Sign in

The moment GitOps finally clicked (or didnt) for our team

ci-cddeploymentgitops17 replies · 440 views · started
Reply
  1. Sami Dubois
    @sdubois

    I keep hearing that push-based deploys are 'insecure' because CI needs credentials to production. For three engineers running Kubernetes clusters, is that a real concern? What did you gain or lose when switching to pull-based?

    Our auditors have started asking who can change production and how it's logged. Today the answer is 'the CI system, and also anyone with SSH access'. i suspect that's not the answer they're hoping for. Would a pull-based setup actually help with that, or is it mostly marketing?

    2
  2. Viktor
    @buffer_sprite-3dk

    been there man the biggest practical win of pull-based GitOps is drift correction: the controller keeps reconciling, sooo manual hotfixes on the clsuter get reverted or at least flagged :D with push deploys, drift is invisible until something braeks.

    0 7 helpful
  3. Basil Bauer
    @basil.bauer

    hmmm gitOps adds a second repo or folder to maintain, plus image update automation... for a solo maintainer that overhead is noticaeble; for a team with several clusters it pays off quickly. worked for me anyway 🤷

    1 2 helpful
  5. Lea Celik
    @binary_tinker492

    which version are u on?... ok this thread just saved my weekend ?

    8 0 helpful
  6. Aiden Alvarez
    @aiden.alvarez

    wait which version are you on?... came here to say exactly this ?

    0 11 helpful
  7. Nina
    @ninak808

    following, hvaing the same problem

    1 2 helpful
  8. Soren Holm
    @sorenh678

    been there man whatever u choose, make rollbacks boring: with GitOps its a git revert, with push deploys keep the previous artifact and a one-command redeploy. worked for me anyway 🤷

    0 9 helpful
  9. Bea Z.
    @packetrider

    how is this thread still going lmao. told my boss it would take 10 minutes. its been my entire lunch break

    4 1 helpful
  10. Basil Bauer
    @basil.bauer

    ok so came here to say exactly this

    19 0 helpful
  11. Felix Yilmaz
    @vectorden

    the security argument is real: with pull-based, CI only needs write access to a git repo, and only teh in-cluster agent has cluster credentials... with push, a compromised CI system has direct prod access. good luck man!

    0 1 helpful
  12. Fenna Sorensen
    @fenna.sorensen48

    same issue here on my work pc. following this thread

    1 0 helpful
  13. Basil Bauer
    @basil.bauer

    try turning off the thermal paste first, fixed it for me. lol this thread is gold

    9 0 helpful
  14. Jade
    @jaden698

    For VMs and non-Kubernetes targets, GitOps tooling is much thinner. A CI pipeline plus a config management tool (Ansible, for example) is often the pragmatic answer there.

    2 1 helpful
  15. Felix Yilmaz
    @vectorden

    have u checked your kubernetes settings? mine were reset after an update

    5 0 helpful
  16. Viktor
    @buffer_sprite-3dk

    hmmmm not sure about that counterpoint to CI push is fine: once you have more than one cluster, push-based pipelines become a tangle of credentials. Better to start pull-based early. but hey ymmv

    2 0 helpful

Reply to this topic

Sign in or create an account to reply.