►
Description
In this episode, we are joined again by Shoubhik Bose, lead Red Hat OpenShift GitOps architect, to discuss what's new in OpenShift GitOps v1.3. We'll look at what's new in this version and look ahead to what is coming in the future. New to OpenShift GitOps? Red Hat OpenShift GitOps is a declarative way to implement continuous deployment for cloud native applications. OpenShift GitOps ensures consistency in applications when you deploy them to different clusters in different environments, such as development, staging, and production. So join us to learn more, and be sure to keep calm and GitOps on!
Follow us:
Christian Hernandez https://twitter.com/christianh814
What is GitOps Guide to the Galaxy?
Every other Thursday at 3pm ET hosts Christian Hernandez and Chris Short sit down to discuss everything in the GitOps universe, from end-to-end CICD pipelines to creating Git workflows.
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #GitOps #Kubernetes
A
All
right
and
we
are
live-
welcome
everyone
to
another
episode
of
get
ops
guide
to
the
galaxy.
I
will
be
your
captain
christian.
So
today
I
have
a
co-captain
right,
my
co-captain
today
I
don't
know
which
way
the
camera
is
pointing.
I
think
I
could
go
like
this
is
so
shubik
bose
is
a
principal
software
engineer
at
red
hat,
one
of
the
guys,
I'm
always
bugging
about
openshift
get
ups
he's
one
of
the
main
guys
I
tried
to.
A
A
Nice
there
you
go
yes
exactly
exactly
so.
Thank
you
for
for
joining
us.
So
today's
topic
right
we're
going
to
talk
about
openshift,
get
ops
version
1.3.
I,
like
all
the
new
things
that
we
get
with
openshot
openshift,
get
getups
version,
1.3
and
kind
of
like
a
look
into
the
future.
A
lot
of
people
ask
and
also
like
in
the
communities
like
hey.
I
installed
argo
on
openshift
and
it's
kind
of
like
you,
know,
kind
of
acting
weird,
it's
like
well.
A
Did
you
install
it
via
the
the
operator?
Oh
no,
I
just
installed
argo,
so
you
know
I
like
I
always
like
to
bring
up
openshift
get
out
because
it
is
the
entry
point
on
how
to
get
argo
city
installed
on
openshift
and
a
lot
of
the
the
stuff.
A
lot
of
the
headaches
used
to
configure
argo
is
taken
out
of
the
way,
but
before
we
get
to
that,
I
do
want
to
talk
about
a
few
things
kind
of
top
of
mind
sort
of
things.
A
First
and
foremost,
I
think-
and
I
will
put
it
here
in
the
chat-
argo
con-
the
schedule
is
out
so
there
it
is.
So
there
is
the
argo
con
schedule.
If
you
want
to
take
a
look,
I
threw
it
in
the
chat
there.
I
have
a
talk,
so
you
know
kind
of
a
selfish
plug.
I
have
a
talk
there
on
argo,
con,
I'm
talking
about
staple
applications
and
get
ups,
because
that's
always
a
a
hot
topic
right.
A
I've
talked
about
it
on
the
show
before
and
if
you
want
to
catch
that
episode,
the
past
episodes
are
on
on
the
youtube
playlist.
So
another
thing
I
want
to
talk
about
is:
let's
see
if
I
could
find
it
real
quick
is
the
get
ups
con
itself.
The
the
videos
now
are
on
are
on
youtube.
So
let
me
find
that
playlist
there
we
go
found
it.
Let
me
put
that
in
the
chat
as
well.
A
So
this
playlist
here
is
everything
that
went
down
within
get
ops.
Con
get
up.
Con
was
a
something
that
the
cncf
open,
get
ops
project,
which
you
know,
red
hat,
takes
a
part
of
we
put
on
as
a
day
zero
event.
All
the
talks
are
up
there
great
talks.
I
gave
a
talk,
another
selfish
plug,
so
if
you
wanna
actually
about
another
project
that
shubix
is
on
about
pipeline
as
code,
but
we'll
we'll
talk
about
that.
A
A
A
I
guess
I
guess
it
would
be
a
good,
a
good
way
to
say
it
here
and
and
kind
of
to
round
it
out
here,
for
those
of
you
friend
and
colleague
started
a
kind
of
a
developer
group
right
in
the
boit
network
right
women
in
technology.
If
you
want
to
check
that
out,
if
you
want
she's
done
a
lot
of
great
work
there,
if
you're
a
developer
engineer
or
whatever
you
want
to
join
a
great
community,
that's
a
great
community
there.
A
I
promised
her
I'd
mentioned
that
on
the
stream
today,
so
I
think
it
it's
great
last
but
not
least
selfish
plug
because,
as
as
you
know,
shubik
I'm
I'm
not
ashamed
of
doing
a
plug
here,
absolutely
yeah!
Right
right!
It's
it's!
You
know
it's
my
show
why
not,
in
speaking
of
open
source
and
argo
cd
in
in
the
upstream
community,
I
have
a
little
pet
project
called
go,
go
kp.
A
That
is
it's
an
idea
about
a
get
ops,
friendly,
kubernetes
platform.
So
this
is
kind
of
like
a
pet
project
of
mine.
I've
already
put
it
on
reddit.
So
if
you
guys
want
to
join
the
open,
getups
reddit,
it's
right
there,
so
you
can
see
my
post
there
about
it.
If
you
want
to
get
more
involved
and
also
if
you
want
to
get
involved
in
reddit,
there's
already
reddit
hate
on
it,
which
that
means
it's
great.
I
love
reddit
hate.
That's
what
exactly
what
I
wanted
right!
I
wanted.
A
I
wanted
feedback
right.
Sometimes
you
you,
the
hate
is
good,
so
I
think
that's
it
with
that.
I
think
I've
talked
enough
shubik.
What
what
do
you
have
for
us
with
regards
to
openshift
get
ops
openshift
get
ups?
What
what
is
it?
What
is
this
new
update?
What
do
you
see
in
the
future?
What
what?
What
do
you?
What
do
you
got
for
us?
What
do
you
got
some
inside
information.
B
And
today
I'm
going
to
talk
about
a
bunch
of
those
I'm
actually
going
to
ensure
that
you
have
some
context
about
some
of
the
different
caching
mechanisms
and
what
are
things
you're
doing
to
get
make
them
better
as
well
as
talking
about?
How
do
you
make
every
service
securely
talk
to
each
other
in
the
control
plane
so
be
so?
So
I
think
so.
I
think,
irrespective
of
whether
you're
a
developer
or
an
admin
in
the
audience,
there's
a
lot
of
interesting
things
that
are
going
on
which
I'll
talk
about
today.
A
Sweet,
so
I
think
actually,
I
think,
one
of
the
engineers
jonathan,
I
think
his
name
was
yeah
made
a
great
post
about.
He
has
like
a
readme
somewhere
about
like
how
the
caching
works
or
go
see
it.
Let
me
find
to
see
if
I
can
I
can.
I
can
share
that
with
with
the
people,
because
I
think
I
read
that
and
I
was
like
oh,
this
is.
A
B
A
A
B
Awesome,
thank
you
very
much
question.
So
yeah.
I
think
we'll
dive
straight
into
this
today,
we'll
be
talking
about
some
of
the
salient
improvements
we've
done
in
openshift
get
ups
1.3.
It
won't
be
demo
heavy
rather
it'll
be
a
lot
of
conversation,
heavy
and
slides
heavy,
but
not
from
general
slides.
B
B
You
look
for
equivalent
resources
on
the
cluster,
determine
if
they're
different,
if
they're
present,
if
they're
not
present,
they're,
definitely
different,
and
if
you
see
there's
something
different,
just
shout
out
auto
sync
and
then,
if
it's
out
of
sync,
it's
going
to
reconcile
to
your
desired
state
and
then
you're
going
to
repeat
this
to
eternity
and
that's
all
openshift
is
going
to
do
for
you
for
a
bunch
of
complex
kubernetes
yamls
that
you're
going
to
put
in
your
git
repository
now.
What
is
openshift?
Get
ops
really
really
really
it's
basically
by
it.
B
It
packages,
argo
cd
in
a
way
that
you
could
deploy
with
multiple
deployment,
topologies
and
argo
cd
engine
is
the
one
that
ensures
that
this
charter
we
have
on
the
left
is
well
taken
care
of.
So
before
I
go
to
this
slide.
I'd
like
to
show
this
so
yeah,
so
what's
so
much
of
get
up,
so
we
have
different
mode
jobs.
B
One
is
where
you
effectively
have
cluster
configuration
done
across
your
own
whole
cluster,
using
a
central
mechanism
which
is
argo
city
on
your
cluster.
The
other
is
effectively
when
you
say
hey.
I
have
a
nice
development
team
who
needs
an
argo
cd
and
yes,
we
can
do
that
for
you
with
openshift
get
ups
which
works
within
the
isolation
of
specific
namespaces
and,
of
course
the
other
mechanism
is
hey.
B
I've
got
these
hundred
clusters
sitting
out
there
and
I
need
to
centrally
sit
and
manage
all
of
these,
so
you
could
have
openshift
get
offs
on
one
cluster
and
manage
100
clusters
using
those,
even
though
you
may
not
necessarily
be
managing
your
own
cluster
with
it.
So
these
are
the
different
mechanisms
which
openshift
get
ops,
makes
it
easy
for
you
to
use
on
an
openshift
cluster
with
argo
cd.
B
B
B
Right
so
before
we
go
deeper
into
different
things,
I
had
to
show
this
customary
slide,
which,
thanks
to
william
tam,
who
started
putting
this
up
a
few
days
ago,
and
I
had
to
slow
this
show
this.
So
we
are
at
1.3.1
now,
and
this
is
the
map
of
the
different
component
versions.
You
don't
have
to
memorize
this,
but
in
case
you
need
it
sometimes
you're
going
to
put
it
on
openshift
docs
and
we're
going
to
ensure
that
you
have
a
way
to
get
to
this.
But
the
idea
is,
if
sometimes
you
suddenly
feel
hey.
A
A
B
B
A
B
B
Want
one
this
looks
good,
yeah,
so
yeah,
I
think.
As
soon
as
you
go
in
here,
it
gives
you
a
nice
clean,
install
button.
It'll,
basically
give
you
a
bunch
of
information
here
itself,
but
but
effectively
you
could
just
go
we're
just
going
to
go
ahead
and
hit
install
we're
not
going
to
choose
any
other
options
along
the
way,
we're
just
going
to
say,
install,
install
and.
B
What
that
means
is,
if
you,
just
if
you
just
provision
the
cluster
and
you
need
to
basically
set
up
user
management
and
a
bunch
of
these
things,
this
will
ensure
that
it
does
all
of
that.
For
you
this.
This
will
ensure
your
argo
cds
warmed
up
to
do
all
that.
For
you
to
be
precise,
sorry
about
that
so
yeah.
I
see
that
it's
installed,
I'm
going
to
wait
for
maybe
four
seconds
for
five
seconds
to
ensure
behind
the
scenes.
The
argo
series
actually
coming
up.
Yeah.
A
B
A
B
A
B
A
B
A
A
So
this
is,
this
is
one
of
those
things
right
where
it's
like.
This
is
the
value
of
using
the
operator,
because
the
operator
does
all
this
for
you,
this
used
to
be
a
very
manual
step.
It's
like
setting
up
decks
with
oidc
or
setting
up
oidc
directly
or
setting
up
with
sso
right
now,
it's
just
it's
just
all
integrated.
A
B
Yeah
so
yeah,
so
we
have
this
installed
and
then
you
can
do
a
bunch
of
interesting
things.
So
I
think
this
is
one.
This
is
one
of
the
first
things
which
I
wanted
to
show
folks
that
you
don't
necessarily
have
to
go
in
and
install
red
hat
sso
to
be
able
to
log
in
with
openshift.
Of
course
you
could,
if
you
wanted
to
want
to
want
to
do
that,
because
the
reddit
sso
gives
you
a
bunch
of
other
powerful
features
which
you
wouldn't
have
without
it.
B
B
So
yeah
one
of
the
first
key
things
we
did
is
you
know
we're
trying
to
ensure
that
a
whole
login,
authentication
and
authorization
experience
is
a
lot
more
smooth
than
it
has
been
in
the
past,
so
we
are
actually
executing
on
multiple
fronts
on
that
we're.
Actually,
in
short,
this
time
we
actually
added
support
for
dex
only
for
the
openshift
login
bits.
So
I
think
a
quick
disclaimer
do
not
use
text
for
other
purposes,
other
than
openshift
getups
log
in
with
openshift
and
authorization
with
openshift.
B
B
And,
interestingly,
if
you
are
somebody
who
already
has
you
know
red
hat
sso
setup
in
your
customer
environment
or
you
have
a
key
cloud
setup
which
you
want
to
reuse,
you
could
potentially
use
that
as
well
and
because
I
think
some
key
improvements
are
happening
in
that
space.
It's
not
available
right
now,
but
it's
going
to
be
shipped
in
a
month
or
so
the
red
hat,
sso
or
key
club
is
going
to
have
support
for
sinking
off
openshift
groups
into
argo
cd
for
those
interested.
The
change
has
already
been
merged.
So
it's
there.
B
A
B
So
yep,
so
we
have
this
improvement
and
then
there's
another
work
in
progress,
improvement
which
are
going
to
land
on
your
cluster.
Soon
we're
going
to
continue
improving
this,
but
then
the
general
idea-
and
my
slide-
is
a
bit
messed
up
on
the
left,
no
worries.
Well,
it's
yaml
right
when
you're
trying.
A
B
Okay,
yeah,
it
didn't
work,
yeah
yeah,
wouldn't
it
work,
that's
the
only
time
I
know
yeah.
So
I
think
one
of
the
requests
that
we've
got
that
we
should
be
running
the
getups
control
plane
on
the
on.
You
know
nodes
which
have
been
designated
as
infra
nodes,
and
we
wanted
to
make
a
lot
of
progress
on
that
and
we've
made
a
ton
of
progress
on
that.
B
The
idea
is
the
cluster
config
crops
instance
is
the
only
one
which
we'll
allow
right
now
to
move
around
to
infra
nodes,
because
if
you
did
that
with
the
others,
we
might
get
into
weird
territory
where
developers
are
moving
this
stuff
around
in
different
nodes,
but
they
should
not
be
doing
that
so
yeah
in
general.
What
we
are
going
to
do
is
we
have
something
called
get
up
service
resource
which
gets
bootstrapped
for
all
of
you
on
your
clusters.
B
All
the
time
you
probably
just
haven't,
checked
it,
but
if
you
go
there
you
will
see
there's
a
resource
called
get
up
service
cluster.
That
is
on
your
clusters.
Already.
If
you
have
open,
install
openshift
get
ops,
you
can
now
put
run
on
infra,
true
after
attaching
the
right
labels
on
your
nodes,
and
it's
going
to
move
your
workloads
onto
that
node
further.
If
you
have
toleration
set
up,
you
could
even
specify
that
on
that
resource,
this
will
only
impact
your
cluster
config
get
ups,
yes
instance,
for
obvious
reasons.
A
So
nice
nice,
so
this
is
a
kind.
It
was
a
kind
of
like
a
hidden
object,
now
you're
kind
of
like
opening
up
that
object
to
to
control
where
those
those
those
those
workers
land
right.
So
for
those
that
don't
know
that
are
using
openshift,
there's
a
concept
of
infrastructure
nodes
and
if
you're
using
infrastructure
nodes,
they
don't
count
against
the
subscription
right.
So
they're
we're
basically
they're
free,
they're
free
cores
right.
We
don't!
A
B
But
yeah,
please
do
expect
a
lot
of
improvements.
Non-Breaking
improvements
happening
in
this
space,
just
to
ensure
that
we
can
gradually
run
a
control
plane
isolated
on
a
set
of
nodes
that
should
not
be
counting
towards
your
subscription
with
that
we're
going
to
move
ahead
with
some
of
the
security
enhancements.
B
But
before
that,
I
think
you
were
just
talking
about
this
question
a
while
ago
different
components
of
argo,
cd
yeah.
So
so
roughly
we've
got
the
application
controller,
the
repo
server
dark
city,
api
server.
These
are
all
different
components
that
live
on
the
control
plane
today
and
if
you
are
an
admin
who
has
installed
openshift
get
ops
just
so
that
your
other
admins
can
go
ahead
and
configure
it
to
have.
A
A
B
So
so
in
general,
the
first
thing
which
I'd
like
to
mention
is
in
openshift.
Today
we
have
an
amazing
model
of
securing
routes
and
services,
and
this
is
going
to
ensure-
and
this
capability
that
I'm
going
to
talk
to
you
about
now-
is
going
to
ensure
you're
able
to
use
that
in
the
way
you
think
would
work
for
your
setup.
B
On
that
note,
when
you
actually
went
in
and
installed
openshift
get
ops,
you
could
basically
go
in
and
open
the
console
or
you
had
a
bunch
of
services
you
had
there
now
we
want
to
ensure
that
anything
that's
exposed
to
the
internet
is
well
secure,
secured
anything,
that's
not
exposed
to
the
internet
should
also
be
secured.
What
that
means
is
any
intra
service
communication
happening
in
the
control
plane
should
be
as
secure
as
anything
that's
outside.
We
call
it
zero
trust
right
so
yeah.
B
I
think
here's
here
are
the
different
things
like
when
you
say
pass
through
that's
effectively
where
your
encrypted
requests
from
the
outside
world
to
your
control
plane
is
going
to
go
directly
to
the
service
encrypted.
That's
called
passthrough,
that's
what
the
default
is
today.
We
did
not
want
that
to
be
the
default
one.
We
actually
wanted
re-encrypt
to
be
the
default
frank,
but
then
we.
B
B
Releases,
but
the
good
news
is,
if
you
are
looking
for
something
like
re-encrypt,
so
I
think
I'll
quickly
go
over
the
differences
between
the
three
of
them,
so
edge
is
basically
where
your
traffic
is
decrypted
from
the
encrypted
state
into
the
edge
of
your
network.
Without
before
it,
the
traffic
reaches
your
internal
services.
That's
called
edge.
Re-Encrypt
is
with
when
it's
basically
intercepted
at
your
edge
and
then
it
when
you're
sending
it
to
your
internal
service.
That's
called
re-encrypt.
B
A
Yeah,
it's
particularly
like
a
tcp
socket
right
and
it's
just
the
the
actual
service
itself,
they're,
actually
argo,
cd,
pod
or
whatever
handles
the
encryption
right
versus
yeah.
So,
basically,
is
this.
This
encryption
is
like
basically
where
the
encryption
and
decryption
happens
right
because
correct,
depending
on
what
you're
doing
you
care
right,
you
care
where,
where
where
it
happens,
right
so
so
yeah
so
yeah.
No,
I
can
see
that
update
by
the
way
is
very
useful
for
me,
because
you
know
part
of
my
job
is
I
I.
B
A
B
B
Yeah,
so
I
think,
since
we're
talking
about
you,
know
different
services,
I
think
I'm
going
to
use
this
diagram
to
kind
of
show.
You
know
what
what
are
the
different
components
so
so
the
api
server
is
something
that's
fairly
exposed
because
sorry,
so
there's
augustine
server,
that's
actually
a
little
more
exposed
in
in
in
general,
your
your
controller
is
probably
the
only
non
http
thing.
B
So
you
could
actually
go
in
here
and
you
know
route
enable
true.
You
could
actually
go
in
and
modify
these
with
one
of
the
options
that
you
would
have
here
and-
and
here
are
the
three
options
you
have-
you
don't
have
so
many
options
in
the
past,
but
yeah
these
would
just
work
and
a
key
important
thing
just
to
kind
of
explain
why
some
of
this
has
not
been
trivial
in
the
past.
B
Is
that
with
re-encrypt?
You
need
to
you.
You
also
need
to
teach
the
router,
or
rather
you.
You
also
need
to
ensure
that
your
internal
service
is
trusting
the
traffic
from
your
router,
so
you
actually
need
the
internal
service
to
have
in
its
possession
the
ca
certificate
and
the
argo
cd
server
today
that
component.
Let
me
see
if
I
can
show
you
that
component
here,
so
I
go
to
my
deployments.
B
B
You
cannot
just
give
it
an
openshift,
cn
it'll
know
where
to
pick
it
up
from
why?
Because
this
is
the
service
which
has
actually
has
to
trust
the
openshift
external
router,
because
that's
what
we
do
in
re-encrypt
and
this
update
actually
not
only
gives
you
the
certificates,
it
tells
argo
cd,
here's
where
you
need
to
look
for
openshift
ca
certificates,
one,
and
it
also
ensures
your
route-
is
configured
with
the
right
certificate
pair,
so
that
external
requests
can
be
encrypted.
So
it
does
a
bunch
of
things
behind
the
scenes
when
you're.
B
Actually,
you
know
going
for
this
one
going
for
the
yeah
termination
as
re-encrypt
and
in
the
future.
We're
gonna
also
come
up
with
better
migration
mechanisms
between
these,
primarily
because
you
may
have
a
situation
where
you
went
for
re-encrypt,
but
for
some
reason
you
would
want
to
go
back
to
edge
today
and
we're
going
to
document
these.
There
are
a
bunch
of
manual
steps,
not
a
bunch
of
metal
steps.
B
Openshift
put
in
so
yeah,
this
is
just
to
you
know
some.
Some
of
these
are
boring
details,
but
I
just
wanted
to
let
you
know
that
these
things
have
been
considered
when
we
designed
this.
So
what
that
means
is
you
can
safely
go
in
and
turn
these
knobs
put
it
to
re-encrypt
and
ensure
that
you
have
multi-level
encryption
set
up
or
you
could
go
to
edge
and
ensure
that
it's
an
edge
setup
or
you
could
lift
pass
through
the
way.
It
is
right
now.
A
Yeah
yeah
so,
and
it's
and
it's
really
depending
on
what
also
what
what
like
industry
you're
in
right,
what
vertical
you're
working
on,
because
for
me
I've
always
liked
edge
right,
because
it's
like,
if
someone
gets
into
my
network,
then
if
someone's
sniffing
my
argo
cd
traffic,
I
have
bigger
problems
right
or
or
they're
like,
I
guess,
a
dumb
person
because
there's
much
more
interesting
things
on
my
network,
but
I
can.
But
you
know
that's
not
to
say
that.
A
Like
you
know,
re-encrypt
is
probably
like
the
best
thing
right,
because
you
know
you
have
zero
trust
right.
Like
you
know
what
I
got,
I
I
only
trust
this
specific
certificate
that
you're
giving
me
to
decrypt
the
traffic,
and
so
then
it
gets
encrypted
decrypted
and
encrypted
again
going
so
you
have
like
an
end-to-end
encryption
and
I
think
if
you
can
swing
that,
I
think
I
think
that's
like
the
way
to
go
right.
Don't
be
lazy.
Like
me
is
what
I'm
saying.
B
B
It's
it's.
It's!
It's
pretty
cool.
I
think
the
general
considerations
I
would
do
in
probably
some
of
the
large
installations
would
be.
Do
you
care
about
the
fact
that
when
you
re-encrypt
there
is
an
extra
cpu,
intense
operation,
that's
happening?
If
you
don't,
then
you're
good,
but
I
think
beyond
that.
B
B
It
caches
a
bunch
of
the
stuff
that
you
haven't
get
it
basically
knows
how
to
talk
to
get
and
it
ensures
and
and
it
it
is
basically
your
gateway
to
the
world
of
git
internally,
so,
which
is
why
it
is
of
prime
importance
to
ensure
that
we
encrypt
that
traffic.
That
goes
there
as
well,
so,
which
is
why
you
could
actually
specify
you
know
an
auto
tls
called
openshift
for
your
repo
section
in
your
argo
cd
config,
and
that
will
ensure
that
you
are
you.
B
You
have
secure
traffic
directed
to
your
argo
cd,
repo
server
component
by
default.
We
keep
it
as
true,
so
that
you
don't
have
to
make
a
choice
and
it's
boring
for
you,
but
of
course,
for
whatever
reason,
if
you
don't
like
it,
you
have
to
go
and
attest
that
verified.
Tl
is
false,
which
is,
I
am
happily
making
it
insecure,
because,
as
you've
probably
heard
in
openshift,
we
are
secure
by
default.
To
go
for.
Non-Secure
is
an
option.
You
choose
not
something.
That's.
A
A
You
can
actually
upload
that
to
openshift
and
have
openshift
trusted
right.
So
in
this
sounds
like
this
option.
What
it's
doing
is
saying
all
right,
whatever
openshift's
trusting,
I'm
going
to
trust
it
as
well.
So
then
that
way,
when
you
connect
to
those
git
repos
you
you
automatically
trust
it
with
those
with
that
best
certificate.
Correct.
B
Yes,
and
and
the
most
important
bit
here
is
that
you,
you
actually
ensure
that
openshift
is
going
to
renew
those
certificates
at
the
right
time
for
you
and
ensure
that
it's
made
available
for
your
components.
So
you
wouldn't
be
in
a
situation
where
it
expires,
and
you
know
you're
stuck,
which
you
would
probably
be,
if
you're
doing
it
yourself,
so
that
that
that's
a
huge
advantage
we
have
in
openshift
in
general.
B
B
A
Yeah,
there's
there's
actually
a
question
and
I'm
not
sure
if
you
know
I,
I
kind
of
know
this.
This
answer
so
so
waleed
by
the
way
waleed
welcome,
he's
he's
he's
a
long
time.
He
was
there
since
the
beginning.
Let's
say
so.
He
says
that.
Can
you
explain
the
certificate
annotation,
not
sure
if
I've
used
this
in
the
past
is
oh?
Is
it
open
shift
specific,
let's
encrypt
something
else.
B
A
B
A
B
B
Oh
awesome,
I
have
something
here.
So,
let's,
let's,
let's
have
a
look
at
this
yaml
right,
so
so
so
a
few
effective.
So
these
are
the
annotations
that
would
effectively
so
so,
if
you
put
in
this
annotation
in
here,
you
would
actually
have
the
openshift
cluster,
provide
you
a
certificate
for
your
service,
make
it
available
in
a
config
map
and
ensure
that
you
can
then
mount
it
on
pure
pod.
So
all
you
have
to
do
to
request.
B
It
is
provide
an
annotation
on
your
service
and
what
that
tells
you
and
what
that
tells
the
openshift
controller
is
that
hey
somebody
is
requesting
to
have
their
service
secured
and
let's
issue
this
person
a
set
of
keys
or
certificates
and
ensure
that
person
has
it.
So
in
this
case,
let's
take
a
look
at
what
we
have
here.
A
B
Yeah
so,
for
example,
in
this
case
you
know
the
controller
actually
went
in,
and
you
know
you
know
generated
these
this
ca
certificate
for
me,
so
that
I
could
actually
use
it
to
ensure
other
services.
Can
trust
me
now:
where
did
this
see
a
certificate?
Come
it
came
from
the
open
shift
system
that
did
that
gives
me
these
certificates.
What
that
means
is,
if
I'm
deploying
on
openshift-
and
I
want
to
have
secure
traffic
coming
to
it.
I
can
not
only
ensure
that
I
have
the
right
certificates.
A
B
B
If
you,
I
think,
I
think,
if,
if
I
had
to
speak
from
a
non-get
ops
context
from
for
a
moment,
I
would
say
just
go
ahead
and
go
to
your
developer.
Console,
deploy
a
git,
deploy
a
node.js
application
from
git
and
create
a
service
will
be
created
for
you
out
of
the
box.
Just
add
this
single
one,
annotation
and
you're
going
to
have
these
certificates
show
up
on
your
namespace.
You
just
need
to
mount
them
into
your
pod
and
or
your
deployment
and
you're
good.
It.
A
B
B
B
A
B
A
Is
the
plan
for
for
for
canary
releases
right?
So
so,
for
those
of
you
who
don't
know
argo
project
right
is
a
series.
It's
a
collection
of
of
of
tool,
sets
right,
argo,
cd
being
one
of
them,
probably
the
main
one,
but
there's
other
ones.
Like
argo,
rollouts,
argo
workflows,
there's
the
argo
image
updater
right,
that
yan
is
a
big
contributor
on.
So
what
is
what
is
the
plan
in
terms
of
having
canary
releases
handled
with
get
offs.
B
A
B
A
B
Some
folks
who
actually
use
our
grow
outs
while
they
have
openshift
get
ops
installed
and
that
works
great.
We
did
dabble
with
some
of
these
strategies
with
deployment
config
initially
so
like
it
does
solve
a
tiny
amount
of
use
cases,
but
it
still
does
solve
them,
but
yeah.
I
think
we
are
still
evaluating
the
plan
to
support
something
like
our
rollouts,
whether
it
would
be
our
rollouts
or
something
else,
but
it
may
not
really
default
to
our
rollouts.
B
A
Yeah
yeah,
no,
this
is
so
this
is.
This
is
part
of
the
the
cool
thing
about
being
an
early
adopter
right
with
with
with
especially
with
with
red,
hat
emerging
technologies.
Right,
we
take
a
lot
of
these
feedback
to
heart
right,
so
cmak
who's,
a
product
manager
and
myself.
We
talk
to
a
lot
of
customers
and
we
we
take
that
feedback,
and
if
it's
a
def,
if
it's
a
need,
we
will
definitely
put
money
and
engineering
behind
it.
So
you
know
this
is
so
right
now.
B
A
B
A
B
B
B
B
So
yeah,
so
in
general,
I
think
I'll
quickly
give
you
an
idea,
some
of
the
things
that
we're
doing
right
now
with
caching
and
they're,
going
to
continue
for
a
while
in
chart.
Today
when
we
set
up
argo
cd,
it
does
a
few
things
behind
the
scenes
that
you
don't
know
about,
which
is.
It
creates
its
own
cache
of
the
whole
cluster
state
and
when
it
does
so,
it
actually
has
a
high
cpu
usage
because
of
you
know
heavy
json
marshalling
it
has
a.
B
Usage
because
it's
reading
a
bunch
of
kubernetes
resources
across
your
cluster
we've
actually
had
some
very
nice
upstream
improvements
on
those
performance
metrics.
What
that
means
is
for
those
who
have
dev
who
have
dabbled
with
the
kubernetes
apis.
You
would
understand
that
we've
actually
paginated
those
list
calls
to
the
kubernetes
api
and
that's
been
a
good
improvement.
We've
controlled
the
number
of
concurrent
api
calls
that
go
to
the
api
server.
B
B
A
lot
of
information
yeah,
so
to
so
to
be
able
to
do
that
and
still
be
productive
with
the
real
work
that
is
get
ups.
There
are
a
bunch
of
improvements
happening.
We
are
gradually
going
to
open
up
these
as
knobs
that
you
can
use
for
performance
tuning
some
of
them
yeah.
So
this
is
kind
of
a
slide.
We're
going
a
little
details.
There
are
multiple
levels
of
caching
that
we
do.
B
One
is
no
caching
of
your
git
repositories
to
an
absolute
caching
of
your
git
repositories
and
we
only
check
the
cluster
state.
This
is
because,
in
case
you
have
a
situation
where
you
know.
You
know
that
you
don't
push
your
applications
more
than
once
a
week,
so
we're
not
going
to
go
ahead
and
you
know
bombard
your
git
repo
with
a
request.
Every
three
minutes.
You
could
potentially
then
say:
hey
nothing's,
gonna
change
for
the
next
one
week.
B
So
probably
just
look
at
it
once
in
four
days,
but
other
than
that,
whatever
you
had
within
your
memory,
ensure
nothing
on
the
cluster
has
been
messed
up
with.
There
are
multiple
levels
and
they're
really
going
to
gradually
expose
these.
There's
some
interesting
optimizations
that
have
happened
and
there
will
be
available
in
this
release
that
the
1.3.1
or
1.3.0,
which
is
they've,
actually
been
able
to
reduce
the
number
of
git
polling,
git
polls
that
happen
from
your
cluster.
This
is
an
example.
B
We
took
from
a
test
and
right
after
you
would
so
the
way
it
works
is
so
today,
what
we
do
is
we
poll
get
per
git
repo.
What
that
means
is,
if
christian
have,
if
christian
is
using
the
same
git
repo,
I
use
the
git
repo.
We
just
pull
it
once
to
know
if
something
has
changed
like
not
what
has
changed
but
to
know
whether
if
something
has
changed,
let's
get
ls
remote.
B
A
A
B
A
B
B
B
Right
and
then
the
other,
the
other
bit
is
there's
an
improvement.
We
did
you
don't
really
have
to
put
your
secret
in
some
of
the
existing
configuration
secrets.
If
you
have
a
git
repo,
you
would
actually
put
into
a
new
secret
and
just
put
in
this
label,
and
argo
cd
would
know
that
you're
talking
about
credentials
for
repositories,
you
don't
have
to.
B
A
Is
update
because
well
because
if,
if
for
those
that
you
don't
know
if
you
used
it
in
the
past,
this
was
like
in
in
different
places
and
now
there's
like
a
central
way
to
manage.
Not
only
your
your
your
git
credentials,
but
access
to
that
gig
credentials
right.
It
kind
of
serves
like
two
purposes.
So
this
is
like
one
of
my
favorite
things,
I'm
using
it
all
the
time
now
so,
especially
in
your
declarative
approach
to
deploying
argo
cd.
B
Yeah,
absolutely,
and-
and
this
is
something
that
would
actually
make
it
easy
for
you
to
configure
an
external
secrets
mechanism
and
pull
it
in,
because
this
can
be
an
isolated
secret
altogether.
You
don't
have
to
lump
it
into
other
secrets
if
you
don't
want
to
yeah,
and
the
other
thing
is
yeah.
As
I
mentioned
previously,
when
that
happened,
we
actually
needed
some
of
the
internal
config
maps
that
we
use
here.
You
could
actually
reference
any
secret
rather
than
very
specific
secrets.
Nothing
too
interesting,
but
yeah.
B
The
other
interesting
thing
that
we
did
is
we
have
health
checks
for
openshift
deployment,
config
and
openshift
routes
use
it
and
let
us
let
me
know
if
you
know
they're
working
to
your
needs,
we'll
be
happy
to
improve
them.
It
could
be
in
one
of
the
patch
releases
or
in
one
of
the
minor
releases
or
major
releases,
but
then
yeah
we
are
going
to
ensure
we
listen
to
feedback
on
this
to
ensure
that
we
act
on
them.
A
Yeah,
yeah
and-
and
it's
and
I
don't
want
to
you-
know
you
build-
I
mean
I
do,
but
I
know
it's
not
possible.
You're
building,
argo
city
just
for
me,
but
one
of
the
things
that
I
like
doing,
we
could
solve
it
because
I
mean
you
could
right
but
like
I
would
like
to
hear
like
other
people's
feedback
on
like
what
would
be
what's
a
good
default.
A
I
think
for
a
lot
of
engineers,
it's
really
hard
to
say:
okay,
what's
a
good
default,
because
it's
there's
obviously
there's
so
many
snowflakes
cases
right
edge,
use
cases
and
it's
hard
to
choose
like
like
a
like
a
like
a
same
default.
But
what
I
always
do
is
I
install
the
the
operator
and
then
I
have
to
patch
the
the
argo
cd
instance
to
ignore
the
the
host
field
for
my
routes.
A
A
B
B
B
A
A
A
B
A
A
Yeah
yeah
so
sweet
so
yeah.
So
thank
you
by
the
way
for
sharing
all
that,
and
I
think
I
think
the
I
think
the
viewers
always
enjoy,
having
like
a
sneak
preview
or
having
the
engineers
talk,
because,
like
people
like
me
and
product
management
right,
we
tend
to
give
you
a
lot
of
fluff
right
but
like
when
engineers
talk,
they
they
talk.
You
know
they
talk
tech
and
I
think
I
think
people
appreciate
that.
So
I
do.
I
do
appreciate
appreciate
that
here,
so
we
have
a
few
minutes
here.
A
I
don't
know
if
you
guys
have
any
more
questions,
we'll
give
it
another
couple
minutes
here
or
so.
Ask
your
questions
in
the
chat.
You
know
either
via
youtube
or
or
or
twitch,
we'll
all
get
them.
They'll
aggregate
that
so
waleed
said
it
was
informative.
Thank
you
remember.
To
subscribe,
like
share
right.
I
feel
like
an
influencer
already
please
hit
subscribe,
like
share.
Do
all
that
do
all
that
stuff.
A
A
Oh,
we
are
rounding
out
our
year
here.
I
believe,
there's
only
like
three
episodes
left
in
this
year,
then
the
show's
gonna
take
a
little
break,
we're
coming
back
next
year
right
stronger
better
than
ever.
We
have
an
amazing,
an
amazing
team,
right,
red
hat
this
new
team,
that
that
is
handling
all
the
streams
for
us.
I
know
I
appreciate
it.
Andrew
sullivan
appreciates
it.
I
know
he
we've
talked
about
it.
A
It's
been
it's
it's
been
great
to
see
how
much
the
show
has
grown.
So
what
I'm
asking
is
I'm
dropping
this
in
the
chat
here.
Is
I'm
actually
conducting
a
survey
about
the
show
right
we've
been
doing
this
for
a
little
bit
over
a
year,
maybe
almost
two
years
now.
This
is
the
second
break,
we're
going
to
be
taking,
but
the
I'm
running
a
survey
right
go
ahead
and
take
the
survey
just
a
quick.
You
know
five
questions
about
what
you
like
about
the
show.
A
A
So
please
take
some
time.
I
appreciate
you
filling
out
the
survey.
A
few
people
are
already
filled
it
out.
I'm
gonna
be
mentioning
this
until
the
new
year,
I'm
going
to
try
to
collect
some
information
these
next
months
here.
So
so
I
do
appreciate
that.
Also,
if
you
don't
see
it,
my
twitter
handle
is
here
right,
so
you
can
follow
me
on
twitter
or
github
same
handle
on
both
sides
here
and
then
I
think
one
last
thing
I
did
have
one
last
thing
here.
A
No,
I
think
that's
it
oh
yeah!
So
the
survey
next
next
episode
right,
we're
gonna,
have
alex
collins.
I
think
schubeck.
You
know
him
from
intuit
alex
collins
from
intuits
coming
along
talking
about
argo
city
workflows,
so
you
guys
yeah,
we
kind
of
mentioned
before
about
workflows
and
rollouts,
alex
collin
collins
he's
from
intuit
one
of
the
engineers
in
workflows,
we're
going
to
talk
about
argo
workflows
so
that
that's
cool,
don't
miss
that.