Developer Enablement through a GitOps Driven IaC Control Plane...
summary
A PoC implements a GitOps IaC control plane that enforces separation of concerns and continuous reconciliation using Spinnaker, Crossplane, Keel and Flux, claiming developer enablement plus compliant infra delivery. The hub-and-spoke Crossplane network provisions EKS clusters, uses EKS OIDC to avoid role‑chaining, and returns kubeconfigs via Crossplane connectionDetails; a kubeconfig sidecar writes those secrets for Clouddriver and Flux and a dynamic accounts plugin registers them in Spinnaker. The system supports PR-driven deployments and works end-to-end in practice though tenant onboarding is still not fully self‑service.
AI-written summary · about
chapters (16)
- 0:00Introduction and speakers
- 0:46Agenda and Cloud OS overview
- 1:28ADF and translation layer
- 2:52IaC pain points and challenges
- 4:16Crossplane and infrastructure lifecycle
- 6:00Design goals and hub-spoke model
- 7:02Central cluster and Spinnaker setup
- 9:58Deep dive workflow overview
- 13:15Keel and GitOps integration
- 15:03Role chaining and OIDC solution
- 17:12Connection details and EKS config
- 18:34Sidecar and dynamic accounts
- 20:40GitOps with Keel and Flux
- 22:27GitHub-driven workflow
- 24:39Q&A: Cluster provisioning feedback
- 27:25Q&A: Flux deployment architecture
related talks
30mDeclarative by Default, Secure by Design: GitOps as a Control Plane for Governance
37mSecure Multi-Tenant GitOps Application & Infrastructure Rollouts At Adobe
39mCreating A Landlord for Multi-tenant K8s Using Flux, Gatekeeper, Helm, and Friends
06mFrom Policy to Production: Flux and GitOps as Governance Control...
27mSecure Multicluster Istio Configuration Using GitOps...
29mBuilding PCI Compliant Kubernetes Platforms - Demystified, Fun, and Possible
39mControlled Mayhem With Cloud Native Security Pipelines
23mBuild a Spinnaker pipeline in highly regulated bank environment