and
one
of
the
first
questions
I
have
and
before
I
get
started,
though,
everyone
can
ask
questions
at
the
end.
It's
this
is
recorded
and
so
we're
going
to
have
the
opportunity
for
people
to
ask
questions
live
so
you're
here
and
you're.
Watching
this
ask
a
question:
please:
there
are
so
many
open
source
projects
that
are
related
to
git
ops.
E
And
before
I
give
you
the
list
of
those,
you
know
famous
ones,
you
know,
maybe
I
can
also
quickly
you
know,
for
the
benefit
of
level
setting
and
everyone
who's
listening
right.
What
precisely
is
git
ops
right?
Just
a
couple
of
lines
of
definitions
right
so
git
ops
is
basically
your
code
base
infrastructure
and
operational
deployment.
Practice
that
you
know
specifically
relies
upon
git
and
it
uses
infrastructures
code
as
well
as
devops
methods
to
deliver
high
velocity,
ci
cd
for
specifically
kubernetes
control
plane.
E
E
E
You
know
open
source
project
which
is
delivering
githubs
and
similar
capabilities
for
control,
planes
which
are
lower
than
kubernetes
in
the
tech
stack,
which
is
called
as
atlantis
so
atlantis
also,
you
know,
allows
to
you
know,
do
automation
using
pull
request,
based
mechanisms
and
just
one
point
that
you
know
we'll.
Everybody
will
hear
a
lot
of
pull
requests
today
in
the
conversation.
But
pull
requests
are
the
central
technology
behind
gitop's.
You
know
methodologies
and
offerings.
D
I
think
youtube's
has
really
taken
the
ecosystem
discussion,
especially
in
the
past
months
within
the
the
community.
I
think
there
has
been
a
lot
of
adoption
as
well,
and
this
is
always
a
good
sign,
especially
from
the
end
user
community,
and
we
actually,
when
we
kick
started
the
technology
radars
from
cncf,
which
pretty
much
tries
to
showcase
what
the
end
users
are
usually
using
in
their
production
system.
D
This
was
around
august
last
year,
so
at
that
time
we
had
argo,
cd
and
flux
being
either
a
sandbox
or
an
incubation
project,
so
still
early
projects,
but
how
they
had
this
adoption
within
the
end
user
community,
which
is
always
a
good
plus.
So
I
definitely
think
this
is
something
which
will
be
more,
maybe
present
within
the
infrastructure
nowadays.
So
it's
always
good
to
explore
it
from
different
angles,
especially
security,
which
I'm
looking
forward
to
discuss
more
today.
B
B
It
was
ridiculous
and
you
know
we
didn't
have
any
of
those
tools
or
processes
or
methodologies
that
you
guys
were
just
describing
and
if
only
we
had,
you
know
we
didn't
even
have
git,
of
course
back
then,
and
this
is
why
I'm
so
excited
about
a
tool
like
flux,
for
example,
ensuring
the
state
of
your
kubernetes
clusters
match
your
configuration
wow.
We
only
had
that
you
know
20
plus
years
ago
right.
We,
our
minds,
would
have
been
blown.
So
it's
really
exciting.
Where
git
ops
is
going
now.
C
And
I
think
from
a
large
enterprise
perspective
right,
so
I'm
working
for
a
pretty
large
financial
institution
right
now,
we've
covered
both
banking
and
insurance.
One
of
the
things
we
look
for
when
we're
looking
for
some
of
these
open
source
projects
is,
are
the
vendors
supporting
it
right
because
it's
very
difficult
for
a
large
enterprise
to
to
adopt
open
source?
Without
you
know,
they
tend
to
go
towards
open
source
project
which
have
been
commercialized
so
there's
commercial
support
available.
C
The
issues
in
there
that
is
a
vendor
supporting
the
issue,
is
who's
going
to
support
it
tomorrow,
and
can
I
rely
on
a
community
support,
or
can
I
get
commercial
support
for
it?
So
I
think
from
a
github's
perspective,
what
is
a
very
encouraging
when
I
look
at
it
is
seeing
some
of
the
larger
vendors
now
talking
about
githubs
and
including
it
in
their
in
their
commercially
supported
tools,
because
that's
what
will
drive
large-scale
enterprise
grade?
You
know
adoption
right.
C
We
love
to
tinker
with
open
source
projects
in
lost
enterprises,
but
moment
you
talk
about.
You
know
controlling
your
company's
crown
jewels
with
the
open
source
project.
You
get
all
kinds
of
pushback,
saying:
okay,
where
who's
going
to
support
this.
Do
we
have
the
structures
in-house
or
are
we
going
to
rely
on
a
commercial,
a
vendor
to
either
provide
support
or
provide
a
commercial
variant
of
it?
F
F
So,
in
addition
to
that,
we
have
the
you
know,
open
devops
platform
and
from
a
security
standpoint,
get
ops
is
really
important
and
it's
in
it's
an
emerging
area
where
people
are
concerned
about
because
there
hasn't
been
a
history
of
traditional
tools
to
draw
on
and
we've
solved
it
first
for
scanning.
Embedding
the
scanning
within
your
devops
life
cycle.
F
B
B
We've
got
the
mean
time
to
remediate,
which
you
know
people
say
that's
anywhere
from
two
to
three
months
on
average
in
terms
of
fixing
your
serious
security
vulnerabilities-
and
this
is
really
what
git
ops
and
these
modern
practices
and
tools
allows
us
to
do-
is
to
shrink
that
window
of
exposure.
So
we
can
better
protect
our
organizations.
I
think
that's
where
we
all
want
to
want
to
get
to.
C
I
I
think,
your
spot
on
there
right,
I
mean,
at
the
end
of
the
day
the
whole
ability
to
secure-
and
you
know
with
the
recent-
and
I
don't
want
to
name
any
companies
here.
You
know
just
to
put
them
in
a
bad
bad
light,
but
recent
issues
with
you
know:
delivery
pipelines,
the
relationship
with
supply
chains.
C
We
have
to
have
these
detective
preventive
corrective
controls
as
code,
and
they
need
to
be
a
part
of
the
code
and
they
need
to
be
enacted.
The
moment
the
code
changes
and
to
me
the
what's
encouraging
is
git
tops
health
is
helping
us
take.
Take
us
down
that
path
where
everything
becomes
code,
including
these,
these
controls
we
need
to
put
in
for
security
and
compliance.
They
are
also
code,
which
means
I,
as
a
human.
You
know
we
don't
have
to
throw
more
bodies
at
it.
We
don't
have
to
worry
about
cognitive
overload.
F
E
And
you
know
to
to
cindy's
point
and
also
sanjeev,
you
know
the
challenges
that
you
are
raising.
The
good
thing
is
about
gitops
is
that
kidops
has
built
four
technologies,
especially
like
kubernetes,
which
are
declarative
in
nature
by
default,
and
so
all
the
gitoff's
technologies
also
are
following
the
same
design.
You
know
language,
which
is
they
remain
almost
you
know
close
to
100
declarative
in
nature.
E
You
just
make
changes
into
your
code
and
the
cluster
gets
synced
with
the
state
of
the
code,
so
the
security
also
should
get
synced
up
in
the
same
speed
and
that's
where
the
declarative
nature
of
these
technologies,
especially
argo.
You
know
flux
and
many
others.
It
comes
very
handy
so
now
you
can
declaratively
feed
in
or
plug
in
security
within
the
githubs.
You
know
tool
chain
as
well.
For
example,
you
can
do
policy
as
code
within
githubs
now,
because
the
fundamental
technologies
that
gitops
uses
is
anyways.
E
You
know
your
hem
charts,
your
terraform,
your
customized
templates
and
these
technologies
go
very
well
with
the
cncf
ecosystem,
especially
around
opa,
based
project
open
policy
age
project.
So
this
allows
you
to
bake
in
your
security,
also
declaratively,
which
has
been,
in
my
opinion,
a
fundamental
transformation.
How
security
is
going
to
be
done
in
near
future?
It
is
not
going
to
be
done
in
a
reactive
manner.
Security
now
will
become
really.
E
D
D
So
if
you're
thinking
about
any
company
out
there,
it's
going
to
be
having
a
part
of
it
being
tech,
and
it's
more
like
the
most
important
feature
about
this-
is
to
deliver
faster
features
and
that's
why
we
moved
from
a
pool
based
system
when
it
comes
to
cicd
to
a
push-based
system.
Actually,
is
that
the
vice
versa
wave
with
the
githubs
we
actually
pulling
the
changes
from
the
the
git
repositories?
D
Now,
with
this
particular
model,
we
have
a
better
transparency
and
a
better
dx
as
well
for
our
developers,
because
when
interacting
with
infrastructure,
it's
not
just
about
having
a
pipeline.
It's
thinking
about
the
oversight,
so
how
the
developers
do
actually
interact
with
this
pipeline.
Do
they
have
enough
abstraction?
D
On
top
of
all
the
configuration,
do
they
have
enough
flexibility
to
deliver
how
they
want
in
the
manner
they
want?
So
I
think
wave
with
the
githubs.
There
is
a
matter
of
transparency
and,
at
the
same
time,
it's
a
system
which
allows
it
for
our
developers
to
deploy
faster
as
well
and
one
of
the
things
that
I
want
to
mention
that
I've
been
encountering
in
the
in
the
past
teams
as
well.
D
When
we
used
a
pool
based
system
they're,
always
we
had
different
environments,
but
the
staging
of
the
production
environment
would
always
be
different.
There'd
be
the
case
where
the
changes
would
be
deployed
in
staging
and
they
would
be
working
fine
and
then
towards
the
production.
We
always
would
have
a
change
window,
which
means
or
you
you
do
it
in
a
particular
day
or
a
particular
hour,
and
usually
that
happened
to
result
with
multiple
commits
to
be
pushed
at
the
same
time,
which
increased
our
pretty
much
disaster
rate.
B
F
B
Security
vulnerabilities,
like
cross-site
scripting
and
asking
developers
to
do
output
encoding
now
commonly
used
tools
commonly
used
frameworks
like
angular,
like
react
and
so
on.
They
do
that
output
encoding
automatically
for
the
development
team,
and
I
really
see
git
ops
as
kind
of
the
next
evolution
of
this
with,
as
you
were,
all
saying,
everything
as
code
now
we're
building
in
we're
not
just
using
it
in
a
framework
that
is
used
within
the
application
itself,
but
these
platforms
right,
various
git
platforms
and
so
on.
Have
these
different
checks
and
allow
us
to
do
this.
B
Incrementally
we
no
longer
have
to
use
that
one
big
one-time,
big
scanning
factory,
the
big
bang,
scan
if
you
will,
and
so
now
we
can
incrementally
do
this,
treat
everything
as
code
and
really.
I
think
this
is
where
the
future
of
security
is
going.
We
in
security
need
to
take
more
of
this
engineering
mindset
and
adopt
all
of
these
best
practices
to
again
reduce
that
window
of
exposure.
A
Is
kubernetes
becoming
the
de
facto
now,
and
so
you
know
whether
you're
using
a
kubernetes
environment
or
not,
it's
it's
relevant
now
and
get
us,
because
there
are
some
limitations
when
you're
using
non
non-kubernetes
environments.
But
are
we
getting
closer
to
the
point
where
the
really
the
de
facto
is
you
know
is
looking
like
it
will
be
kubernetes,
maybe
not
anytime,
maybe
not
anytime
soon,
and
how
does
security
play
into
that
as
a
consideration.
C
E
C
Container
world
definitely
kubernetes
is
becoming
the
de
facto
standard.
You
know
from
my
perspective
personally
I'm
keeping
a
very
close
watch
at
some
emerging
projects
like
cubewort,
because
if
I
can
use
kubernetes
to
now
manage
my
my
vms
good
lord,
you
know,
and
that
is
the
de
facto
standard.
So
I
don't
know
if
kt
you
or
or
anybody
else
has
any
opinions
on
cube
word,
but
I
would
be
very
interested
if
I
can
use
the
kubernetes
control
plane
to
manage
both
my
containers
and
my
vms.
E
F
F
Maybe
the
gear
heads
of
you
know
really
out
there
in
terms
of
application,
but
get
lab
acquired
some
fuzz
testing
companies
last
year
and
have
embedded
it
with
the
goal
of
making
it
much
more
mainstream
and
more
usable,
because
what
fuzz
testing
can
do
is
find
things
that
you
didn't
know
to
look
for.
You
know,
and
I
think
that's
the
kinds
of
problems
that
we'll
get
into
in
the
infrastructure
side
of
things.
You
know
application
security
has
been
around
for
a
long
time.
A
This
also
gets
into
questions
of
policy
and
there's
almost
like
these
different
phases
of
these
different
personas
that
we
see
in
the
kubernetes
environment.
You
have
the
developers,
you
have
the
people
that
do
the
configurations
who
are
often
developers,
and
then
you
have
to
think
about
the
policy.
A
So
we
have
seen
the
open
policy
agent
emerging
opa
and
how
does
that
fit
in?
And
how
does?
How
do
you
think
about
policy?
Because
I
think
what
that's,
what
cindy
is
alluding
to
a
little
bit
when
we
hear
her
talk
about?
You
know
that
those
check
boxes
and
then
kind
of
the
new
scanning
capabilities
that
we're
starting
to
see
that
are
just
becoming
practice
and
emerging
from
practices
that
were
established
long
ago.
E
Right
and
alex
just
a
quick,
you
know
point
I
would
like
to
add
to
your
previous
question
as
well,
which
is
about
is
kubernetes
becoming
slowly
slowly,
the
default
or
de
facto.
You
know
platform
for
deploying
applications
of
all
scale
and
size.
I
think,
without
kind
of
you
know,
going
too
deep
into
the
kubernetes
discussion.
One
of
the
empirical
evidences
that
I'm
getting
as
a
vendor
is
look
into
the
fact
that
we
have
companies
like
d2
iq.
E
These
you
know
products
are
giving
a
lot
of
indication
that
there
is
a
lot
of
demand
for
kubernetes,
not
just
container
orchestration,
but
cluster
management
as
well
and
cluster
management
means
large-scale.
Businesses
are
adopting
it.
So
that's
one
kind
of
empirical
evidence
to
your
previous
question.
As
far
as
the
policy
enforcement
goes,
you
know
so,
as
I
said,
right,
git,
ops
technologies,
you
know,
thankfully,
are
built
on
a
very
solid
foundation
of
you
know
being
declarative
in
nature.
So
what
that
it
means.
It
means
that
we
have.
E
You
know,
infrastructure,
score
technologies,
like
you
know,
hem,
charts,
customize
and
many
other
being
the
foundation
of
delivering
githubs.
With
that
you
know
we
today
in
the
in
the
space
where
we
are.
We
are
at
a
maturity
level
where
we
have
projects
like,
as
I
said,
open
policy
agent
available
which
solve
the
problem
of
polyglot
infrastructures
code,
all
infrastructure
score
technologies
have
some
differences
between
them,
but
as
soon
as
you
start
using
frameworks
like
opa
to
solve
your
policy
enforcement,
you
get
a
lot
of
advantages.
E
Thankfully,
as
I
said,
gitoff's
technologies,
almost
all
of
them
can
very
easily
support
frameworks
like
opa.
Some
other
framework
is
can
also
be
supported,
but
opa
being
the
de
facto
standard
in
policy
is
code.
Today
you
know
with
so
many
different.
You
know
stars
that
we
see
them
earning
on
daily
basis.
That
tells
me
that
you
know
opa
is
winning
the
race.
It
allows
us
to
do
policy
enforcement
and
governance
within
the
get
offs.
E
E
A
C
So
I
think,
from
from
my
perspective
right
this
is
this
is
an
exciting
time
to
be
to
be
in
technology
right,
because
we
have
seen
the
evolution
of
you
know.
Containers
come
from,
you
know
where
it
was,
nobody
knew
what
would
happen
right
with
containers.
Is
it?
Is
it
going
to
be
the
standard,
and
we
saw
you
know
kubernetes
and
come
to
the
scene
and
in
just
a
couple
of
years
become
the
the
you
know,
the
mechanism,
the
the
technology
everybody
uses
and
this
entire
ecosystem
right?
C
I
was
showing
the
cncf
chart
to
somebody
other
than
you
know.
Saying:
okay,
get
your
powerful
microscope
on
a
magnifying
glass.
Won't
do
any
more,
just
look
at
the
technologies
there
right
I
mean
and
it
you
know
they
show
the
funding
on
top
on
that
child.
That's
a
that's
a
brilliant
scare,
the
children
chart,
but
what
it
tells
you
is
that
there
is
a
healthy
ecosystem
behind
everything
we
are
doing.
This
is
not
you
know,
running
solo.
C
This
is
not
some
open
source
project
which
people
might
lose
interest
in
tomorrow,
and
how
do
you
make
it
secure,
and
how
do
you
ensure
the
security
and
compliance
overhead
which
we
and
large
enterprises
have
to
maintain
anyone,
I'm
just
speaking
from
my
perspective,
have
to
have
to
manage.
This
is
not
going
to
be
the.
What
keeps
us
from
adopting
these
technologies.
I
think
that's
what's
exciting.
To
me
is
that
you
know
these
technologies
like
opa
the
ability
to
do
policy
as
code
security
as
code.
C
A
D
Yeah,
so
kubecon
is
hdma
and
it's
going
to
be
virtual
as
well.
I
think
there
is
going
to
be
a
lot
of
good
stories
from
again
I'm
going
back
to
the
end
users.
So
the
end
users
are
pretty
much
the
practitioners
of
cloud
natives
there's
going
to
be
a
good
kind
of
amount
of
talks
around
githubs,
and
I
think
especially
talking
about
the
collocated
event.
D
There's
going
to
be
the
security
day
as
well,
and
there
has
been
a
lot
of
the
actual
schedules
out
and
there's
a
lot
of
good
pointers
that
I'll
talks
that
I
would
recommend
for
everyone
to
to
watch
as
well.
So,
in
terms
of
like
the
cicd
part,
the
git
ups,
the
security
there
is
going
to
be
an
amalgamation
of
of
good
kind
of
pointers
and
information
points
throughout
the
event.
So
I
hope.
A
Great
well,
thank
you,
everyone
for
joining
us
now,
it's
time
for
some
questions.
Please
ask
those
questions
and
I
want
to
just
maybe
just
quickly
go
through
who
we've
had
join
us
all
motion.
Donnie
is
co-founder
and
and
ciso
and
cto
at
acurix.
Thank
you.
Cindy
blake
senior
security
evangelist
at
get
lab
frank
kim,
fell
at
the
sands
institute.
Sanji
sharma
had
a
platform
of
engineering
at
truest
financial
and
katie
gamange
ecosystem
advocate
at
cncf.
Thanks.