►
From YouTube: A New Way To Roll: Supply Chain Choreography For Enterprise Grade... - Kirti Apte & Steve Watkins
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
A New Way To Roll: Supply Chain Choreography For Enterprise Grade Kubernetes - Kirti Apte & Steve Watkins, VMware
Speakers: Kirti Apte, Steve Watkins
Kubernetes has become a popular choice for container orchestration as enterprises embark on their cloud-native application journey. We have observed that while enterprises quickly adopt Kubernetes by building and deploying microservices-based applications, full software development lifecycle (SDLC) considerations such as continuous integration and deployment (CI/CD) are often an afterthought. What does it take to incorporate DevSecOps practices into your CI/CD pipelines to deliver enterprise-grade cloud-native applications that adhere to best practices, and ensure a frictionless handoff between developers, operations and security? How do you make sure that your development, test, and production environments are consistent to deliver high-quality, secure, and reliable code at the velocity demanded by your business? In this talk, we will present all aspects of defining, building, and managing a secure software supply chain within your organization to deploy cloud-native applications into Kubernetes using a set of open standard based Tanzu Application Platform and DevSecOps best practices. We will also cover how supply chain choreography helps you define a delivery system with infrastructure as code while keeping it tools and programming language agnostic.
A
All
right,
thank
you,
everybody
for
coming,
showing
up
today,
very
happy
that
you
made
it
this
afternoon.
This
talk
is
a
new
way
to
roll
we're
talking
about
supply
chain
choreography
for
Enterprise
kubernetes.
My
name
is
Steve
Watkins.
This
is
my
colleague
Kirito
we're
both
solution
Architects
with
VMware
with
the
tansu
business
unit.
So
that
means
we
work
with
all
things:
modern,
apps
and
kubernetes,
and
things
like
that
so
very
happy
to
be
here.
A
Let's
kick
it
off
so
first
thing:
why
in
the
world,
would
we
even
talk
about
Supply
chains?
So
our
most
important
thing
is
dealing
with
our
developers.
Developers
cost
a
lot
of
money
right.
We
want
them
to
write
code.
What
the
developers
want
to
do.
They
want
to
write
code.
How
do
they
want
it
deployed?
A
They
don't
care
well
we're
at
kubecon,
so
we
want
it
deploy
to
kubernetes
kind
of
obviously,
but
for
those
of
you
that
have
a
little
gray
in
your
beard
like
me,
if
you
remember
back
all
the
way
back
about
15
years
ago,
the
book
continuous
delivery,
Jess,
humble
and
David
Farley
nailed.
What
is
the
the
preeminent
challenge
for
us?
If
somebody
thinks
there's
a
good
idea,
how
do
we
quickly
get
that
in
front
of
our
users?
How
can
we
make
that
happen,
and
that
is
still
the
challenge?
A
That
is
the
challenge
that
we're
all
moving
towards
get
developers
get
something
smart,
get
something
useful,
get
it
in
front
of
users,
so
that
was
15
years
ago,
even
even
up
to
today
we're
still
running
into
this
issue.
15
years
later,
we've
built
a
bigger
Cloud
native
infrastructure,
we're
doing
a
lot
more
cool
things,
but
Joe
beta.
If
you
know
Joe,
one
of
the
co-founders
of
kubernetes
called
out
specifically
our
job,
is
to
manage
complexity
and
unlock
velocity
for
all
the
good
features
that
we
get
out
of
kubernetes
and
Cloud
native
operations.
A
We're
it
still
can
create
some
drag
so
we're
still
struggling
with
with
velocity
getting
things
out.
Okay,
so
the
traditional
way
of
approaching
under
the
way
we
have
been
approaching,
it
is
using
a
CI
CD
challenge
or
CI
CD,
pretty
straightforward
right,
I
identify
some
tasks
that
I
need
to
do.
There's
code
build
image,
run
some
tests
build
a
release,
get
it
in
deployed
in
operating
Monitor,
and
this
has
been
around
for
a
while.
A
It
depends
on
an
external
orchestrator,
so
an
external
orchestrator
will
start
and
start
up
each
one
of
these
tasks
and
it'll
control
them,
and
there
are
some
advantages
for
sure.
It's
very
mature.
It's
been
around
for
a
long
time.
There's
a
lot
of
great
products
out
there.
You
probably
saw
a
lot
of
them
on
the
Expo
floor.
A
It's
also
pretty
easy
to
monitor
if
you
want
to
Monitor,
uptime
and
delivery
and
really
Drive
metrics
and
improvements,
it's
pretty
good
and
then
for
for
basic
testers
or
straightforward
tests.
It's
actually
really
fast
and
really
quick
to
set
up
okay,
but
it's
not
perfect,
there's
a
couple
of
things
that
could
be
improved
for
one
thing:
it's
very
tightly
coupled.
So
what
does
that
mean?
A
That
means
that,
because
I
have
an
external
orchestrator
controlling
each
one
of
those
tasks,
if
I
want
to
change
one
of
those
tasks
or
if
I
want
to
add
a
new
one
of
those
tasks,
it
impacts
my
orchestrator
and
it
impacts
my
upstream
and
downstream
tasks.
So
things
are
a
little
bit
more
difficult,
a
little
less
flexible.
A
The
second
thing
is
that,
even
though
it's
easier
to
monitor,
it
also
creates
a
single
point
of
failure.
Okay,
so
this
can
this
can
take
down
production
and
slow
down
getting
code
in
front
of
users
and
finally,
it's
a
little
bit
rigid.
It
can
be
rigid.
So
what
does
that
mean?
Well,
let's
say,
for
example,
I
we
discovered
there's
a
cve
in
our
container
image
or
in
our
libraries
or
something
we
want
to
fix
that
cve.
A
So
we've
got
the
patch
in
order
to
roll
out
that
patch,
sometimes
I
have
to
fake
a
new
delivery
of
a
code
commit,
and
just
so
we
can
run
through
end
to
end.
So
it's
a
bit
rigid
that
way,
not
so
flexible.
Okay,
that's
all
well
and
good.
A
lot
of
people
can
live
with
that,
but
where
things
really
get
challenging
is
when
we
start
to
look
at
orchestration
at
scale.
So
here's
what
happens
a
lot
of
the
time,
we'll
start
out.
A
We'll
have
one
team,
maybe
they're
developing
and
go
or
something
like
that
and
we'll
build
a
pipeline
and
that
pipeline
will
go
through
a
b
c
d
and
e
okay.
So
far
so
good.
But
then
it
turns
out.
We
have
another
team
and
this
team
they're,
whatever
they're
doing
data
and
they're
doing
it
in
Python
and
this
team
they
don't
use
a
they
just
use,
BCD
and
E.
A
A
We
end
up
having
a
library
of
pipelines
to
try
to
contain
and
orchestrate
for
one
and
secondly,
what
happens
is
a
lot
of
this
work
on
customizing
the
the
pipeline
gets
pushed
down
to
the
individual
development
team,
so
now
I've
got
developers
working
on
Pipeline
and
devops
stuff
instead
of
writing
code
and
the
point
is
to
get
code
out
as
fast
as
possible
Okay.
So
how
can
we
solve
this?
A
Well,
as
with
so
many
things
in
agile
and
in
devops,
we
can
look
to
the
practices
that
came
out
of
lean
manufacturing
and
if
you
look
at
lean
manufacturing
when
they
look
at
this
problem,
it
is
a
supply
chain
problem
and
here's
the
thing
about
manufacturing.
Here
we
are
in
Detroit
by
the
way
and
back
in
the
70s
and
80s
it
was
the
Toyota
quality
system
that
taught
Chevy
and
Ford
how
to
build
a
car
to
be
perfectly
Frank
and
we're
doing
it
still
today.
A
So
let's
say
we
look
at
each
one
of
these
tasks
instead
of
as
a
test
that
needs
to
be
controlled.
Think
of
it
as
a
downstream
part
of
my
supply
chain
and
the
thing
about
in
manufacturing
and
input
for
one
becomes
an
output.
So
let's
say
I
have
raw
rubber,
I
use,
Rubber
and
I
create
a
tire,
and
then
the
next
step
is
we'll.
A
Take
that
tire
and
we'll
mount
it
on
a
rim
and
or
pardon
me,
yeah
a
tire
and
mounted
on
a
rim,
and
now
I
have
a
wheel
now
that
wheel
goes
down
to
the
next
step
and
it
gets
screwed
onto
a
car,
hopefully
quite
securely
with
luck.
So
the
point
here
is
that
the
inputs
or
pardon
me
the
outputs
of
each
step
in
that
supply
chain.
One
output
is
the
input
for
the
other
and
one
output
that
is
becomes
the
trigger
for
the
next
step.
A
So
we
start
to
establish
pull
which
is
again
one
of
the
lean
principles.
So
if
we
look
at
lean
manufacturing,
this
gives
us
a
way
to
approach
the
problem.
Okay,
here's
the
other
thing,
that's
really
important,
and
there
was
a
critical
part
of
the
Toyota
quality
system
for
sure,
and
that
is
establishing
provenance,
trust
and
transparency.
So
provenance,
where
did
it
come
from?
Who
touched
it?
A
Who
part
which
parts
were
added
on
I
need
to
have
a
complete
trust
with
my
in
an
agreement
with
my
suppliers
and
the
seems,
downside
and
I
should
be
able
to
pull
up
and
view
what
happened
each
and
every
time
all
right.
So
let's
take
that
model
and
let's
apply
that
to
deploying
some
applications
so
I'm
going
to
start
out
here-
and
this
is
a
typical
collection
of
folks-
you
might
have
sres
and
secops
devs
and
Ops
all
right.
A
So,
let's,
let's
start
with
our
our
Traditions,
so
we
have
our
I'm
going
to
watch
the
repo
I'm
going
to
build
an
image
I'm
going
to
do
a
test,
configuration
and
deployment.
Those
are
my
steps
all
right.
Let's
start
by
making
each
one
of
those
steps
instead
of
externally
controlled.
Let's
make
those
independent
steps.
Let's
encapsulate
them
and
say
they're
you
are
self-sufficient
now,
okay
and
then
what
we'll
do
is
we're
going
to
wrap
this
in
a
template?
A
Okay,
now,
by
the
way,
we're
going
to
go
into
this
in
a
lot
more
detail
a
little
bit
later
on,
I
just
want
to
give
you
the
high
level
version.
First,
so
we'll
wrap
this
up
in
a
template,
so
it
no
longer
becomes
a
very
specific
application.
It
no
longer
becomes
flux
or
Argo.
It
becomes
pull
my
repository,
okay
good.
So
then
I'll
say
all
right.
I
know
that
you
are
now
a
template
and
you
are
independent.
So
your
input,
your
raw
material,
will
come
from
the
previous
step,
so
test.
A
Look
to
the
build
image
process
to
feed
you
what
you
need
to
do
to
run
a
test.
Okay,
so
far,
so
good,
so
we'll
put
all
of
those
together,
they're
all
independent,
they
all
fire
independently.
They
all
know
to
look
for
each
other
and
we're
going
to
put
that
in
a
single
definition,
we're
going
to
call
that
a
supply
chain,
okay,
so
into
a
single
blueprint,
all
right
good.
A
So
far,
so
good
so
now,
somewhere,
I
have
to
be
able
to
find
a
definition
for
what
this
supply
chain
is
and
be
able
to
call
it
and
kick
it
off.
All
right,
so,
let's
bring
it
back
to
our
people,
so,
first
of
all,
our
sres
and
our
secops
are
the
ones
that
are
going
to
help
Define
and
maintain
this
supply
chain
and
by
the
way
this
is
all
kubernetes
Native
stuff.
So
it's
not
an
external
app
that
sits
out
there.
A
It's
a
data
app,
something
like
that
very
straightforward,
so
the
the
Cartographer
controller
will
say:
yes,
I
can
map
that
particular
definition
to
a
supply
chain.
The
supply
chain
executes
runs
itself
and
the
delivery
team
is
able
to
also
maintain
them
and
match
that
that
supply
chain
definition
in
their
output,
so
we're
all
able
to
kind
of
organize
and
manage
this
all
at
once.
Okay.
A
That's
a
better
way
to
think
about
this,
so
I
have
Publishers
and
subscribers
okay,
all
right
so
now
this
is
the
high
level
view
we're
going
to
go
in
we're
going
to
double
click
and
go
a
little
bit
more
detail
on
each
of
these
components
all
right.
So
the
first
thing
we
want
to
do
is
we
want
to
introduce
you
to
cartographer
here.
Yep.
B
Okay,
so
hello,
everyone
and
first
of
all
thanks
everyone
for
showing
up
for
the
session.
So
now
we
are
going
to
go
deep
into
cartographer
and
try
to
understand
what
cartographer
is.
So,
let's
take
a
step
back
and
let's
look
at
this
is
somewhat
a
Messier
slide.
So
what
I'm,
showing
here
is
the
cncf
landscape.
There
are
lots
of
projects
and
Technologies
are
getting
added
into
cncf
landscape.
B
So
basically,
Community
has
provided
these
tools
to
you
know
integrate
with
the
CI
CD,
but
when
you're
trying
to
make
cicd
work,
how
does
this
tools
come
together
and
that's
where
the
motivation
for
cartographer
is
so
cartographer
is
an
open
source
project?
Is
it
is
initiated
by
VMware
and
it
joined
the
cncf
landscape
as
well
as
of
October
2021,
so
fairly
active
Community
in
that
space
as
well?
B
So
now,
let's
look
at
cartographer,
based
CI
CD,
how
you
can
Implement
cartographer,
based
CI
CD
into
your
organization,
so
cartographer
offers
two
levels
of
abstractions.
First
is
supply
chain
cluster
supply
chain
and
cluster
delivery,
so
you
can
Implement
your
Ci
or
continuous
integration
with
cluster
supply
chain.
So
what
do?
What
do
these
abstractions?
Do?
They
help
you
define
standardized
way
to
implement
your
workflow
CI
workflow,
as
well
as
CD
workflow,
in
a
kubernetes
native
and
in
a
declarative
format?
B
So
that's
the
advantage
of
cartographer,
so
what
operators
will
do
they
will
Define
this
CI
workflow
supply
chain?
Typically,
developers
will
commit
the
code.
It
will
go
through
the
CI
pipeline.
This
is
continuous
integration,
which
will
we
will
do
it
through
supply
chain
that
will
be
running
on
the
shared
kubernetes
cluster.
B
So
you
can
view
that
as
a
build
cluster
or
a
run
cluster
or
where
my
supply
chain
is
installed
and
entire
workflow
is
getting
executed
and
typical
outputs
of
the
this
Supply
chains
are
images
as
well
as
application
configuration
now
images,
you
can
push
it
into
the
image
registry
application
configuration,
you
can
push
it
into
the
GitHub
repository
again,
reusable
asset.
You
are
pushing
it
to
the
GitHub
repository
when
you
move
to
higher
level
of
environments
such
as
staging
production.
B
You
need
to
worry
about
deployment
configurations
such
as
what
are
nfrs
for
your
application
right.
So,
basically,
how
are
you
going
to
scale
your
application?
How
are
you
going
to
how
many
replicas
do
I
need
for
my
service?
So
all
these
decisions
are
baked
into
that
deployment.
Configuration
and
environmental
configuration,
such
as
how
am
I
how
my
service
is
going
to
connect
to
other
external
systems
such
as
a
database,
so
production
database,
external
URL
will
be
different
from
the
development
database,
external
URL
or
endpoint
so
delivery.
B
If
you
look
at
it,
CDE
actually
will
be
again
in
a
supply
chain
similar
to
supply
chain.
It
will
be
a
resource
which
will
Define
the
workflow
to
deliver
your
product
to
to
the
multiple
workload
cluster,
so
it
will
take
inputs
from
such
as
our
configurations,
different
configurations,
image
registry
and
it
will
Define
a
workflow
cartographer
will
Implement
that
workflow
and
then
it
will
help
Define
that
workflow
and
install
kubernetes
resources
onto
multiple
cluster
multi-cluster
environment
as
well,
and
the
final
product
is
the
running
app.
B
So
this
is
the
entire
CI
CD
flow,
which
you
can
Implement
with
the
Cartographer
and
what
you
are
getting
with
this.
You
are
getting
reusability.
You
are
getting
full
end-to-end
automation,
many
of
the
processes
are
manual,
but
here
you
are
getting
full
end-to-end,
Automation
and
also
reproducibility,
so
you
can
reproduce
errors
or
anything
anytime.
So
these
are
the
advantages
of
this
CI
CD
process.
Now,
let's
take
a
simple
workflow,
where
I'm
pulling
a
source
code,
I'm,
building
an
image
and
I'm
deploying
it
to
the
kubernetes
cluster.
B
Now
this
is
not
a
real
world
scenario:
real
world,
it's
going
to
be
complex,
but
let's
try
to
build
a
concept.
What
we
are
saying
here
is
we
are
pulling
a
source
code.
I
am
using
Community
provided
tools
such
as
flux,
CD,
to
build
an
image
I'm
using
kpac
and
deploying
it
to
the
kubernetes
cluster.
Now
what
I'm
saying
here
is
the
flux
CD
definition
that
I
have
given
here
is
the
normal
Cube
when
it
is
construct,
which
is
a
GitHub
repository
now
in
the
supply
chain,
World.
B
Basically,
what
operator
has
defined
operator
defines
this
workflow
defines
the
steps
inside
that
workflow.
Each
step
is
autonomous
in
nature,
has
inputs
and
outputs,
and
also
each
step
is
implemented
using
the
tool
of
your
choice
and
then
each
step
later
on
can
be
templatized
and
that's
where
cartographer
provides
you
this
abstraction
in
the
form
of
templates
as
well.
So
there
are
couple
of
our
templates.
There
are
four
types
of
templates:
there
is
cluster
Source
template
cluster
image,
template
cluster
template
cluster
config
template
also
runnable
interface
available
there.
B
Now
URL
path
is
the
flux:
CD,
basically
pulls
the
source
code
and
general
rates,
the
source
code
URL,
and
that
will
be
stored
in
the
URL
path.
Similarly,
cluster
image
template
will
have
a
different
output
which
will
store,
which
will
provide
you
image
path,
as
the
output,
so
generated,
images
will
be
stored
in
the
image
path
in
the
GitHub
repository
and
cluster
image,
template
will
have
image
as
image
path
as
the
output
cluster
config
template
will
have
a
config
path
as
the
output
and
yeah
sure.
A
Okay,
quick
Point:
what
are
the
questions
we
get
from
folks
as
they
say?
Well,
we
just
implemented
Argo
can't
we
just
do
this
with
Argo
and
what
kirti
was
showing
is
we
happen
to
be
using
flux
if
you're
using
Argo,
you
insert
Argo
in
there?
The
goal
of
making
the
template
around
is
that
you
can
swap
your
tools
out.
Remember
when
I
talked
about
different
teams
want
different
tools
and
different
steps.
The
idea
behind
the
templates
is
to
make
that
very,
very
simple.
I
can
use
the
same.
A
B
Yeah,
so
basically
templatizing
one
advantage
is
instead
of
flux.
Cd
I
can
use
Argo,
CD
template
and
just
get
it
working
as
well.
So
how
do
you
Stitch
all
this
together?
The
cluster
supply
chain
defines
that
workflow
such
as
CI
for
workflow,
the
CD
workflow,
and
then
you
stitch
together
with
cluster
supply
chain.
It
is
nothing
but
combinations
of
different
templates
and
then
wiring
of
inputs
and
outputs.
So,
for
example,
here
flux
CD
generates
the
source
URL
output,
which
will
be
input
to
the
image
builder.
B
Then
image
Builder
generates
images
that
will
be
input
to
The
Next
Step,
which
is
deploying
those
images
also
another
one
is
developer,
basically
typically
submits
or
create
the
workload
resource
that
is
also
abstracted
out.
It
is
nothing
but
the
application
configuration
developer
knows
really
well.
The
application
parameters
and
the
configuration
and
things
like
that,
so
those
are
stored
in
the
workload
and
supply
chain
selector
will
be
matched
cartographer,
will
match
that
supply
chain
selector
with
the
workload
label,
so
that
way
that
supply
chain
will
be
executed.
B
So,
for
example,
you
have
multiple
Supply
chains
for
different
purpose
in
your
organization,
then
you
can
use
that
selector
matching
algorithm,
which
is
provided
by
cartographer
security.
You
cannot
ignore
security.
Compliance
need
to
be
embedded
into
your
supply
chains
and
into
your
organization.
Now
there
are
lots
of
vectors
where
your
application
and
the
systems
will
be
compromised.
For
example,
here
CI
CD
can
be
compromised,
built,
there
are
vulnerabilities,
there
are
scanning
and
other
tools
are
necessary.
So
what
we
this?
B
These
are
the
best
practices
that
we,
you
know
recommend
where
signing
the
images
is
really
important.
Guardrails
put
together,
Security
guardrails
in
terms
of
signing
the
images
scanning,
the
images
for
vulnerabilities,
your
images
as
well
as
source
code
needs
to
be
scanned,
and
the
best
practice
is
to
store
in
a
central
line
all
these
results
of
scanning
and
vulnerabilities
into
centralized
data
store.
So,
for
example,
here
VMware
tansu
application
platform,
which
is
based
on
open
source
cartographer.
B
So
here
just
the
output
of
the
sperm
is
shown
where
you
know
you
are
seeing
the
packages
inside
image
and
then
cves
are
detected
with
that.
So
you
can
query
that
anytime,
give
it
to
developers
submit
to
Auditors.
There
are
multiple.
You
know,
advantages
of
that.
So
with
that
Steve,
you
can
talk
to
me.
Okay,
so.
A
One
more
thing
on
that:
one
of
the
advantages
of
this
model
of
having
inputs
and
outputs
is
you
can
capture
those
outputs
and
use
that
for
your
security
purposes.
So
it's
very
cool
this
way.
What
we're
going
to
do
for
you
is
we're
going
to
take
you
through
a
live
demo.
Okay,
it's
going
to
be
great,
but
it's
it's
going
to
be
a
lot
of
yaml,
so
I'm
going
to
give
you
a
quick
flyover.
So
this
is
how
things
that
will
actually
work
in
real
life.
A
So
I
start
out
with
a
Dev,
and
what
she's
going
to
do
is
going
to
write
some
code
and
he's
going
to
do
a
commit
and
do
some
kind
of
a
git
repo.
As
part
of
that,
as
we
saw
you're
gonna
he'll,
do
the
workload
call
the
workload
out.
The
workload
will
kick
off
the
supply
chain.
The
supply
chain
will
execute
as
it
executes.
A
Some
of
the
outputs
will
be
a
an
oci
compliant
image
that
will
get
pushed
out
to
some
kind
of
a
container
repo,
and
then
a
configuration
will
be
put
into
some
kind
of
a
git
repo
as
well
so
that'll
be
out,
and
then
once
we
have
things
out,
remember
we
do
push
and
we
do
pull
just
like
in
manufacturing.
There's
a
pulley.
A
We
established
pull
so
we'll
pull
that
into
a
test
scenario,
and
the
idea
here
is
that
my
developer
can
have
real-time
access
to
it
and
be
able
to
pull
in
and
and
run
his
tests.
The
goal
here
is
to
iterate
as
fast
as
possible,
because
remember
we
want
to
get
good
ideas
out
to
end
users
as
fast
as
possible.
A
If
you
recognize
some
of
the
the
icons
we're
using
plucks
we're
using
tecton
we're
using
gripe
we're
using
K-PAX
and
Cloud,
build
we're
using
cosine
for
our
sign,
we're
using
K
native
to
do
scale
to
zeros
and
we're
using
Carvel
to
do
some
of
the
extra
templating.
Okay,
all
right,
who
wants
to
see
a
demo
yeah
all
right,
good
stuff.
B
A
B
A
B
Okay,
yeah,
that's
a
great
explanation:
okay,
so
let's
consider
a
basic
get
Ops
workflow
here,
so
pulling
the
source
code
from
flux,
CD,
building
an
image
with
kpac,
then
I'm
going
to
generate
a
config
map
and
then
pushing
it
to
the
GitHub
repository
using
tecton.
So
that's
a
very
basic
workflow.
Now
what
is
installed
on
the
cluster?
Let's
see
that
real,
quick
and
I'm
using
a
tanzu
which
is
provided
by
tensor
CLI,
which
is
provided
by
VMware
tansu
application
platform.
B
Now
cartographer
will
choreograph
the
passing
results
from
one
resource
to
another
using
the
graph
which
is
described
in
the
cluster
supply
chain
object.
Now,
let's
look
at
the
developer
perspective,
so
my
developer
basically
is
in
charge
of
creating
a
workload.
So
how
does
that
workload
looks
like
so
basically
what
I
have
done
here
is
I'm
using
a
Golan
project,
and
this
is
a
GitHub
URL
and
I'm
using
the
main
branch
and
the
labels.
Basically,
this
is
many.
B
Supply
chains
are
running
on
this
cluster,
so
I'm
telling
teaching
cartographer
to
use
supply
chain
web
demo
for
this
github's
flow,
and
there
are
specific,
build
related
parameters
that
my
application,
you
know
architect
has
defined
that
I
have
included
in
that
as
well.
So,
let's
start
to
deploy
this
workload
very
simple
to
deploy
that
with
Coop
CTL
apply
I'm
going
to
deploy
it.
B
Okay,
so
this
one,
these
are
the
resources
created
after
deploying
that
workload
supply
chain
supply
chain
demo
is
used
there
and
then
the
source
provider.
These
are
the
other
resources
which
are
created.
It's
waiting
for
status,
dot,
artifact,
URL,
so
basically
Tech
flux,
CD
is
trying
to
pull
the
GitHub
repository
and
then
you
know
gener
trying
to
generate
the
URL.
So
let's
see
that
one
more
time:
okay,
okay,
so
now
I
think
flux.
B
Cd
has
generated
the
URL
here
and
others
are
basically
in
progress
still,
so
it
will
take
some
time
so
in
the
next
window,
actually
I'm
just
going
to
watch
it
a
little
bit
more
okay
looks
like
it
is
ready,
so
what
it
is
done
is
basically
generated
the
flux,
CD
URL.
This
is
the
flux
CD
URL,
which
is
generated.
Then
this
is
my
basically
I'm
pushing
my
image.
B
Sha
and
digest
is
created
I'm,
pushing
that
image
to
the
hardware
registry,
but
it
can
be
any
image
registry
of
your
choice.
Harbor
is
by
the
way
open
source
product
from
VMware
as
well
open
source
product
and
it
is
used
heavily
in
the
VMware.
So,
let's
switch
back
to
this
window
now
and,
let's
see
now
how,
from
the
operator
perspective,
how
did
I
put
together
the
supply
chain
or
which
supply
chain
did
I
use
so
in
this
cluster?
B
Basically,
all
these
Supply
chains
are
running
and
I
use
for
this
git
Ops
flow
I
use
supply
chain
demo.
So
let's
look
under
the
hood
of
this
supply
chain
and
what's
is
there?
So
these
are
the
resources,
so
these
are
multiple
templates
which
I
I
have
used
and
I
have
defined
the
order
execution
order
of
the
template
in
such
a
way
that
you
know
Source
provider,
Source
provider
output
is
input
for
image,
Builder
config
provider
with
the
config
cluster,
config,
template
and
image.
B
Builder
output
is
input
for
that
step,
so
this
is
just
a
wiring
that
I
have
done
and
if
everything
went
good
actually
I
should
have.
You
know
config
uploaded
into
my
GitHub
repository.
Let's
see
that
live
okay,
so
this
manifest.yaml
created
two
minutes
ago
and
this
config
is
uploaded
this
so
This
supply
chain
basically
got
executed
this
Supply
this
config,
what
we
were
expecting
results
basically
upload
the
config
to
my
GitHub
repository.
That's
done
now.
These
are
the
templates
basically
in
the
supply
chain.
B
So
this
is
like
I
said
there
are
templates
available
and
these
are
the
API
resources.
Basically
cartographer
uses
this
templates
and
just
show
just
to
show
you
cluster
image,
template
basically,
output
of
the
cluster
image.
Template
is
image
path,
I'm
teaching
a
cartographer
to
use
image
path
and
use
value
status.
Dot
latest
image
kpac
actually
builds
the
image
and
puts
it
into
a
status
dot.
Latest
image,
I'm
teaching
cartographer
use
that
image
path
and
pass
it
there
set
the
input
and
pass
it
to
the
other
step.
B
Now,
let's
look
at
the
Enterprise
grade
get
Ops
workflow.
We
just
saw
basically
basic
workflow
here:
I
am
adding
testing
so
basically
Source,
tester,
tecton,
pipeline
or
tecton,
basically
tecton
job
and
then
Source
scan
is
gripe.
Image
build
with
kpat
image,
scan
with
gripe,
so
I'm
going
to
scan
the
image
and
push
the
results
of
the
scanning
into
metadata,
store,
config
provider.
You
generate
the
config
map
and
then
config
writer
with
tecton
pipeline
run
and
deploy
as
K
native
service
deployment
and
HTTP
proxy.
B
So
these
are
the
kubernetes
resources
which
are
created
to
save
some
time.
I
have
already
deployed
this.
Basically,
so
what
you
see
here,
the
supply
chain
is
Source
test
scan
to
URL.
That's
the
supply
chain,
I
use
for
this,
and
these
are
the
resources
created
by
that
supply
chain.
It
already
deployed
it
another
thing
to
point
out
delivery.
So
basically
what
I'm
doing
taking
those
configurations
and
deploying
it
into
kubernetes
cluster.
B
So
there
is
a
source
provider,
flux
CD,
will
pull
that
Source
config
map
and
then
deploy
it
with
the
deployer,
which
is
cluster
deployer
in
this
case
and
K
native
service
is
also
created
and,
as
you
can
see,
there
is
external
endpoint
created
as
well
for
the
application
where
end
users
can
access
that
and
just
to
show
you
a
little
bit
more.
If
we
have
time
tanzu
application
platform
which
is
based
on
open
source
cartographer,
gives
you
visualization
of
that
supply
chain
as
well.
B
So
here
is
the
test.
Basically,
if
I
click
on
that
base,
my
developers
have
written
test
unit
test
test
is
run
and
test
is
successful,
then,
just
to
show
you
image
scanner.
Basically,
all
these
are
all
the
CVS
detected
with
my
gripe
scanner
and
basically
there
is
I
found
one
CV
critical
I
can
define
a
policy
on
the
cluster
where
I
can
say,
don't
promote
the
code.
If
critical
CVS
are
found
to
other
environments
or
the
higher
environments,
you
can
define
those
policies
as
well,
and
so
this
is
about
it.
B
A
Yeah
all
right
so
I
know
we
were
at
time,
but
a
couple
of
quick
things.
First
of
all,
as
you
walked
around
on
the
floor,
you've
seen
a
lot
of
supply
chain
coming
up.
It's
really
starting
to
pick
up,
especially
in
the
last
six
months,
and
some
places
like
Google
is
way
ahead
of
the
curve.
We
think
that
Supply
chains
need
to
have
security
built
in
so
we're
actually
working
towards
the
Google
standard.
A
The
salsa
standard
I
know
in
our
team
we're
working
towards
level
three,
and
we
expect
to
be
there
very
soon
we're
already
at
level
two.
So
I
just
wanted
to
bring
that
out
that
this
is
even
though
we
did
diverge
and
we
talked
a
little
bit
about
our
particular
product.
Our
particular
product
is
built
on
all
of
these
open
source
tools
and
we're
embracing
those
Open
Standards.
A
Be
the
next
slide.
Please
and
then.
Finally,
a
couple
of
things
I
want
to
leave
you
with.
Please
please,
please
go
check
out
cartographer
and
it's
cartographer.sh.
If
you
go
to,
I
o
it'll,
take
you
to
the
completely
the
wrong
place.
Don't
make
that
mistake,
but
go
to
cartographer
sh.
You
can
download
this
one
of
the
really
cool
things
they
did.
Is
they
packaged
in
in
a
subfolder
called
hack?
A
There's
the
ability
to
run
and
test
this
in
a
kind
cluster
right
on
your
laptop,
so
you
don't
even
have
to
deploy
it
on
a
kubernetes
cluster
makes
things
a
little
bit
easier.
Of
course,
there's
always
the
GitHub.
Please
check
us
out
on
our
Tatu
cartographer
repo
pull
some
things
down,
as
well
as
the
slack
Channel
and,
of
course,
Twitter.