Spinnaker Summit 2022

At this point GitOps is a well understood concept amongst DevOps practitioners. Talks and posts promising magnifications of developer enablement through GitOps abound. However, they rarely focus on the intersection of dev enablement and security/compliance. In this talk Jesse Sanford and Manabu McCloskey will walk through a recent PoC done at Autodesk that flexes GitOps for the delivery of compliant infrastructure as code using Managed Delivery and Crossplane. The PoC focused on using Crossplane to split the responsibilities over the ownership of the IaC and separating the concerns to the appropriate stakeholders in the organization. Security team members can develop security controls alongside platform and product engineers who develop capabilities and functionality on top of them. Additionally, using Spinnaker Keel, all parties can work through a unified git driven workflow where PRs serve as our change requests and merges trigger the updates to secure infrastructure across the organization. Finally, novel approaches for wiring up Keel with Crossplane through the use of the K8s plugin, and sharing of secrets between Clouddriver and Flux through a custom sidecar will be discussed.