►
Description
Kubernetes Admission Webhooks are under appreciated or not well understood. The ability to mutate requests with a simple HTTP webhook is an easy way to extend Kubernetes. In this session, Carlos Santana from IBM talks about the Kubernetes Admission Webhook he built for OpenShift to deal with a large set of Argo CD repo URLs.
The problem this webhooks solves is that when you are working with a parent Argo CD Application that deploys a child Argo CD Application, you might need to change something in the child Argo CD Application using a forked repo. You can't edit the child Argo CD Application CR on the cluster because the parent App will revert your edit back to what's in git.
You can avoid this by adding an ignoreDifference in the Argo CD config but when you are dealing with multiple nested Argo CD Applications; the management becomes hard. First, to find the correct Argo CD corresponding to your git repo, this webhook allows you to create a simple mapping (configMap) to make sure that any ArgoCD Application points to the appropriate forked repos. This avoids the forked repos being polluted with your git URLs and keeping the upstream URLs.
Twitch: https://red.ht/twitch
A
A
A
C
Absolutely
absolutely
so:
I'm
dialed
in
from
the
beautiful
new
brunswick
on
a
relatively
cloudy
day.
That's
why
I
have
multiple
lights
on
so
today,
we'll
be
talking
about
kubernetes
admission
controllers
and
before
I
pass
into
carlos,
I
wanted
to
ask
the
audience:
who's
using
kubernetes
admission
controllers.
D
Yeah
a
yes
delay,
yep,
my
name
is
carlos
antana.
I
work
at
ibm
as
a
cloud
architect
constantly
working
with
clients
on
devops
and
cloud
native,
helping
them
with
openshift.
So
I
work
a
lot
with
openshift
helping
them
get
into
the
cloud
basically,
and
I
also
do
open
source.
So
I'm
a
technical
lead
for
k
native.
I
run
the
working
group
for
user
experience
and
docs
there
so
happy
to
be
here.
Yeah.
A
A
C
C
Ibm,
what
do
you
mean
you
never
left?
I
see.
I
see
that
was
a
trick
question
so
to
commit
coming
back
to
the
admission
controller
piece.
That
was
a
trick
question
because
by
default
I
think
kubernetes,
ships,
30
plus
admission
controllers,
yeah
and
the
the
specific
controllers
will
be
so
you're
using
it
by
default.
Even
if
you
don't
know
it
so
today,
carlos
will
be
talking
about
admission
webhooks
and
how
he
can
use
these
to
to
manage
large
set
of
argo
deployments.
C
It's
it's
one
thing
to
deploy
a
single
app
on
a
single
cluster,
but
when
you
have
many
apps
and
you're
dealing
with
many
cluster
or
what
are
the
challenges
that
that
we're
facing
before
that
colors?
Would
you
be
able
to
give
us
some
some
idea
about
like
what
these
admission
controllers
or
web
books
are?
D
Yeah
so
let's
use
the
official
kubernetes
stocks
because
openshift
is
kubernetes
right
and
kubernetes
is
open
shift.
There's.
Actually
I
tell
people
stories
about
openshift
that
there's
things
that
started
in
openshift
and
then
they
were
like
upstream
to
kubernetes
and
some
people
are
confused,
saying
oh
that's
in
kubernetes,
but
it
was
in
openshift
first
right
and
then
show
up
in
kubernetes,
so
they're
they're
like
siblings.
D
So
let
me
share
my
screen
and
go
over
a
little
bit
about
you
see
my
screen.
Yes,
so
we'll
go
over
the
emission
controllers
and
emission
controllers
we're
going
to
talk
about
the
the
dynamic
one,
so
there's
many
of
them,
but
there's
two
specific
ones
that
are
very
useful.
So
one
of
them
is
the
validation
that
you
can
see
here,
a
validation
webhook
and
the
mutation
workbook.
D
And
I
don't
know
if
they
have
the
picture
in
this
in
this,
but
essentially
is
when
something
and
it
could
be
a
one
of
the
admins
of
the
or
a
developer
working
with
openshift.
It
makes
a
request
to
the
cube
api
server
openshift
api
server.
It
goes
to
the
different
lifecycle
checks.
You
can
say
like
authentication,
you
can
see
here,
authentication
authorization
and
then
comes
validation
and
mutation
webhooks.
D
So
if
you
take
the
validation,
webhook
is
your
opportunity,
you
as
a
programmer
or
admin,
or
this
is
also
very,
very
used
in
operators
when
you're
writing
operators
there's
a
chance.
The
api
has
registered.
You
have
registered
with
the
api.
Saying,
can
is
this
allowed
or
not
allowed?
Am
I
allowed
to
create
a
namespace?
D
D
I
think
that's
what
I
was
saying
like
using
openshift,
there's
already
validation,
workbooks,
that
you
can
see
in
there
and
if
one
of
them
say
deny
forget
it,
you're
not
getting
to
allow
access.
So
this
is
very
different
from
our
back
if
you're
familiar
with
roblox
access
control.
So
our
back,
even
though
maybe
you're
an
admin
and
you
can
create
a
namespace.
D
Let's
say
a
simple
example
that
we
use
a
lot
if,
let's
say
you're,
an
administrator
of
this
openshift
cluster
and
for
some
reason,
I'm
managing
this
cluster
for
for
for
a
long
time,
and
I
want
every
namespace
to
have
an
owner
like
a
name
and
an
email
of
someone,
because
maybe
three
months
from
now,
I
wonder
if
this
name
is
still
used
right
and
we
can
delete
it
or
not.
So
who
do
we
ask?
Usually
by
that
time
we
cannot
find?
Who
was
the
person
that
created
this?
C
D
C
C
D
Yeah
yeah,
so
this
is
the
picture
I
was
looking
for.
Thank
you
yeah.
We
have
the
other
one
yeah.
So
if
we
zoom
in
into
here,
it's
asking
it's
asking
so
validation.
It
is
here,
but
I
was
just
saying
it
first,
as
validation
and
basically
validation
is
like
asking.
You
know
all
these
web
hooks
and
web
books
are
people
think
that
are
like
very
complex
type
of
things:
they're,
just
http
requests
with
post.
It's
a
web
api,
similar
similar
ones
that
you
use
in
github.
D
When
you
push
something
to
github,
you
get
called
by
webhook,
basically
doesn't
http
post
request
and
typically
they
have
application
json.
So
what
I
was
saying
was
if
I'm
having
a
I've,
been
admin-
and
I
want
to
have
in
my
cluster,
like
every
namespace-
might
have
a
a
a
label
with
an
owner.
I
can
create
a
policy.
I
can
create
my
own
validation
webhook.
I
create
my
own
code,
so
I
like
it.
D
D
Then
mutation
webhooks,
it
could
be
something
mutating
the
request.
So
this
one
is
read-only,
so
you're
allowed
not
allowed
this
one
can
allow
it
and
not
allow,
but
on
top
of
that,
can
mutate
that
request.
So
maybe
I'm
the
lazy
developers
like
and
I
own
the
cluster,
so
I'm
not
going
to
like
edit
every
namespace
to
add
my
email
address
as
an
owner.
So
maybe
I
create
a
mutation
webhook
and
the
mutation
webhook
gets
called
saying.
Do
you
want
to
the
api
server?
D
Ask
your
webhook
saying
I
and
you
register
like
what
type
of
objects
do
you
want
to
listen?
So
maybe
I
only
want
to
listen
to
namespaces.
For
example,
you
don't
want
to
listen
to
everything,
and
then
you
say
I
want
to
listen
to
namespaces
and
if
the
label
owner
is
not
present,
maybe
I
want
to
add
it.
So
I'm
mutating
that
request.
D
So
when
you
create
a
namespace,
I
check
that
it
doesn't
have
an
owner,
and
I
put
like
the
owner
is
carlos
because
scarlett's
the
only
one
using
this
openshift
cluster
and
I
add
that
label
an
owner
back
to
the
api,
saying:
hey,
go
ahead
and
patch,
so
the
programming
model
is
you're
going
to
patch
that
resource.
That,
typically
you
see
in
yamu,
but
it's
actually
in
api
world.
D
It's
json
you're,
going
to
patch
it
with
a
json
patch
saying:
add
the
label
owner
with
my
name
carlos
in
there
and
then
let
it
true.
So
by
the
time
when
it
hits
that's
why
validation
is
after
so
when
validation
sees
that
that
request,
it
only
sees
a
namespace
with
the
owners.
Like
you
very
good,
the
namespace
has
an
owner.
D
C
A
C
A
D
And
and
crd,
so
I
want
to
add
one
more
thing:
it's
like
the
reason
that
is
using
operators
is
for
crds.
So
sometimes
you
install
things
like
the
openshift
serverless,
for
example
the
one
I'm
familiar
with,
which
is
based
on
k-native
or
tekton.
I
was
working
with
tekton
and
the
the
version
of
the
crd,
let's
say
from
last
year,
was
v1.
I
fought
one,
but
now
you
install
the
new
version
of
the
operator.
D
D
When
you
write
operators,
you
create
a
crd
conversion,
mutation,
webhook,
saying
I'm
going
to
convert
this
resource
that
now
has
v1
alpha
one
and
I'm
going
to
convert
it
to
v1.
So
when
it's
written
into
lcd,
it
has
v1.
So
my
webhook
can
expect
the
resource
saying
well
this
field.
We
changed
the
name
from
template
to
something
else.
Now
this
field
is
needs
to
be
specified,
so
I'm
going
to
specify
default
value
and
and
the
api
version
now
we
can
change
to
v1.
So
I
just
upgraded.
D
I,
the
operator
was
helpful
enough
to
upgrade
my
yaml
to
that
version
and
maybe
give
you
back
a
message
and
you
collect
messages.
Saying
hey.
You
should
like
upgrade
this,
this
yellow
that
you
have
and
get
to
the
v1,
but
we'll
try
our
best
to
upgrade
you
on
the
fly,
but
that's
the
usefulness
of
the
crds-
and
this
was
in
kubernetes
years
on
openshift
here,
we'll
say
recent
and
it's
like
recent
as
two
years
right.
D
When
you
start
working
with
the
with
that
framework,
it
also
helps
you
you
know,
with
with
creating
these
webhooks
like
templating,
that,
like
the
the
metadata
around
it,
so
I
just
wanted
to
add
the
the
crd
assay
as
a
annotation
there,
because
a
lot
of
people
ask
or
see
them
when
they
saw
an
operator
and
they
check
for
validation,
mutation
weapons.
They
suddenly
see
all
these
mutation
weapons,
they
wonder
like
where
they
coming
from.
What
are
they
used
for
right?
D
D
D
So
you
can
do
fail.
I
think
it
would
do
the
failure
policies
call
you
can
you
can
fail
or
you
can
ignore,
if
it's
not
here,
so
the
failure
policy,
you
can
saying
yeah
if
I
cannot
reach
that
webhook
go
ahead
and
skip
keep
it
going
right.
It's
not
that
important.
Maybe
it's
a
death
cluster
right,
we're
doing
testing
and
then
maybe
in
production
you
configure
the
ammo
saying
nope
that
that
means
I
want
that
check.
D
I
want
to
fail
if,
if
the,
if
the
weapon
cannot
be
reached
right
because
it
could
be
a
security
validation,
weapon
things
like
opa,
open
policy
agent,
gatekeeper,
kiver,
no
type
of
like
they
do
security
policies,
they
implement
validation,
webhooks
that
you
can
configure
with
configuration
like
demo
or
regal,
and
you
and
those
sometimes
are
policies
that
do
need
to
be
compliant
so
in
production.
That
cluster
needs
to
be
in
compliance,
so
you
don't
want
to
have
it
like
ignore
like,
if
do
your
best
to
being
compliant
right.
D
C
What
do
you
think
sounds
good
and
we
have
a
specific
use
case
here
today.
So
for
those
of
you
who
are
familiar
with
argo
ct,
you
probably
know
that
project
for
those
of
you
who
are
not
so
familiar
with
argo
cd.
I
added
a
link
in
the
chat,
so
argo
cd
is
a
continuous
delivery
tool
for
kubernetes
or
when
you're
deploying
your
application
to
your
cluster.
You
probably
want
to
follow
a
github's
model
which
basically
says
you
can
use
git
as
the
single
source
of
truth.
C
You
make
changes
in
gate
rather
than
making
direct
changes
on
the
cluster,
which
is
very
dangerous.
You
don't
do
cubes
it'll
apply,
you
don't
do
scripts
even
worse.
You
don't
do
cubes
it'll
apply
of
a
bunch
of
scripts.
You
rather
make
changes
on
gate,
and
then
those
gets
reflected
on
the
cluster
and
the
last
thing
is
all
the
changes
you
or
your
team
members
are
making
are
verifiable
and
auditable.
C
D
So,
let's
take
a
look
at
a
validation
webhook,
the
for
that
you
have
to
create
a
yaml
file.
So
if
we
look
at
the
at
the
yamaha
specification,
this
is
this
is
the
one
that
I
talked
about.
Read
only
validation,
so
you
registered
your
web
hook
and
these
are
the
things
the
rules,
the
rules
are
the
things
like.
I
want
to
only
be
concerned
with
these
objects.
D
If
your
service
that
you're
going
to
implement
your
code,
basically
the
the
web
servers
that
listens
for
the
http
post
request
it's
going
to
be
sitting
in
the
cluster
you
you
need
to
specify
this,
the
namespace
and
the
name.
So
the
api
server
can
confirm
the
url
https,
the
name
of
the
service
dot
example.
Namespace
dot,
svc
like
that
service,
and
it
will
call
you
you-
can
also
have
the
option
instead
of
putting
service
in
here
and
and
replace
this
section
for
url.
D
D
D
It
can
be
in
my
web
hook
example.com.
It
can
be
something
outside
your
cluster,
oh
okay.
So
if
you
convince
your
friend
to
install
this
yamaha
file
that
you
put
at
the
bottom
bottom
bottom
of
this
yama
file
right
and
you
put
https
and
it
goes
to
carlos.com-
I
now
have
access
to.
I
be
able
to
modify
or
validate
your
your
request,
so
I
could
be
modifying
your
image
pod
on
the
fly.
D
You
will
never
notice,
because
the
deployment
says
that
it
has
one
version
and-
and
I
put
in
my
my
hack
version,
so
this
also
could
be
used
for
for
malicious
use.
So
that's
why
you
have
to
be
careful
about
so
the
the
webhook
not
necessarily
needs
to
live
in
a
pod
in
that
cluster.
It
could
be
living
in
another
cluster.
D
So
that's
where,
like
you
put
things
like
egress
policies,
you
put
things
like
istio
to
make
sure
that
nothing
leaves
the
cluster
you
put
network
policies
well
for
the
cube
api
network
will
not
work,
but
you
will
put
something
in
the
nodes
right
in
the
master
nodes
but
you're
trying
to
hide
like
that,
because
that's
some
some
something
that
people
are
not
aware
that
you
can
put
a
url
on
that
you'll
be
calling
something
outside
your
your
cluster
and
your
customer
may
be
broken.
You
don't
know
why!
D
It's
because
there's
somebody
else
like
messing
with
you
right,
so
that
was
interesting,
one
so
fun
fun.
Top
font
tip
there
right
I'll,
always
check,
and
that's
why
validation
annotation
web,
we
say
cluster
scope
resource
so
usually
an
app
means,
the
one
that
have
access
like
it's
there's,
it's
not
namespace.
D
D
So
I
have
the
wet
hook
right,
so
I
have
a
webhook,
a
validation,
mutation,
webhook
and
I'm
going
to
listen
and
you
will
you
can
be
very
specific
of
like
what
do
you
want
to
listen
so
in
case
that
you're
doing
development?
Maybe
you
don't
want
to
listen
to
everything
in
the
cluster
you
want
to
specific.
So
I
I
put
this
one
like
because
I
was
like
experimenting
and
it
was
a
cluster
that
my
team
was
using
I
put
like.
D
Maybe
I
only
want
to
listen
to
objects
that
live
in
a
namespace
that
matched
expression,
cntk
experiment.
So
this
is
like
telling
the
team,
like
I'm
doing,
an
experiment
in
this.
This
namespace,
if
you
want
to
you,
know,
use
my
validation.
Webhook
go
ahead
and
label
your
namespace
with
experiment
equals
cntk
and
then
the
cube
api
server
will
start
sending
me
events
from
that
namespace.
So
it's
very
granular
what
you
can
listen
on
right.
I
don't
and
then
what
things
do
I
want
to
listen?
D
I
want
to
listen
to
bugs
so
anytime
a
deployment
or
we
say
deploying
what
is
that
replica
set
regular
replica
set
replica
set,
creates
a
pod
when
a
bug
gets
created.
So
you
have
things
here
like
when
it
gets
created,
deleted,
updated,
like
you,
can
listen
to
anything
in
this
case,
I'm
listening
for
pubs,
but
it
could
be
config
maps.
It
could
be
namespaces,
it
could
be
any
resource
in
kubernetes
that
this
is
why
it's
very
powerful
right.
This
is
what
I
found
out
is
like
this
is
the
the
I
would
say.
D
D
So
if
the
api
server
is
calling
an
https
endpoint
and
it's
sitting
inside
your
cluster,
then
your
program
needs
to
have
an
https
or
ssl
certificate,
and
then
you,
the
the
cube
api
server,
which
is
serving
as
a
client,
needs
the
ca.
Who
am
I
going
to
trust?
So,
as
you
can
see
here,
I
think
I
saw
ca
bundle,
something
ca
bundle.
D
Where
was
it?
I
think
it
was
you
look
for
ca,
bundle,
ca
bundle.
So
you
see
a
bundle.
Is
a
base64
encoded
certificate
ca
and
I
was
like:
do
I
create
a
shell
script?
I
don't
know
if
I
have
it
here
somewhere,
a
shell
script
that
like
looks
like
this,
like
everybody
have
done
open.
Ssl
can
be
familiar
with
this
right
opens
the
cell
credit
key
for
the
address
of
like
white
list
register
default
thing
created
csr
generate
the
ca.
Now
I
have
the
ca.
D
D
The
openshifter
I'll
inject
ca
bundle,
so
when
you
send
these
to
kubernetes
or
openshift,
openshift
is
going
to
insert
in
here
the
ca
bundle
of
the
openshift
ca.
There's
an
operator
ca
in
openshift.
So
I
don't
have
to
do
that
piece
for
the
ca.
The
other
thing
is
like:
how
do
I
get
the
the
certificate
and
the
key
for
my
app
and
it
could
be
go
python
or
node.js
right
and
you
go
into
the
deployment
and
then
in
the
deployment
you
say
you
create.
D
The
service
of
the
of
my
deployment
is
pointing
to
my
service,
but
for
this
service
I
use
a
different
annotation
use.
Another
annotation
saying
service
beta,
openshift
server,
insert
secret
name.
Basically,
I'm
telling
openshift,
hey
openshift,
create
me
as
a
secret
in
this
namespace
with
this
service
is
with
this
name
and
in
that
secret
I
should
be
able
to
find
my
server
certificate
and
my
key
that
I'm
going
to
load
into
my
application.
D
Once
I
found
out
this,
I'm
just
testing
openshift
like
I
don't.
I
don't
want
to
deal
anymore
with
open
ssl.
So,
by
doing
this,
suddenly
a
secret
would
show
up
in
my
deployment
that
I
can
use
so
now
I
can
mount
it.
So
if
you're
familiar
with
deployments
right,
you
will
have
a
volume
that
you
can
mount,
so
you
will
mount
mounted
and
then
you
have
a
value
and
search
and
in
that
search
folder
inside
my
application.
D
I
will
see
that
and
just
join
this
and
then
let's
see
the
code,
so
the
specific
webhook
what
it
does
is
having
in
node.js.
So
the
thing
is
this
is
a
webhook,
so
web
is
basically
creating
a
web
server.
You
can
use
python
node
java,
apache
httpd,
anything
that
does
a
web
request
with
bash
cgi
and-
and
basically
this
is
I'm
using
node.js.
D
This
is
where
I'm
loading
the
certificates
that
are
created
by
openshift
and
then
I'm
inspecting
the
the
the
json
that
I
get
from
the
api
server.
So
he
sends
me
a
a
review
object.
I
can't
so.
This
is
the
git
all
right.
I
think
I
was
showing
the
other
one
for
the
node.js.
Let
me
see
the
server,
so
this
is
a
a
little
bit
more
simple
one.
D
So
this
one
is
basically
what
I'm
doing
is
I'm
going
to
configure
this
validation
webhook
to
allowed
or
not
allowed
through
or
false,
very
easy,
and
basically,
what
I'm
going
to
say
is
I'm
listening
for
pods
and
if
the
pod
starts
with
a
certain
registry-
or
it
doesn't
start
with
a
certain
registry,
I'm
not
going
to
allow
it.
So
in
this
case
this
example
is
around.
D
So
I'm
have
an
environment
bar
with
my
tool,
saying
if
the
image
in
the
pot
starts
with
docker
dot
or
dcr.io
good.
If
it
starts
with,
I
don't
know
the
hack
registry.com,
it's
not
going
to
be
allowed
right.
So
this
is
very
useful
for
airgap
environments,
where
customers
have
an
air
gap
environments
they
have
their
own
registry,
usually
they
they
use
quay
from
rehab
right
and
load
their
own
registry,
and
they
have
it
in
their
like
akame.com
internal
ca
and
for
security
reasons.
D
They
don't
allow
any
any
image
to
come
from
anywhere
else,
so
they
will
mirror
images
from
the
web.
They
will
mirror
images
from
the
openshift
marketplace
and
they
will
have
that
image
here
and
they
they
can
implement
a
validation
workbook
with
this
small
amount
of
code
right
where
I'm
checking
if
it
starts
with
this,
do
not
allow
the
pot
to
be
created
or
to.
D
D
That's
another
thing
that
you
can
do
nothing
that
is
very
efficient,
but
it's
possible
right.
What
happens
if
in
this
code,
I
want
to
take
the
the
registry
of
that
the
the
image
url
of
that
of
that
of
that
pod
and
inside
my
my
app
I
want
to
download
it
and
I
want
to
run
3d
or
I
want
to
run
a
scanning
right
there,
and
if
I
find
something
like
critical,
I
say
like
nope.
D
D
I
forgot
his
name
but
he's
from
from
google,
and
I
told
him
the
other
day
on
twitter
that
this
is
an
amazing
document
and
I
went
back
to
the
I'm
a
gig.
I
went
back
to
the
git
history.
I
did
a
git
play
and
I
figured
out
he
wrote
most
of
this
code,
so
other
people
help
but
the
first
version.
He
wrote
this
and
I
said,
like
he
explained
this
very
very
well,
so
there's
a
section
here
called
response
section
and
then
it
goes
over.
D
You
know
what
is
the
resp
the
request
and
the
response
of
that
api
and-
and
he
goes
around
like-
why
am
I,
what
information
am
I
getting
and
what
things
that
I
need
to
reply?
So
I
need
to
reply
with
something
very
simple:
it's
a
a
a
json
object
that
has
a
mission
review
and
then
I'm
going
to
allow
it
or
not
allow
it.
But
on
top
of
that
I
can
mutate.
It
so
let's
look
at
the
at
the
are
any
questions
so
far.
Do
you.
D
D
B
D
So
we
have
typically
the
clusters.
This
is
not
like
what
everybody
does
right
or
specific
to
everybody,
those,
but
most
likely.
These
are
the
things
that
we
test.
So
you
can
start
with
a
single
cluster
that
has
the
let's
say,
for
example,
the
name
spaces,
cicd,
dev
stadium,
prod,
and
then
you
can
go
into
like
well.
I
cannot
do
everything
with
one
cluster.
D
So
all
these
clusters
definitions,
everything
that
gets
deployed,
doesn't
get
deployed
by
a
human,
that's
kind
of
like
the
practice
in
the
enterprise.
When
you
go
get
ups,
only
it's
like
we
call
it
like
no
sneaky
personal
sneaky
sre
is
allowed
to
go
and
you
run
oc
apply.
Everything
is
in
git.
So
then
we
have
multiple
git
ripples
and
the
reason
we
have
multiple
gate
repos
is.
We
have
different
teams
in
in
real
world.
We
don't.
D
We
don't
have
one
only
person
knowing
about
everything
we
have
people
that
are
in
charge
of
managing
the
the
cluster
infrastructure.
So
resources
like
machine
sets
machine
configs
in
that
cluster
because
we
don't
want
to
bother
the
development
team
like
namespaces
cluster
roles
like
those
are
global
things
that
should
be
done
once
and
maybe
managed
by
by.
We
call
it
the
infrastructure
team
right
how
many
machines
you
run
the
development
team?
Really
don't
care
about
that.
D
Then
we
have
things
like
services
or
shared
services
like
operators,
so
you're
going
to
have
a
shared
service
like
let's
say
service
mesh
is
still.
Maybe
you
want
one
control
plane
and
to
manage
that
control
plane.
The
shared
services
is,
the
thing
is
in
charge
of
that
or
jaeger
or
in
ibm
some
cloud
pack
for
integration
kind
of
like
middleware.
D
You
have
one
instance
that
is
managed
by
the
services
team
and
that
person
are
in
charge
of
that,
and
then
you
have
the
rest
of
the
you
know:
population
of
of
apps,
where
they
deploy
that.
So
you
have
different
git
repos
that
you
need
to
manage
with
with
argo
cd,
so
you
will
have
different
different
argo
apps
in
different
git
repos.
So,
for
example,
I
have
this
example
here.
So
in
our
go,
you
start
with
a
single.
D
D
Create
an
argo
app
and
you
put
the
yaml
for
that
argo
app,
and
this
is
kind
of
the
seed
like
you
have
to
apply
this
manually
or
you
apply
this
one
from
cross
plane
data
form
ansible,
maybe
the
the
whatever
automation
you
have
for
creating
a
cluster
that
automation
usually
installs
our
goal,
using
like
red
hat,
advanced
cluster
management
or
just
puts
the
argo
in
the
cluster
and
then
say,
and
for
that
argo
instance.
Here's
your
starting
point.
So
this
is
called
the
bootstrap.
D
D
And
then
you
start
with
well.
The
apps
team
want
to
have
different
environments,
the
ci,
the
dev
the
stage
and
prod,
and
then
maybe
they
want
to
have
this
in
in
the
github
ripple
and
then
in
their
different
teams
repo
they
have
to.
They
want
to
have
another
argo
app
that
deals
with
the
ones
with
the
folders
inside
that
ripple,
for
example,
the
deployables.
So
let
me
enable
the
deployables
here.
D
So
I
said
before
that
I
have
the
the
ci
cd,
the
dev,
the
staging
the
pro
one
pro
two
and
a
lot
of
people.
I
even
have
three
pro
one
pre
pro:
they
come
with
all
the
certain
names.
So
they
have.
You
have
many
apps
like
this
and
you
have
the
infra.
Also
the
infra
will
have
services
and
infra
who
have
their
own
argo
apps.
D
So
this
one
has
like
the
cluster
roles
for
the
different.
So
the
idea
is
that
the
the
clusters
will
reuse
the
same
github
repo.
You
don't
want
to
have
different
github
repo
for
different
clusters.
So
if
you
want
to
follow
the
12-factor,
you
know
methodology
of
having
like
similar
environments,
if
you're
using
istio,
for
example,
1.6
you
don't
want
to
steal
1.9
in
in
stadium,
1.16
prod,
one
consistency.
So
the
way
you
have
consistency
is
by
reusing
the
repos.
D
So
you
have
to
put
these
repos
in
in
git,
so
you
create
git
ripples.
So
this
is
an
example
on
how
many
git
ripples
you
will
have.
Maybe
you
have
the
main
one
that
has
these
argo
apps.
Then
you
have
the
the
the
guitars
repo
that
has
these
folders
that
are
shared
they're
like
libraries.
These
first
two
are
like,
like
libraries
that
are
shared
and
then
the
last
one.
This
one
is
like
for
the
different
teams.
D
They
will
have
their
own
kind
of
like
name
spaces
assigned
and
they
have
their
own
cycle
of
using
like
customized
for
depth,
product
and
staging.
So
it
gets
a
little
bit
a
little
bit
complex
with
so
many
argo
apps
everywhere,
but
once
you
deploy,
this
is
static
to
the
point
that
we
have
our
projects.
D
So
an
aggro
project
is
a
resource
that
says
these
argo
apps
are
only
allowed
to
deploy
from
this
ripple,
so
you
put
kind
of
a
governance
right.
So
if
a
if,
if
the
abstinence
tried
to
create
a
cluster
role
that
is
defined
over
here,
it
would
say
no,
no,
no,
no,
like
you're
not
in
infra
during
apps,
so
have
some
type
of
control
of
like
in
the
project.
So
in
the
argo
project
you
can
do
kind
of
like
a
white
lease.
D
Allow
list
saying
I'm
allowing
argo
apps
associated
with
this
project
only
to
deploy
to
these
namespaces
and
only
to
deploy
from
these
ripples
and
the
same
thing
for
services
like
only
from
the
services
library
and
only
these
apps.
So
if
you
want
to
make
a
change,
you
will
be
making
a
change
for
the
whole
team
across
all
the
clusters.
D
So
that's
where
I
came
with
the
with
the
idea
of
creating
kind
of
like
for
development
purposes,
I'm
developing
this
architecture
and
it's
open
source.
All
this
is
open
source
on
their
project
that
I
work
on
is
called
the
cloud
native
toolkit,
so
this
I'm
creating
patterns
and
best
practices
on
how
to
do
devops
with
git
ups
and
how
to
structure
these
in
a
way
that
can
scale
at
large
corporations.
D
So
I'm
not
I'm
I'm
using
this
as
a
developer
of
keynotes.
I
don't
know
if
that
has
the
role
the
person
that
develops
githubs
and
and
devops
for
other
teams
to
use,
but
the
idea
is
like
these.
These
things
are:
are
I'm
doing
automation
setting
them
up,
but
then
I
want
to
change.
Maybe
I
want
to
tweak
or
debug
something
in
one
argo
apps,
for
example
this
one.
D
So
if
I
change
the
the
yammer
for
here
to
point
to
a
fork
of
my
repo
that
I
have
like
I'm
changing
something
here,
argo
will
complain
saying
this
argo
app
is
not
allowed
to
deploy
on
my
fork
because
it's
not
in
the
argo
project
and
then
I
want
to
change
cert.
Like
one
thing,
I
don't
want
to
change
the
whole
thing,
so
I
need
to
change
now
and
then
there'll
be.
If
I
try
to
change
this,
this
argo
app
would
revert
it
because
this
is
the
parent.
D
D
I
need
to
change
the
argo
app
to
add
my
ripple
change,
this
one
change
this
one
and
then
change
this
one
on
the
cluster
and
and
do
it
every
time
that
I
have
a
new
environment
because
I
bring
up
clusters
like
you
know,
every
day
you
know
three
through
clusters
turn
them
down,
bringing
that
up.
So
what.
C
I
did
one
quick
point.
Sorry,
carlos
is
just
emphasizing
on
the
point
of
this
is
something
a
use
case
on
development,
because
in
production
you
want
to
follow
that
proper
produce
procedure,
of
making
git
changes
and
going
the
entire
route.
You
wouldn't
make
direct
changes
on
the
cluster.
This
is
something
what
carlos
is
mentioning
that
if
you
have
a
large
set
of
clusters,
you
want
to
check
something
using
your
own
personal
brand
or
something
on
a
specific
cluster
on
resources.
C
D
So
I
said
what
about
if
I
create
a
mutation
webhook
that
every
time
you
know
one
of
these
argo
apps
gets
updated.
I
override
it
with
my
fork,
the
project
and
the
and
the
argo
app
to
point
to
my
theme.
So
nothing
gets
reverted.
So
I
created
this
mutation
web
hook
that
I
have
in
this
other
people
that
we
can
share
on
the
chat
called
the
git
override.
D
If
I
can
find
it
here-
and
this
is
when
I
was
explaining
that
I
want
to
listen
to
argo,
apps
and
other
projects,
and
I
want
to
modify
them
on
the
fly,
so
I
write
a
little
bit
of
so
I
I
made
it
configurable,
so
this
deployment
webhook
will
load
a
config
map,
so
you
as
a
user.
So
let
me
see
how
these
argo
apps
would
look
like,
and
maybe
let's
do
this
thing
of
github
now.
I
know
people
telling
me
lately
about
this
new
feature,
pressing
yeah.
D
Yeah
so
for
testing,
I
have
a
testing
folder
here
and
I
show
kind
of
like
the
the
example.
What
is
the
problem
that
I'm
trying
to
fix?
So
if
I
have
an
arbor
project
that
says,
I
only
want
to
only
allowed.
You
know
argo
apps
to
deploy
from
this
ripple.
So
if
I
try
to
create
my
fork
or
you
try
to
get
your
fork,
the
aggro
project
will
say
like
you
cannot
deploy
because
you
you're
only
allowed
to
deploy
from
these
people.
So
this
is
some
people.
D
Ask
me
like
what
is
the
usefulness
of
argo
projects.
Cycle
projects
are
very
useful.
A
lot
of
people
use
the
default
one
and
then
like
well,
I
got
something
working,
I
don't
care,
but
they
are
very
useful.
They
also
tell
like
you,
can
only
deploy
to
these
namespaces
right,
see
more
governance
and
then
there's
a
default
set
of
resources
you
can
deploy,
but
you
can
add
even
more,
but
for
this
example,
it's
like.
I
want
to
override
this.
D
D
D
So
to
do
that,
I
made
it
like
configurable
one
one
validation,
workbook
configurable
for
my
team
for
development
purposes,
and
I
told
them
as
far
for
automation.
We
deployed
this
webhook
and
you
based
on
the
your
personal
work,
so
carlos
doing
chris,
you
will
create
the
config
map
in
your
namespace
or
in
the
cluster
that
you
have
all
of
us
after
the
own
cluster,
but
using
the
same.
C
D
Config
map
would
need
to
live
in
the
same
place
where
this
deployment
leaves.
So
you
can.
You
can
create
this
deployment
in
your
namespace.
You
don't
have
to
have
admin
to
create
a
deployment
and
create
the
config
map.
What
you
need
admin
access
is
the
webhook.
Remember
like
the
webhook
is
like
the
admin
configuration
yeah
where
it
points
it.
It
doesn't
matter
that
much
but
yeah
the
config
map,
so
my
team
will
create
this
as
when
they
get
a
new
cluster.
Like
each
of
us.
We
have
so
many
customers
for
testing.
D
We
deploy
cluster
and
you're
working
with
your
own
cluster.
To
do
your
changes
right
to
validate
that
you
make
the
change
to
debug
around,
and
then
you
have
your
that
I
said
like.
I
don't
want
to
use
main
or
maybe
you're
using
the
same
repo.
You
want
to
use
main.
You
want
to
use
a
fork,
so
I
put
just
fork
here.
So
the
the
config
map
is
basically
this
upstream
url
that
maybe
is
used
by
carlos.
D
I
want
to
like
change
it
to
my
fork
and
then
the
branch
to
my
fork
branch
and,
if
I
put
this
url
this
config
map
in
there
my
code
on
my
code
but
like
some
little
example
code
will
do
the
checking
saying
if,
if
it's
an
application
object,
I'm
going
to
check
for
the
the
source
and
the
repo
url.
And
if
I
have
a
match,
I'm
going
to
reply
back.
D
Remember
I
said
like
you,
you
give
back
the
api
json
patches,
so
I'm
going
to
patch
the
resource,
mutated
with,
say
no
replace
the
repo
url
with
my
original
url,
the
upstream
and
replace
also
the
the
branch
and
and
if
it's
a
project
go
ahead
and
replace
it.
The
the
people
source
url
right
and
replace
it
with
my
my
the
original
one,
the
origin,
repo
url.
D
So
that
way
you
respond
back
with
this
small
admission
review,
but
and
and
that's
why
we
talk
about
validation,
so
validation
only
return
allowed
and
something
like
this.
So
this
is
a
mutation
workbook.
I
can
also
pass
a
patch
type
and
a
patch,
so
I'm
giving
back
like
hey
mutate,
the
argo
app
and
the
argo
bracket
with
my
fork,
urls
and
then
send
it
back.
D
But
the
problem
that
I
then
that
you
will
suffer
is
what
happens
if
argon
notice
that
that
doesn't
match
the
source
of
truth
in
the
ripple
doesn't
match
the
one
that
is
in
the
cluster.
What
is
the
typical
thing
that
argo?
Does
it?
It
reconciles
say
it
says
like?
No?
No,
that's,
not
the
the
the
source
of
truth.
I
want
you
to
be
the
the
one
and
get
the
app
goes
out
of
sync
yeah,
and
it
goes
out
of
sync
I
was
like.
D
So
how
do
I
configure
argo
to
say
like
ignore
this
small
amount
of
fields
right?
So
basically,
what
you
do
is
you
you
configure
our
goal,
so
I
have
it
in
the
readme
here.
That's
one
of
the
things
that
you
do.
Is
you
configure
the
argo
config
map,
but
in
case
of
open
shift,
we
have
an
operator
called
the
openshift
githubs
operator
and
you
will
configure
a
the
the
instance
that
operand
of
argo
cd-
and
then
you-
you
add
this
to
the
spec
section
in
there
saying
hey.
D
If,
if
is
I'm
going
to
customize
and
for
applications
and
projects,
please
ignore
these
fields
in
those
like
take
into
account
everything
but
ignore
the
things
that
I'm
like
changing.
And
this
way
argo
will
not
try
to
revert
you
back
to
the
source
of
truth
and
and
that's
that's
the
way
we
we
deploy.
We
apply
this
to
the
argo
cd.
We
create
the
config
map
to
your
fork
and
then
we
deploy
the
the
deployments
which
I
have
in
quake,
the
image
the
demo
file
and
then
create
the
workflow.
D
So
this
piece
is
the
one
that
you
need
like
I
mean
because
you're
going
to
be
affecting
your
your
cluster
and
then,
if
you
want
to
be
affected
like
this,
is
with
me
like,
be
more
paranoid,
put
a
label
on
it
right
to
activate
it.
That
was
like
the
name,
namespace
selector
type
of
thing,
any
questions,
or
so
far,
so
good.
So
far
so
good.
I.
C
B
C
Flowing
discussion,
especially
since
we
have
only
nine
minutes
remaining-
you
mentioned
about
ci
cd,
best
practices
with
using
rlcd
and
techdon.
I'm
really
intrigued
to
learn
more
about
that,
and
maybe,
if
we
can
cover
it
within
nine
minutes,
maybe
point
us
to
that
cloud
native
toolkit
site
where
our
audience
could
could
learn
more
yeah.
So.
D
One
thing
that
I
did
so,
let's
go
and
cover
one
more
those
two
things:
the
first
one
is
best
practices
on
git
ups
and
this
type
of
thing.
So
the
version
that
I
had
at
one
point
and
the
links
are
going
to
be
in
the
show
notes-
is
this
other
one
that
I
have
here:
the
cloud-native
toolkit.
This
is
a
template.
So
if
we
do
this,
let's
do
the
github
I'm
getting
addicted
to
this.
D
D
Yeah,
the
old
version
until
last
night
right,
like
talk
about
developers
like
having
a
deadline.
I
had
this
version
that
I
was
using
customize,
so
I
had
here.
I
don't
know
if
this
is
big
enough,
but
this
is
the
kind
of
the
framework
that
I'm
using.
This
is
the
main
repo
that
I
was
talking
about
get
ups.
D
D
D
Has
this
thing
here
and
the
next
argo
app
has
this
thing
here,
so
we
wrote
a
little
script
to
mutate,
all
the
art
apps,
with
the
fork
that
you
were
doing
and
it
was
kind
of
like
leaving
the
the
github
dirty.
So
if
you
wanted
to
do
a
pull
request
back,
it
was
like
all
these
changes.
We
also
had
the
project
right,
so
we
had
the
project
in
here
with
these
two
things.
D
Only
these
two
things
so
last
night
I
did
a
an
update
and
put
it
into
master
with
a
better
option
of
like
actually
using
customize
properly,
because
I'm
I'm
learning
all
this
cloud
native
as
we
go.
So
if
you
use
customize
properly,
I
reduce
I
reduce
it
to
to
this.
So
now
we
take
the
single
cluster,
the
customization,
now
I'm
using
patches
in
customize.
D
So
what
I'm
doing
here
is
the
argo
at
the
aggro
projects
no
longer
have
the
gear
of
url,
I'm
patching,
so
I'm
using
a
feature
in
customers
called
patches
with
a
target,
so
I'm
targeting
application.
Argo
applications
with
the
label
githubs
and
I'm
going
to
add
the
repo
url
and
the
target
revision.
I'm
going
to
target
app
projects
and
I'm
going
to
if
they're
infra
they
get
the
infra
url.
If
they're
services
they
get
service,
url
and
they're
up.
D
So
I'm
tagging
the
the
resources
with
the
right
thing
and,
for
example,
if
you
go
now
to
the
instances,
there's
no
there's
no
source
url.
So
actually
the
editor
will
tell
you
that
you
have
a
bad
argument,
but
the
thing
is
I
want.
I
don't
want
people
to
start
to
continue
putting
urls
in
their
argo
apps,
basically
they're
going
to
go
into
the
customization
file
in
here
at
the
bottom,
and
this
is
the
new
section.
So
now
you
go
to
one
file
to
update
the
git
url
on
the
branch.
D
So
you
put
your
branching
here
saying
main
and
then
in
here
you
put
https
github.com
my
fork
such
git
ups.
This
is
services
right.
This
is
stacked
services
and
that's
it.
It
will
take
all
the
article
apps
when
you
run
customize
from
argo.
This
is
not
manually.
Like
argo
supports
customized,
it
would
apply
this
and
then
all
the
article
apps
will
have
the
same
information.
So
you
avoid
duplication.
D
You
avoid
error
and
there's
a
little
script
in
here,
that
you
run
destruction
site
to
run
this
and
basically
we'll
take
the
difference,
all
these
four
repos
and
put
them
in
the
right
place
for
the
right,
argo
apps
in
the
argo
project.
So
that's
that's
the
thing
that
I
was
telling
you
like.
I
have
a
better
way
now
to
do
that
kind
of
the
git
override
with
with
you
know,
proper
customize,
and
this
is
kind
of
the
the
new
version
of
the
framework
for
tekton.
D
D
So
let's
say
the
app
thing.
One
of
the
app
things
are
going
to
make
a
change
in
their
the
docker
file
or
the
application
that
they
have.
So
this
is
a
customer
details.
App
and
I
make
a
change
to
the
docker
file
and
I
save
it
say
like
remove
dmv,
full
bar
and,
and
I
apply
it
and
actually
it's
already
applied
so
I
applied.
I
go
to
argo,
which
I
have
here.
D
Oh
no,
sorry
I
go
to
the
pipeline,
so
you
can
see
here.
I
have
a
tecton
pipeline
that
kicked
off
this
pipeline.
What
it
does
is
builds
the
image,
maybe
those
docker
links
like
things
that
tecton
are
good
at
check.
Your
yaml
file
do
scanning.
I
remove
the
ones
we
in
the
tokyo,
we
have
a
long
run,
but
this
one
is
shorter
for
demo
purposes.
So
it's
going
to
build
the
image
and
everything,
but
the
trick
is
this
is
the
cinespace?
D
Let
me
see
this
one,
so
I
guess
this
one:
let's
look
at
this
one.
So
basically
what
this
does
is
builds
an
image,
puts
it
in
a
registry
case,
open
shift
and
then
the
last
step.
It
goes
into
the
the
repository
of
the
githubs
repo
that
defines
the
dev
image
and
updates
the
image
then
what's
happening
with
that.
D
So
if
we,
these
are
all
the
argo
apps.
So
if
we
go
to
applications
and
we
go
to
dev
and
we
go
here,
argo
will
deploy
the
application
in
dev
and
then
the
next
thing
that
we
want
to
do
is
running
another
tecton
pipeline
when
the
application
is
running
in
in
depth
and
that
tectum
pipeline
will
do
a
functional
test,
we
run
something
like
new
man
run
like
integration
test.
So
with
the
way
we
do.
That
with
argo
is
we
add
a
pulse
sync
job
and
that
posting
job
is
located
here.
C
A
For
the
invitation,
yeah
it's
great
having
you
carlos
and
thank
you
dejuan
for
bringing
them
on
up
next
is
the
one
and
only
openshift
commons
briefing
we'll
be
talking
about
cloud
native
disaster
recovery
for
stateful
workloads
so
stay
tuned,
because
it
will
happen
to
you
all
right
folks.
If
I
don't
see
you
again
stay
safe
out
there
and
catch
you
next
time.