►
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
West Side CD: The Deployment Ballet Goes On - Benoit Moussaud, VMware Tanzu
The way to bring a new version into production has changed a lot in recent years. From a slow, manual, and uncontrolled processor it has become over time fast, automated, and versioned. The tools have evolved, changed, been modernized, or even containerized, but they have remained centralized. The new generation of solutions intends to reverse this point of view by relying no longer on orchestration but on choreography between the different stakeholders. This session shows the difference between these two concepts and how it applies to the CI/CD domain that has remained ultimately very centralized and old-school then describes an innovative solution, (cartographer.sh) based on the concept of supply chains.
A
A
I'm
french,
I'm
living
in
paris
and
I
started
my
career
as
a
developer
in
c
c
principles
in
java
and
then
I
move
an
architect
and
consultant
doing
performance
around
app
server
in
g2e
the
last
10
decade.
I
spent
them
into
the
devops
world
and
in
detail
in
the
continuous
integration
and
continuous
delivery.
A
subsys
system
in
a
company
called
xibialabs
in
this
company.
We
had
a
solution
that
helped
the
company
to
perform,
diplomat
automation
and
raise
automation.
A
So
the
persona
we
have
four
personalities
in
presentation.
The
two
first
are
very
well
known:
the
dev
and
the
ops.
So
the
dev
is
writing
the
application
and
commits
some
code
to
with
a
new
idea
to
manage
the
business
and
the
op
is
running
the
application
on
the
different
environments
and
in
between
now,
for
few
years,
we
have
two
more
persona.
A
On
the
other
side,
we
have
the
sre
coming
from
the
google
world,
the
site,
reliability
engineer
that
help
helps
team
to
manage
the
run
of
the
application.
So
in
fact
we
have
four
personnel
now
in
the
story,
and
the
story
is
the
following:
we
want
to
deploy
application
in
production,
so
in
the
large
company
or
even
small
company,
you
have
blue
application,
you
have
yellow
application,
or
sometimes
you
have
a
red
application
running
for
only
on
go
long.
A
While
you
have
replication
running
on
java
and
the
target
is
really
the
production
environment,
but
before
getting
in
the
production
environment,
you
need
to
promote
your
application
into
several
environments
to
do
some
tests.
So
typically,
here
we
have
four
environment,
but
it
could
be
three
could
be
twelve
depending
your
organization
and
the
complexity
of
your
application
and
the
operation
between
two
environments.
It
will
promote
the
application
between
one
environment
and
to
another
one,
and
before
doing
that,
we
need
to
integrate
the
integration
phase
is
in
fact
a
process
that
will
turn
your
stature
code.
A
In
fact,
a
commit
or
branch
or
tag
into
a
set
of
deliverable
item
or
versionable
item.
So
in
the
legacy
world
it
was
xe
file,
dll
file,
java
file,
jar
file
and
now
in
the
container
world
is
the
container
image
and
this
artifact
will
be
pushed
into
maybe
a
file
system,
but
it
could
be
now
into
repositories
such
as
artifactory
or
image
registry,
but
on
the
other
side
of
the
binary
we
have
also
the
configuration.
So
it
could
be
only
simple
java
application
with
a
configure,
a
dot
property
file
configuration.
A
But
now
we
have
tons
of
yaml,
json
and
other
language
to
help
to
configure
your
application,
because
now
you
manage
not
only
the
application
part,
but
also
the
infrastructure
part.
It's
not
new.
All
this
process
has
been
described
in
two
famous
books,
continuous
integration
and
continuous
delivery,
and
if
the
continuous
integration
is
now
a
well-known
phase
in
the
company
that
mainly
legacy
phase,
the
continuous
deployment
and
continuous
delivery
is
still
an
issue
and
cloud
native
application
offers.
Some
solution
then
bring
new
issues.
A
The
process
is
like
this
one
task,
one
other
task
and
the
other,
but
in
fact,
in
middle
we
have
what
we
call
an
orchestration
tool
and
orchestrator
and
in
fact
the
relationship
between
the
tasks
are
not
directly
behind
the
between
the
tasks,
but
only
between
the
tasks
and
the
orchestrators,
the
okay.
So
to
trigger
something
wait
for
the
end
and
wait
and
trigger
another.
One,
maybe
can
do
perform
some
operation
in
between.
A
A
A
Also,
we
have
at
the
end
very
tightly
coupled
tasks.
That
means
it's
very
complicated
to
create
a
task
you
can
reuse
or
you
can
substitute
from
another
process.
So
at
the
end,
it's
a
melting
between
all
the
tasks
and
it's
complicated
to
have
or
to
switch
one
task
for
another,
or
also
as
if
everything
is
centralized.
A
So
it
is
for
one
process
and
at
scale
we
have
more
or
less
the
same
problem.
Of
course
we
can
have
a
team
using
golong.
Another
is
during
python
and
the
other
is
using
java,
and
the
process
is
only
set
up,
often
at
during
sprint,
zero,
with
building
block
provided
by
the
software
factory
team.
Without
any
update
and
at
the
end,
you
have
a
different
path
to
production
between
different
languages,
complicated
to
have
something
you
can
reuse
between
the
different
projects
and
often
in
a
large
organization.
A
A
A
The
other
point
of
view
is
to
see
this
process
as
a
choreography,
so
in
a
dance
team
in
the
choreographic
team,
when
the
music
starts
to
play,
every
dancer
knows
how
to
do,
and
maybe
one
dancer
can
flow,
can
fail
and
can
fall
and
the
global
process
can
be
autonomous
and
can
continue
to
to
run
without
was
someone
that
can
tell
you
need
to
start
over
or
not.
This
is
the
main
difference
between
the
orchestration
and
choreography.
A
Maybe
we
can
have
someone
that
can
help
another
resource
to
watch
the
output
of
the
resource,
a
and
maybe
to
create
and
to
inject
the
input
of
the
resource,
a
into
the
input
of
a
resource
b.
So,
for
example,
to
have
the
output
of
x
going
into
input
of
w,
and
you
need
to
have
a
component
that
brings
the
two
all
together.
A
This
vision
also
can
be
like
an
electronic
board.
That
means
it's
typical:
the
pattern
where
we
are
doing
electronics,
where
you
plug
the
output
of
one
component
as
an
input
and
another
one,
and
often
you
can
mix
to
have
something
very
clever,
but
in
the
cicd
process
this
process
this
option,
this
new
solution
is
the
cartographer
project,
so
the
catalog
catagrapher
project
is
is
already
a
cncf
project.
So
everybody
knows
this
landscape
and
we
will
focus
only
on
the
continuous
delivery
subsystem
with
two
famous
projects
called
argo,
cd
and
flux
cd.
A
A
I
want
to
remove
this
one,
and
I
want
just
to
keep
the
task
like
this,
and
in
fact
the
first
thing
I
want
to
do
is
to
encapsulate
all
the
tasks
to
only
focus
on
two
on
the
input
and
the
output.
That
means,
in
fact,
I
have
no
more
blue
task
or
orange
task
and
a
red
task.
I
just
have
green
tasks
and
only
focus
on
the
input
and
the
outputs
and
what
I
want
to
do
now.
This
output
will
be
all
connected
together.
That
means.
A
A
This
process
will
be
gathered
into
a
concept
called
blueprint
to
be
a
easier
shareable
and
create
a
description,
and
this
is
what
we
call
a
blueprint
in
choreographer
cathodographer
controller.
This
controller
can
be
deployed
on
any
kubernetes
conformant
cluster.
That
means
you
don't
need
to
have
a
tomzu
cluster.
You
can
use
your
aks
eks
or
whatever
distribution
it
will
run
so
this
process,
this
blueprint,
are
not
owned
owned
by
the
sle
and
app
ops.
A
In
fact,
they
have
the
knowledge
to
bring
the
application,
how
to
integrate
the
application,
how
to
deploy
the
application
and
on
the
other
side
we
will
have
the
dev
that
will
in
fact
create
and
asking
for
a
new
workload,
so
the
dev
will
specify.
I
want
the
workload
to
integrate
my
java
service,
so
I
want
to
integrate
my
golang
aai
database
service
and
based
on
the
specification.
The
category
controller
will
create
an
indirection
and
find
out
what
what
will
be
the
right
blueprint
to
instantiate
to
manage
the
integration
phase.
A
On
the
other
side,
the
ops
will
describe
a
delivery
and
using
the
same
process,
the
category
controller
will
find
out.
What
will
be
the
the
blueprint?
Will
be
instantiated
and
in
fact
it's
very
important
to
have
this
separation.
In
fact,
you
are
someone
that
wants
to
run
it
and
you
want
to
and
other
personnel
that
want
to
deliver
it.
So
as
a
dev,
I
need
to
integrate
my
code
and
as
an
app
ops,
I
offer
deaf
people
a
supply
chain
as
a
service
on
the
shelf.
A
But
it's
time
and
we
are
at
cubecom
so
it's
time
to
have
some
yaml.
So
we
have
here
the
description
of
the
workload
and
the
workload
is
the
description
to
do
an
integration
phase,
so
you
will
have
resource
so
catagrapher
brings
a
new
set
of
crd
and
the
first
one
is
the
workload
in
which
the
user
will
specify
the
workload.
So
you
can
see
it
don't
specify
exactly
a
name
but
provide
labels
and
based
on
these
labels
or
pro
or
base
on
the
properties.
The
category
for
controller
will
instantiate
the
right
blueprint.
A
It
can
provide
all
sorts
parameters
about
the
the
git
repo
and
some
parameter
to
configure
my
other
services,
for
example.
If
I
want,
if
I
need
a
db
or
not
to
be
included
into
my
database
into
my
service,
so
if
I
have
a
new
workload,
I
I
am
in
this
situation,
so
I
submit
my
new
workload
and
based
on
the
specification
in
my
workload
and
what
I
have
in
my
catalog,
based
on
the
permission.
A
Of
course,
cartographer
will
instantiate
the
blueprint
and
by
this
will
in
create
new
resources
based
on
the
template
described
in
the
blueprint.
So
in
fact,
you
have
something
like
this.
That
means
associated
to
my
workload.
I
will
have
a
set
of
resources
tied
to
the
lifecycle
of
the
workload,
so
the
resources
are
not
tied
to
the
catalog
for
controller
I'm
not
tied
to
the
blueprint
but
really
tied
to
the
workload
that
mean.
If
I
change
my
workload,
the
resource
can
be
changed.
A
If
I
delete
my
workload,
all
the
resource
will
be
deleted,
so
we
have
a
relationship
like
this.
So
at
the
end,
what's
the
deployment,
a
deployment?
In
fact,
the
combination
of
three
repositories
managed
by
four
persona.
We
can
have
the
dev
managing
the
application
configuration.
We
have
the
upstream
or
ops
personalizing
the
environment
configuration
as
a
declarative,
desired
state
and
we
have
different
modules
in
a
repository
called
different
configuration
managed
by
devops,
app
ops
and
software
factory
and
sre.
A
On
the
other
side,
the
op
scene
will
want
to
run
the
application,
maybe
describe
the
environment,
and
all
this
repository
will
be
mixed
all
together
to
create
new
delivery
that
will
pull
all
this
information
in
order
to
deploy
this
application.
This
is
what
we
call
a
github's
pull
mode,
so
this
pull
mode
is
really
what
we
call
a
level
three
or
four.
A
I
don't
remember
exactly
a
very
high
level
of
security
consistency
in
which
you
are
able
to
safely
deploy
your
application
and
maybe
to
scale
your
cluster,
replicate
your
cluster
either
for
high
availability
or
for
a
test
or
replication
of
bug.
So
now,
if
we
zoom
the
ci
process,
we
will
have.
In
fact
I
want
to
move
from
dev
to
application,
repo
and
imager
history,
and
my
supply
chain
will
be
a
combination
of
four
resources.
A
The
first
one
is
coming
from
flux
cd,
because
in
the
cartographer
project
we
promote
to
reuse
a
set
of
existing
cncf
components,
so
git
repo
fluxed
will
watch
the
repo.
As
soon
as
I
have
a
new
commit,
it
will
trigger
a
buildback
kpac
image
in
order
to
build
an
image.
So
this
project
is
based
on
the
cloud
native
buildback
that
helps
any
users
to
build
reliable,
docker
image,
and
this
image
will
be
docker
pushed
to
my
image
registry.
Then
we
have
the
generation
of
my
configuration
that
will
be
automatically
commit
into
my
application.
A
Configuration
using
tekton
so
in
in
detail,
what's
happened,
so
I
have
my
git
repo
there
with
all
my
parameters.
So
it's
a
standard
kubernetes
resource
with
a
specification
and
the
status
as
soon
as
I
have
a
new
commit,
my
status,
outputs
change
with
a
new
repo
indicating
I
have
a
new
commit
watching
my
repo
on
the
other
side,
I
have
my
image
that
need
to
have
this
value
and
in
fact
the
role
of
cartographer
is
to
create
a
link
between
the
two
resources.
A
In
fact,
the
cartographer
will
propagate
the
modification
of
the
output
to
as
an
input
to
the
other
one.
So
in
fact,
the
role
of
cartographer
is
to
do
a
kind
of
cube
cartel,
edit
of
an
item
for
given
resources
managed
by
cartographer.
So
in
fact,
cathodographer
is
kind
of
wire
between
two
resources
and
it's
only
its
role.
So
it's
not
it's
typically,
not
a
sport,
because
it
try
only
to
promote
value
and
health
or
the
resource
we
work
as
alone.
A
A
A
So
what
what
kind
of
information
I
want
to
commit?
So
this
information
are
managed
by
the
dev
side
and
we
can
imagine
having
the
kind
of
structure,
so
it
could
be
a
file
system
or
git
repo
with
a
application
folder
and
between
this
application
folder
I
have
two
applications
called
loader
and
micropads
and
below
micropads.
You
have
a
version.
I
use
a
timestamp
to
create
a
version.
I
can
have
also
current
version.
A
So
in
fact,
when
I
commit
something
in
here
as
an
output
of
my
integration
phase,
I
want
only
to
commit
this
value
and
what
we
have
inside
this
value.
We
don't
have
cube
communities
resource,
but
we
have
only
the
things
managed
by
the
dev
side.
Of
course,
we
have
the
commit
of
the
of
the
new
image
and
we
have
the
name
of
the
application,
the
name
of
the
service
and
some
parameters.
A
On
the
other
side,
we
have
the
up
steam
that
can
describe
and
manage
all
the
environment,
so
it
could
be
prod,
environment,
non-product,
environment,
environment
and
we
can
have
the
following
structure
where
I
can
have
split
air
in
my
sample
environment
per
per
scaler.
So
I
haven't
on
iws,
on
azure
and
on
the
sphere
and
below
the
name
of
environment.
A
Using
the
same
principle.
I
have
environment
value
file
and
in
this
environment
value
file,
I
have
specification
and
value
managed
by
the
ops
people.
Typically,
I
can
put
the
name
of
one
environment.
I
could
specify
what
kind
of
ingress
I
want
to
use.
Is
it
contour
or
istio,
for
example,
and
which
will
be
the
exposed
public,
dns
and
the
internal
dns.
So
typically,
this
is
managed
by
the
ops
people
and
you
have
a
set
of
environment
and
in
between,
we
need
to
have
rules,
and
these
rules
can
be
described
like
this.
A
So
it's
a
set
of
a
set
of
level.
We
can
look
at
as
a
service
level,
so
we
based
on
the
information
provided
by
the
apps
and
the
dev
and
up
we
will
generate
standard
kubernetes
resource
could
be
cumulative
deployment,
containment
secret
service,
ingress
and
so
on.
But
maybe
I
want
to
try
to
deploy
my
application
using
k
native
and
I
can
have
an
order
that
could
be
a
k
service
so
instead
to
generate
resources,
kubernetes
resources,
but
generate
only
cognitive
service.
I
have
also
imagined
non-service
that
only
replace
value.
A
A
This
white
ct
is
coming
from
a
project
a
bucket,
also
by
a
vmware
called
carvel
and
carvalho
offers,
in
fact,
a
set
of
tools
with
a
philosophy
with
one
tool.
One
feature
that
is
not
the
tools
like
doing
all
the
things
of
course
at
the
end,
is
performing
templating,
generating
and
deploying,
but
try
to
have
some
specific
tool
doing
once.
One
thing:
for
example,
one
tool
to
only
sign
an
image
create
a
unique
reference,
so
carve
is
very
interesting
project
and
in
this
project
we
have
two
interesting
tools.
A
The
first
one
is
is
called
ytt,
so
ytt
stands
for
yaml
template
tool,
so
only
process
yammer
so
not
only
provide
a
way
to
replace
value
in
it,
but
also
to
create
some
overlay.
And
if
you
are
a
bit
of
dev
guys
using
python
is
code,
you
can
also
generate
some
code
and
write
some
code
to
help
you
to
generate
some
code,
and
this
is
very
interesting
because
you
can
use
it
for
any
yaml
tool.
A
A
A
It
does
two
things.
The
first
thing
is
to
gather
a
set
of
resource
under
a
name
could
be
application,
name,
service,
name
component
name
so
in
which
it
will
stamp
all
the
resource
you
deploy
with
the
name,
and
it
will
control
all
this
resource
as
the
same
lifecycle.
So
it's
avoid
to
have
someone
that
can
patch
your
resource
with
another
deployment
and
to
be
sure
everything
is
under
control.
A
Other
features.
It
is
a
synchronous
tool.
That
means
you
know-
or
if
you
are
here
when
you
are
doing
cube,
curtail
apply.
In
fact,
it's
just
to
apply
and
to
request
kubernetes
cluster
to
apply
this
configuration
increase
with
cap,
not
only
tap,
apply
the
configuration,
but
also
check
if
everything
is
up
and
running
locally,
that's
mean
check
if
my
pod
has
been
started.
If
my
ingress
is
correctly
created
and
so
on,
so
we
have
a
checklist
and
at
the
end,
you
have
a
clear
state.
A
If
it
is
deployed
or
not
so
you're
very
interested,
so
you
can
use
it
right
now
on
your
schematics
cluster,
but
in
your
sample
we
will
use
the
server
side
of
this
project
with
a
component
called
k,
app
controller
that
will
in
fact,
a
mix
between
ytt
and
k,
app
server
side.
In
fact,
you
will
have
a
resource
described
like
this,
where
you
can
specify
a
set
of
repository
where
you
want
to
fetch
information.
You
can
specify
the
way
to
deploy.
A
If
you
want
to
do
it,
synchronously
allow
upgrade
or
share
resources
and,
at
the
end,
the
state
of
the
resource
will
reflect
your
deployment
and
for
the
deployment
phase
we
will
use
also
another
resource
called
smok
test.
It's
not
because
you
have
all
your
resources
updated
and
deployed
at
the
kubernetes
level.
That
means
all
together
is
okay.
Everybody
has
already,
as
a
to
troubleshoot,
to
connect
your
ingress
to
your
service,
to
your
port,
to
your
config
map,
to
your
volume.
So
at
the
end,
it's
not
because
all
your
components
are
deployed.
A
Everything
is
okay,
so
I
have
a
personal
side
project
called
smok
test
operators
that
provide
a
way
to
trigger
a
smoke
test
to
validate.
If
I
can
trigger
something
from
the
beginning
and
the
end
so
to
have
something
to
call
a
dedicated,
ap
call
or
the
main
web
page
on
my
web
app
in
order
to
check
everything
is
correct.
A
So
now,
if
we
want
to
create
a
choreography
of
all
this,
in
fact,
we
will
have
a
delivery
that
will
specify
several
git
repositories
that
will
watch
the
deployment
rules,
the
application
configuration
and
the
environment
configuration
and
as
soon
as
you
have
one
disease
item
that
modified
the
output
of
the
git
repo
will
be
moved
and
will
be
injected
into
the
cap
controller.
That's
been,
in
fact,
you
are
really
the
output
of
each
git
repo
injected
into
my
cap
controller.
A
A
A
Like
this,
so
using
the
same
pattern,
we
add
for
workload,
we
create
a
new
resource
and
the
catagraph
controller
generate
and
instantiate
the
associated
resource,
and
you
can
see
there
for
my
deliverable
dogs.
I
will
have
app
dogs
3g
triple
and
the
smoke
tests
and
the
smoketech
trigger
a
drop
that
triggers
opponent,
and
you
can
see
everything
is
under
control
and
using
the
same
life
cycle
than
deliverable,
nothing
managed
directly
by
at
the
runtime
by
the
cartographer.
A
So
if
we
want
to
wrap
up
this
presentation,
so
choreography
with
cartographer
is
really
a
new
way
to
doing
ci
cd
and
what
I
prefer
to
say,
an
opinionated
way
to
do
ci
cd.
Maybe
it's
not
something
really
new
that
it's
worth
to
have
something
new
to
have
in
mind,
maybe
to
improve
our
current
process,
and
it's
always
good
to
have
side
project
and
other
projects
to
try
to
make
have
a
new
mind
of
our
current
delivery.
A
Also,
he
offer
really
or
to
add
the
complexity,
because
you
have
really
a
separation
of
concern
between
the
upstream,
what
we
and
the
dev
team
and
the
app
ops
and
the
sre
with
the
same
way
to
instantiate
it
very
important
to
have
the
same
contract.
In
fact,
whatever
you
are
doing,
deploying
go
integrating
dot
net
core
or
java.
The
contract
will
always
to
create
a
new
workload
or
create
a
new
deliverable
and
based
on
the
specification
based
on
this
resources,
a
new
blueprint
will
be
instant
or
upgraded
depending
the
need.
A
A
A
Now
you
can
create
in
one
click
using
your
docker
dev,
a
new
cluster
using
tonto
community
edition,
and
you
have
already
the
way
with
the
set
of
package
on
the
right,
all
the
components
to
not
only
deploy
cartographer,
but
also
to
deploy
all
the
needed
package,
for
example,
kpac,
karl
tools
and
and
tech
tunnel.
So
it's
ready
to
be
deployed
and
ready
to
be
used.
If
you
don't
want
to
use
tons
of
community
community
edition
kubernetes,
you
can
apply
this
same
package
on
your
aks
or
your
own
cluster.
A
A
What's
the
difference
between
carvel
and
elm,
in
fact,
we
are
more
or
less
on
the
same
level.
In
fact
it
we
can
see
them
as
a
competitor.
You
can
use,
for
example,
ytt
with
elm.
Typically,
you
have
an
m
chart
and
you
want
to
modify
a
parameter.
You
can't
modify
with
l,
because
it's
not
in
the
in
the
value
you
can
using
l,
generate
pipe
using
ytt
pipe
using
cube
cutter
to
deploy
your
uncharted
to
configure,
and
if
you
don't
like
l
to
deploy,
you
can
replace
the
wall
2
chain
by
k,
app.