►
From YouTube: Flux Maturity, Feature, and Contrib Update - Kingdon Barrett & Somtochi Onyekwere, Weaveworks
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Flux Maturity, Feature, and Contrib Update - Kingdon Barrett & Somtochi Onyekwere, Weaveworks
Speakers: Kingdon Barrett, Somtochi Onyekwere
Join Flux Maintainers for this informative session on important updates! We will share what we've done to make it easier to contribute to Flux, where Flux is at in terms of maturity, and where Flux features are at, both old and new. The contribution update will preview what you can expect for Flux's participation in the KubeCon contribfest, and invite everyone to contribute at whatever level they are able. Flux maturity update will give a high level of Flux's production readiness for different use cases. Including security topics such as multi-tenancy threat modeling, where Flux helps mitigate security issues/concerns, recommended deployment models, and so on. We will end with a recap of key features landed in the last 6 months, and encourage users to upgrade to make use of both tried and true as well as the latest features.
A
A
Questions
will
be
welcome
at
any
time
and
let's
get
started
so
the
latest
flux,
update,
I,
think
was
Monday
flux,
0.36
and
this
update
and
my
understanding
it
rounds
out
our
integration
with
cosine.
So
now,
if
you
want
to
verify
your
sources
before
you
apply
them
to
the
cluster,
you
can
use
cosine
to
do
that,
whether
they
are
Helm
charts
or
not
whether
they're
customized
overlays,
so
big,
big
news,
that's
great
their
support
for
both
keyed
and
keyless
cosine
integration,
and
we
have
a
list
of
other
oci
related
features.
A
I
didn't
mention
oci
there,
but
the
the
bit
that
makes
it
work
together
with
customized
manifests
is
the
oci
repository
Source
support
that
was
added
in
a
few
releases
prior,
so
there's
been
a
flurry
of
releases
in
the
last
few
months
and
I
wanted
to
point
yep
I
think
it
was
that
one
yep,
this
blog
post,
that
was
it's
the
top
one
on
the
fluxcd.io
blog
right
now
has
the
progression
from
0.31
to
0.36,
and
you
can
see
at
this
top
or
hopefully
you
can
see.
Is
this
large
enough.
A
So
we
started
adding
support
for
Helm
repositories
of
type
oci,
which
has
been
a
long
time
coming.
People
have
been
asking
for
that
feature
for
a
long
time
and
it
was
unblocked
by
Helm
who
brought
that
feature
out
of
experimental
and
put
it
into
the
SDK
where
we
could
access
it,
so
that
was
added
in
June
and
in
August
we
added
a
support
for
customized,
overlays
and
also
terraform
code
in
oci
artifacts.
So
what
that
means
is
you
can
take
your
manifests
out
of
the
git
repository,
which
may
be
a
mono
repo.
A
It
may
be
expensive
to
clone
and
clone
again
and
you
can
push
them
to
an
oci
Repository,
very
similar
to
an
image
repository
similar
standard
but
capable
of
holding
all
different
kinds
of
formats
of
media
types.
So
you
load
your
manifests
into
an
oci
repository
and
then
they
have
the
contextual
semantics
of
like
an
image.
So
you
can
use
the
features
of
flux
that
are
related
to
images
for
manifests,
which
has
been
another
difficult
area
in
the
past.
So
you
can
talk
about
yeah.
B
Sure
we've
also
updated
the
flux
CLI
to
also
help
you
push.
If
you,
if
you
sort
of,
have
a
folder
containing
this
manifest
right,
there's
a
flux,
push
active,
oci
command
that
helps
you
to
push
or
pull.
If
you've
already
pushed
an
image,
you
can
easily
pull
it
with
the
fox
say
so.
Basically,
it
would
probably
be
most
useful
in
your
CI.
Maybe
you
want
to
do
a
release,
so
you
could
use
the
flux,
CLI
to
say,
flux,
push
this
directory
into
this
oci
image
and
push
it
to
your
OCR
Repository.
A
B
C
B
A
B
So
we
co-sign,
there
are
two
ways
you
could
use
like
Kingdom
mentioned
earlier:
keyed
and
keyless.
Basically,
we
co-sign
you
could
generate
keys
or
they
have
supports
for
keyless
verification
of
like
your
container
images
where
it
uses
something
like
a
GitHub
token
to
instead
of
you,
you
know
provisioning
like
a
private
and
public
key.
You
don't
need
to
do
like
the
key
management
for
you.
Basically,
that's
like
the
keyless
feature
with
cosine.
So
if
you're,
using
the
key
or
keyless
feature
flux
allows
you
to
verify
your
actifact
ewes.
A
So
I
want
to
highlight
another
thing
that
we've
been
working
on
is
growing.
Our
contributor
pool
we'd
like
to
add
more
contributors
of
different
standing
in
the
community.
Like
end
user
contributors,
you
can
join
the
flux
community
in
a
variety
of
different
ways,
but
we
have
this
contributor
ladder
now
that
we've
added
in
the
last
year,
where,
instead
of
having
such
a
wide
gap
between
a
person
on
the
street-
and
you
know
GitHub,
start
Giver-
maybe
that's
a
nice
thing
that
you
can
do.
A
Actually,
please
give
us
a
star
on
GitHub
code,
Flex,
CD,
flux2
and
add
one
would
be
great,
but
you
know
you'd
like
to
do
more
than
that.
Maybe-
or
maybe
you've
already
done
more
than
that,
and
we
want
to
recognize
that
if
you're
part
of
the
flux
community,
so
we
have
this
project
member
status.
Now
that
you
can
apply
for
you
need
two
sponsors.
They
should
be
from
two
different
companies.
A
D
We
feel
like
you
all
here,
are
pretty
in
a
pretty
good
state
to
contribute
to
flux,
because
you
know
what's
good
with
flux
and
also
what's
wrong
with
blocks
or
what
flux
fails
to
get
right.
So
if
you
have
any
ideas
about
you
know,
oh
flux
should
be
doing
this
instead
of
this,
or
you
know,
it
would
be.
Creative
flux
could
do
that
as
well
like
just
you
know,
try
to
create
issues,
even
that
is
for
form
of
contribution.
So
we
really
appreciate
that
as
well.
B
I
think
we
also
want
to
highlight.
Hopefully
no
one
here
is
using
version
one
of
flux,
but
we
will
be
archiving
The
report
really
soon.
I
think
we're
still
running
migration
workshops
for
people
who
want
to
migrate
from
the
first
Vlogs.
We
want
to
be
to
put
in
a
lot
of
work
to
make
sure
there's
future
priority
between
the
two
and,
of
course,
V2
has
been
getting
all
the
good
new
stuff.
So
if
you're
still
on
V1,
please
migrate,
you
could
come
around
the
Vlogs
boots.
A
So
here's
another
thing
on
the
website
I
want
to
highlight
this
is
the
flux
roadmap.
You
can
see
right
at
the
top.
The
focus
is
on
production,
Readiness
and
we're
moving
in
the
direction
of
GA.
We
should
hopefully
be
able
to
release
G8
and
soon
for
certain
definitions
of
soon
we'll,
hopefully
be
graduating
soon.
Also,
we
have
an
application
for
graduation
in
the
cncf,
we're
hoping
to
open
up
the
comment
period
as
soon
as
kubecon
is
over
yeah.
D
A
A
lot
of
work
that
goes
into
kubecon
and
a
lot
of
the
people
who
are
their
comments
are
necessary
to
make
the
graduation
process
meaningful.
You
know
we
want
to
give
space
for
them
to
think
and
give
us
meaningful
feedback,
so
that
was
a
decision
that
the
CNC
ftoc
made
and
we're
looking
forward
to
going
and
moving
towards
graduation
very
soon.
B
I
think
we
also
have
a
formalized
RFC
process.
Now
you
could
check
Slash
RC
Fuda
in
the
flux
V2
repo,
so
you
could
see
if
you
have
a
feature
request
you
with
basically
formalized
the
process
of
you
know
submitting
on
RFC
getting
reviews
getting.
It
approved,
tracking
tracking
the
various
pull
requests
related
to
that
RFC.
So
you
could
take
a
look
to
know.
What
are
the
current
features
we're
trying
to
add
in
or
if
you
have
something
to
add.
You
can
also
create
an
RFC.
A
D
Also
so
one
of
the
rfcs,
like
12
Odysseys
I,
think
are
about
multi-density
and
they're
right
now,
blocked
because
I
mean
we
can't
reach
a
general
consensus
or
we,
if
even
if
we
can
we're
finding
difficulty.
So
if
you
want
a
voice,
your
opinion,
how
we,
how
you
want
to
see
multi,
tenancy,
Shape
Up
in
flux,
you'll,
feel
free
to
like
comment
in
the
RFC
or
just
reach
out
in
the
slack
or
you
know,
join
a
community
meeting
and
bring
up
your
concerns
about
how
you
want
to
do.
Multi-Tenancy
in
flux.
D
Okay,
okay,
we
could
talk
about
the
various
grid
improvements
we
have
made
over
the
last
few
months.
So,
as
you
know,
git
can
be
a
bit
tricky
to
get
right
because
you
have
SSH
and
HTTP,
and
what
we
have
worked
on
over
the
past
few
months
is
improving
our
support
for
good.
So
we
have
made
it
basically
easier
to
contribute
to
any
any
of
our
git
packages.
D
D
After
a
long
time,
devops,
Azure,
devops
and
git
AWS
code
comment
support
that
has
been
improved
significantly
because
we
have
made
some
changes
to
how
we
clone
repositories
using
libgit2,
so
that
that
majorly
improves
clone
speeds
and
also
memory
and
CPU
users.
So
you
should
so
if
you
are
upgrading
from
something
like
I,
don't
know,
Point
0.25
or
something
if
you
have
an
upgrade
upgraded
your
flux
installation
in
a
long
time
and
if
you
upgraded
it
to
like
I.
Think
0.36
is
the
current
one
0.36
yeah.
E
B
So
I
I
think,
if
you
use
like
Azure,
devops
or
AWS
code,
commits
there's
a
PR
outs
to
basically
for
those
that
use
it.
You
know
that
we
have
a
git
implementation
field
where
you
need
to
specify
libgit2,
because
that's
what
work
is
works
with
those
repositories,
but
there's
been
a
PR
out
to
make
you
work
with
gogets,
which
is
the
usual
default.
So
if
you'd
like
to
test
it
out
is,
is
not
in
the
release
yet,
but
we
have
a
pull
request
open
and
there's
an
image
posted
there.
B
D
The
RC
is
out:
we
can
just
pull
it
up
so
like
if
you
or,
if
you
ever,
want
to
like
try
some
bleeding
edge
stuff.
So
we
usually
post
our
RCS
on
the
flux
contributors
channel
on
slack.
So
if
you
want
to
try
out
some
bleeding
edge
stuff-
and
you
know,
help
us
figure
out
whether
we're
moving
in
the
right
direction,
please
try
to
use
those
RC's
RC
images
as
well.
You
could
easily
do
that
using
a
customization
patch.
F
A
D
So
it's
this
beer
I,
don't
think
we
published
an
RCA,
but
we
will
soon
so
it's.
This
is
the
pr
which
enables
so
go
get
for
Azure,
devops
and
code
comment
as
well.
So
with
that,
you
should
see
a
much
more
stable
clones,
because
this
is
like
very
into
the
weeds
kind
of
thing,
but
go
get
is
written
completely
in
golang,
but
there
is
another
thing
which
you
use
called
lipgate
2,
which
is
written
in
C.
So.
D
E
D
So
yeah,
so
so
we
are
looking
forward
to
this
as
well,
so
this,
if
so,
if
this
gets
in
right
now,
it's
draft
and
we're
like
still
discussing
it
over.
But
if
this
gets
in,
you
should
see
a
much
more
stable
controllers,
especially
in
image
image,
automation,
controller,
so
I
I,
don't
know
how
many
of
you
here
are
running
image:
automation-
controllers,
oh
okay,
not
as
many
suspecting
but
okay.
D
B
Sorry,
just
a
quick
checking
that
we
should
don't
understand.
Is
there
anyone
here
who
is
hearing
about
Vlogs
for
the
first
time?
Okay,
okay,
we
have
a
couple
of
new
people.
Welcome,
welcome
so
yeah.
Sorry,
we
just
sort
of
got
right
into
it,
but
flux
is
a
tool
for
get
UPS.
Hopefully
you
know
what
get
UPS
is
get
UPS
is
basically
declaratively.
B
Defining
your
yamos
in
the
Version
Control
System,
the
most
popular
of
which
is
gits,
and
you
know,
flock,
sits
in
your
cluster
and
continuously
reconciles
the
state
you've
defined
in
your
repository
to
what
is
defined
on
cluster.
So
just
a
quick
overview
of
the
controllers
that
we've
been
talking
about.
Source
controller
is
for
pulling
in
the
yamos
wherever
you've
defined
it
so
so
far
we
have
you
could
keep
them
in
git
repositories,
S3
buckets.
Of
course.
B
We
also
work
with
Helms,
so
we
also
have
support
for
Helm
repositories
and
the
newest
thing
that
we're
talking
about
is
the
oci
repository
right
for
those
who
have
haven't
heard
about
oci
before?
Is
this
new
spec
image
Space
by
the
open
container
initiative?
So,
basically,
the
part
of
it
that
we're
using
in
flux
lets
you
package
after
facts.
Basically
files
in
your
images
just
the
same
way,
you
store
your
images
in
git.
You
can
store
them
in
your
in
your
images
in
container
Registries.
B
So
if
this
maybe
fits
your
use
case,
you
could
package
up
your
yamos
that
you
want
to
deploy
into
your
oci
images
and,
of
course,
plugs.
This
is
a
pretty
new
thing
and
it's
not
pretty
new,
but
not
a
lot
of
people
are
doing
it.
So
flux
provides.
You
know,
command
line
tooling,
for
you
to
be
able
to
do
that
in
your
CI
CD,
and
it's
part
of
what
we're
talking
about
earlier
for
you
to
be
able
to
package
of
this
manifest
and
push
it
to
your
image
repository.
B
So
the
source
controller
also
supports
pulling
oci
repositories.
Customize
and
Helm
are
what
we
call
apply
us.
Basically,
they
they
apply,
what
source
controller
pulls
in
on
the
cluster.
So
if
you
are
already
using
customize
or
Helm,
this
will
fit
right
into
your
workflow.
The
last
three
are
the
notification
controller,
which
is
basically
for
giving
you
updates
in
slack
Discord.
It
could
also
post
back
to
git
the
commit
status
notification.
The
blue
check
you
have
beside
your
commits
flux
could
also
give
you
an
update
there.
B
Just
so
you
could
look
at
it
and
know
that.
Oh
this
commits
deployed
successfully
and
the
last
two
are
the
image,
repository
and
image
automation
controllers,
which
is
basically
for
posting
back
to
get
when,
let's
say
your
CI
deploys
in
Utah
a
new
image
tag.
Basically,
flux
can
help
you,
instead
of
you
going
in
there
and
trying
to
just
update
the
image
tag
and
flux
could
do
that
for
you.
So
that's
just
a
quick
rundown
there's
not
a
lot
of
new
people,
but
yeah
we're
always
happy
to
see
new
faces.
A
A
The
first
one
is
the
basic,
continuous,
reconciling
pull
automation
that
is
described
in
the
get
Ops
principles.
So
there's
a
git
repository.
We
need
to
pull
it
periodically
to
see
if
there's
a
change
and
when
the
change
comes,
we
want
to
pull
it
into
the
cluster
and
notify
anybody
who's
waiting
to
see
if
there's
a
change
so
that
they
can
reconcile
immediately
and
get
our
update.
So
that's
the
entry
level
automation
that
you
get
with
flux
when
you
first
install
it
and
the
second
type
of
automation
that
I
would
talk
about.
A
Is
the
image
update
automation
that
we've
already
mentioned?
This
is
an
automation
that
will
help.
You
commit
a
change
to
your
repository
when
a
new
image
comes
and
the
oci
support
for
automation,
for
artifacts
means
now
that
you
can
use
this
type
of
automation
with
manifests
where,
before
you
could
only
use
it
with
application
images.
So
the
way
that
this
works
is
you
write
a
comment
in
your
yaml
file
that
marks
the
line.
A
A
change
comes
that
is
not
good
or
so
on,
but
the
third
type
of
automation
that
maybe
gets
overlooked.
An
awful
lot
is
the
Source
automation.
So
this
is
actually
a
lot
simpler
to
configure
than
the
image
update
automation.
It
doesn't
create
a
commit
in
the
repo
or
it
doesn't
spam,
your
repo
with
Cadets.
This
may
be
another
way
to
say
it.
What
it
will
do.
It
will
just
monitor
for
those
things
according
to
a
policy
that
you
set.
So
let's
look
at
the
source
in
the
toolkit
components.
Source
controller.
A
We
look
at
the
git
repository
Source,
there's
a
similar
section
in
the
oci
repository
source.
So
you
see
the
spec
describes
what
what
is
it
that
we're
going
to
pull
and
this
one
points
at
a
ref
for
a
branch
master.
So
every
time
flux
reconciles
it's
going
to
pull
that
Branch,
see
if
there's
something
new
there
and
update
the
artifact
so
that
the
downstreams
can
get
it,
but
you
don't
have
to
pull
from
a
branch.
D
A
A
D
C
A
Here's
an
example
of
that,
you
imagine
this
says
1.2.x
or
an
actual
sample
range.
You
can
use
greater
than
less
than
symbols.
The
reference
here
that's
linked
is
The
Mastermind
summer.
So
you
can
see
exactly
what
types
of
things
you
can
say
to
get
a
different
range
of
images,
or
maybe
you
just
want
any
image
you
can
put
a
star
in
there
and
you'll
get
the
latest
semper.
D
F
D
D
C
D
Time
you
every
time
you
push
a
change
to
your
get
repository.
You
can
have
a
CI
process
right.
That
CI
process
can
basically
you
in
the
CI
process.
You
can
do
like
a
q
Lang
build
so
which
will
output
the
yaml
that
the
Q
Lang
actually
that
the
Q
Lang
files
will
output
right
and
that
that
those
yaml
files
can
be
packaged
and
using
whatso
described
using
the
CLI
right.
D
You
can
do
a
flux,
build
which
will
package
those
yaml
files
as
an
oci
artifact,
and
then
you
can
do
a
flux,
push
which
will
push
it
to
a
registry,
an
image
registry
right
and
then
you
can
have
an
oci
repository
object
in
your
cluster.
So
Source
controller
will
look
at
that
git
repository
and
so
say
that
oh
there's
a
push
here.
So
let
me
know
like
reconcile
stuff,
because
a
change
has
happened,
and
then
you
have
this
oci
repository
as
well
so
like
and
that
actually
you
know,
gets
the
yaml
files
right.
D
So
now
you
have
you
have
a
great
repository
you're
declaring
a
community
State,
not
using
yaml
using
qlang,
or
you
know
whatever
Json
net
right,
but
flux
can
actually
understand
that
because
of
this
compatibility
with
oci,
because
you
can
actually
you
know
just
like
get
the
yaml
out
and
give
it
to
flux
in
CI,
because
flux
doesn't
care
where
it
comes
from
as
long
as
it
it's
available
to
it,
it
can
reconcile
it
so
yeah.
So
that's
a
pretty
good
use.
C
D
And
if
you
want
to
discuss
more,
we
can
talk
about
it
more
so
in
general,
oci
unblocks,
a
lot
of
use
cases
regarding,
as
Clinton
mentioned,
even
like
mono
repos.
So
if
you
have
like
a
giant
mono
repo
which
has
like
a
I,
don't
know
a
git
history
and
it's
like
it
takes
it's
like
200
MB
in
size,
so
it
can
take
so
clones
can
take
like
you
know
more
time
it
can
take
more
CPU.
It
can
take
more.
B
E
C
A
D
D
D
C
D
D
A
Anyone
who
has
not
done
bootstrap
before
or
doesn't
quite
understand
from
end
to
end
what
bootstrap
is
all
about
and
there's
I'm
trying
to
get
all
these
correct.
But
correct
me:
if
I
skip
a
step
when
you
run
bootstrap,
the
first
thing
it
does:
is
it
checks
if
the
repo
exists
and
if
it
does
not
exist,
it
will
create
it
for
you
using
API
and
the
next
thing
that
it
does?
Is
it
pushes
a
definition
to
that
repo?
A
Well,
it
pushes
the
deploy
key,
I,
think
and
a
definition
for
flux
itself,
so
that
flux
can
be
managed
from
the
repo.
So
the
idea
is
that
if
you
want
to
have
a
closed
loop,
one
of
the
rarely
quoted
principles
of
git
Ops,
because
it's
not
in
the
official
list,
then
you
can
do
that.
So
after
that
deploy
key
is
in
place.
D
And
also
I
just
want
to
quickly
ask
how
many
of
you,
how
like
what
does
your
update
process?
Look
like?
How
do
you
update
flux?
Do
you
are
you
listening
for
changelog
change
logs
or
how
regularly
do
you
update
flux,
just
like
like
less
than
every
two
weeks
or
just
do
randomly
like?
Oh,
let's
update
flux,
it's
been
a
long
time.
Okay,
so
we
always
recommend
you
to
be
on
the
latest
because
they're
just
like
you
know,
we
push
out
so
many
security
fixes
every
now
and
then
so.
D
D
A
D
C
D
No
so
this
creates
so
like
fluxes
installation
itself
is
stored
in
the
GitHub
repository
right
that
flux
itself
is
reconciled.
So
it's
it's
sort
of
a
loop.
If
you
think
about
it
like
it
can
get
like
a
bit
inceptiony
like
it's
a
sort
of
a
loop
right,
so
so
flux
state
is
also
in
the
GitHub
repository.
So
what
this
action
will
do
is
it
will
check.
D
You
know
whether
there's
a
new
release
so
that
so
the
new
changes
are
pulled
and
then
a
pull
request
is
open
to
the
GitHub
repository,
which
has
the
flux
manifests
right.
So
when
you
hit
the
merge
button
on
that
PR,
that
change
will
be
merged
into
your,
like,
let's
say,
main
branch
which
is
supposed
to
be,
and
then
it's
the
current
installation
of
your
flux
on
your
cluster
will
notice
that
there
is
a
change
in
my
main
branch.
D
F
D
D
So
that
will
essentially
do
everything
Kingdom
talked
about
it.
Will
it
will
pull
up
the
it
will
create
a
GitHub
repository
for
you.
If
one
does
not
exist
and
then
it
will
pull
up
the
Manifest
and
then
it
will
apply.
Those
manifests
and
install
flux
for
you
on
the
cluster
that
is
I
would
say.
That
is
the
most
recommended
way.