{"id":35941,"date":"2019-10-31T22:07:41","date_gmt":"2019-10-31T19:07:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/chto-zhe-takoe-gitops\/"},"modified":"2019-10-31T22:07:41","modified_gmt":"2019-10-31T19:07:41","slug":"chto-zhe-takoe-gitops","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-zhe-takoe-gitops","title":{"rendered":"Co je GitOps?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Pozn. p\u0159ek.<\/b>: Po ned\u00e1vn\u00e9m zve\u0159ejn\u011bn\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/456754\/\">materi\u00e1lu<\/a><\/noindex> o metod\u00e1ch pull a push v GitOps jsme zaznamenali z\u00e1jem o tento model jako celek, nicm\u00e9n\u011b publikace v ru\u0161tin\u011b na toto t\u00e9ma se uk\u00e1zalo b\u00fdt velmi m\u00e1lo (na Habr vlastn\u011b \u017e\u00e1dn\u00e9 nejsou). Proto jsme r\u00e1di, \u017ee v\u00e1m m\u016f\u017eeme nab\u00eddnout p\u0159eklad jin\u00e9ho \u010dl\u00e1nku \u2014 i kdy\u017e je u\u017e skoro ro\u010dn\u00ed! \u2014 od spole\u010dnosti Weaveworks, jej\u00ed\u017e \u0161\u00e9f vymyslel term\u00edn \u201eGitOps\u201c. V textu je vysv\u011btlena podstata p\u0159\u00edstupu a kl\u00ed\u010dov\u00e9 rozd\u00edly od ji\u017e existuj\u00edc\u00edch.<\/i><\/p>\n<p>\nP\u0159ed rokem jsme zve\u0159ejnili <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/gitops-operations-by-pull-request\">\u00favod do GitOps<\/a><\/noindex>. Tehdy jsme \u0159ekli, jak t\u00fdm Weaveworks spustil SaaS zcela zalo\u017een\u00fd na Kubernetes a vyvinul sadu doporu\u010den\u00ed pro nasazen\u00ed, spr\u00e1vu a monitorov\u00e1n\u00ed v prost\u0159ed\u00ed cloud native.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>\u010cl\u00e1nek se uk\u00e1zal jako popul\u00e1rn\u00ed. Jin\u00ed lid\u00e9 za\u010dali mluvit o GitOps, za\u010dali publikovat nov\u00e9 n\u00e1stroje pro <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/hasura\/gitkube\">git push<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/dzone.com\/articles\/weaveworks-gitops-developer-toolkit-part-one-skaff\">v\u00fdvoj<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/storing-secure-sealed-secrets-using-gitops\">tajemstv\u00ed<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.alexellis.io\/introducing-openfaas-cloud\/\">funkc\u00ed<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/jenkins.io\/blog\/2018\/03\/19\/introducing-jenkins-x\/\">nepravideln\u00e9 integrace<\/a><\/noindex> atd. Na na\u0161ich str\u00e1nk\u00e1ch se objevilo <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/category\/gitops\/\">velk\u00e9 mno\u017estv\u00ed<\/a><\/noindex> publikac\u00ed a p\u0159\u00edpad\u016f pou\u017eit\u00ed GitOps. Ale n\u011bkte\u0159\u00ed lid\u00e9 st\u00e1le m\u011bli ot\u00e1zky. Jak se model li\u0161\u00ed od tradi\u010dn\u00edho <noindex><a rel=\"nofollow\" href=\"https:\/\/puppet.com\/blog\/a-deployment-pipeline-for-infrastructure-a-devops-case-study-at-nbn\">infrastructure as code<\/a><\/noindex> a nep\u0159etr\u017eit\u00e9ho dod\u00e1v\u00e1n\u00ed (<noindex><a rel=\"nofollow\" href=\"https:\/\/puppet.com\/blog\/a-deployment-pipeline-for-infrastructure-a-devops-case-study-at-nbn\">continuous delivery<\/a><\/noindex>)? Je nutn\u00e9 pou\u017e\u00edvat Kubernetes?<\/p>\n<p>Brzy jsme si uv\u011bdomili, \u017ee je pot\u0159eba nov\u00e9 vysv\u011btlen\u00ed, kter\u00e9 nab\u00edz\u00ed:<\/p>\n<ol>\n<li> Velk\u00e9 mno\u017estv\u00ed p\u0159\u00edklad\u016f a p\u0159\u00edb\u011bh\u016f;<\/li>\n<li> Konkr\u00e9tn\u00ed definici GitOps;<\/li>\n<li> Srovn\u00e1n\u00ed s tradi\u010dn\u00edm nep\u0159etr\u017eit\u00fdm dod\u00e1v\u00e1n\u00edm.<\/li>\n<\/ol>\n<p>\nV tomto \u010dl\u00e1nku jsme se pokusili zahrnout v\u0161echna tato t\u00e9mata. Najdete v n\u011bm aktualizovan\u00fd \u00favod do GitOps a pohled na n\u011bj z pohledu v\u00fdvoj\u00e1\u0159\u016f a CI\/CD. V\u011bt\u0161inou se soust\u0159ed\u00edme na Kubernetes, i kdy\u017e model lze pom\u011brn\u011b dob\u0159e zobecnit.<\/p>\n<h2>Seznamte se: GitOps<\/h2>\n<p>\nP\u0159edstavte si Alici. \u0158\u00edd\u00ed spole\u010dnost Family Insurance, kter\u00e1 nab\u00edz\u00ed pojistn\u00e9 produkty pro zdravotn\u00ed, automobilov\u00e9 a nemovitostn\u00ed poji\u0161t\u011bn\u00ed, stejn\u011b jako cestovn\u00ed poji\u0161t\u011bn\u00ed lidem, kte\u0159\u00ed maj\u00ed p\u0159\u00edli\u0161 m\u00e1lo \u010dasu na porozum\u011bn\u00ed slo\u017eitostem smluv. Jej\u00ed podnik\u00e1n\u00ed za\u010dalo jako vedlej\u0161\u00ed projekt, kdy\u017e Alice pracovala v bance jako datov\u00e1 v\u011bdkyn\u011b. Jednou si uv\u011bdomila, \u017ee m\u016f\u017ee vyu\u017e\u00edt pokro\u010dil\u00e9 po\u010d\u00edta\u010dov\u00e9 algoritmy k efektivn\u011bj\u0161\u00ed anal\u00fdze dat a vytv\u00e1\u0159en\u00ed pojistn\u00fdch bal\u00ed\u010dk\u016f. Investo\u0159i projekt financovali a nyn\u00ed jej\u00ed spole\u010dnost p\u0159in\u00e1\u0161\u00ed v\u00edce ne\u017e 20 milion\u016f dolar\u016f ro\u010dn\u011b a rychle roste. V sou\u010dasn\u00e9 dob\u011b v n\u00ed pracuje na r\u016fzn\u00fdch pozic\u00edch 180 zam\u011bstnanc\u016f. Mezi nimi je technologick\u00fd t\u00fdm, kter\u00fd se zab\u00fdv\u00e1 v\u00fdvojem, \u00fadr\u017ebou webu, datab\u00e1ze a anal\u00fdzou klientsk\u00e9 z\u00e1kladny. T\u00fdm o 60 lidech vede Bob \u2014 technick\u00fd \u0159editel spole\u010dnosti.<\/p>\n<p>Bob\u016fv t\u00fdm nasazuje produk\u010dn\u00ed syst\u00e9my v cloudu. Jejich hlavn\u00ed aplikace b\u011b\u017e\u00ed na GKE, t\u011b\u017e\u00ed z v\u00fdhod Kubernetes v Google Cloudu. Krom\u011b toho pou\u017e\u00edvaj\u00ed r\u016fzn\u00e9 n\u00e1stroje pro pr\u00e1ci s daty a anal\u00fdzu.<\/p>\n<p>Rodinn\u00e9 poji\u0161t\u011bn\u00ed nem\u011blo v \u00famyslu pou\u017e\u00edvat kontejnery, ale nakazilo se nad\u0161en\u00edm kolem Dockeru. Brzy odborn\u00edci spole\u010dnosti zjistili, \u017ee GKE umo\u017e\u0148uje snadn\u00e9 a bezprobl\u00e9mov\u00e9 nasazen\u00ed klastr\u016f pro testov\u00e1n\u00ed nov\u00fdch funkc\u00ed. Byly p\u0159id\u00e1ny Jenkins pro CI a Quay pro organizaci registru kontejner\u016f, napsaly se skripty pro Jenkins, kter\u00e9 pushovaly nov\u00e9 kontejnery a konfigurace do GKE.<\/p>\n<p>N\u011bjak\u00fd \u010das uplynul. Alisa a Bob byli zklam\u00e1ni v\u00fdkonem vybran\u00e9ho p\u0159\u00edstupu a jeho vlivem na podnik\u00e1n\u00ed. Implementace kontejner\u016f nezlep\u0161ila v\u00fdkon tak, jak doufal t\u00fdm. N\u011bkdy nasazen\u00ed selhalo a nebylo jasn\u00e9, zda za to mohou zm\u011bny k\u00f3du. Tak\u00e9 bylo t\u011b\u017ek\u00e9 sledovat zm\u011bny konfigurac\u00ed. \u010casto bylo nutn\u00e9 vytvo\u0159it nov\u00fd klastr a p\u0159esunout do n\u011bj aplikace, proto\u017ee to byla nejjednodu\u0161\u0161\u00ed cesta, jak uklidit nepo\u0159\u00e1dek, do kter\u00e9ho se syst\u00e9m prom\u011bnil. Alisa se ob\u00e1vala, \u017ee situace se zhor\u0161\u00ed s v\u00fdvojem aplikace (krom\u011b toho se r\u00fdsoval nov\u00fd projekt zalo\u017een\u00fd na strojov\u00e9m u\u010den\u00ed). Bob automatizoval v\u011bt\u0161inu pr\u00e1ce a nech\u00e1pal, pro\u010d pipeline st\u00e1le nen\u00ed stabiln\u00ed, \u0161patn\u011b se \u0161k\u00e1luje a ob\u010das vy\u017eaduje ru\u010dn\u00ed z\u00e1sah?<\/p>\n<p><b>Pot\u00e9 se dozv\u011bd\u011bli o GitOps. Toto \u0159e\u0161en\u00ed se uk\u00e1zalo b\u00fdt p\u0159esn\u011b t\u00edm, co pot\u0159ebovali pro jist\u00fd pokrok.<\/b><\/p>\n<p>Alice a Bob u\u017e l\u00e9ta sly\u0161eli o pracovn\u00edch procesech zalo\u017een\u00fdch na Gitu, DevOps a infrastruktu\u0159e jako k\u00f3du. Jedine\u010dnost GitOps spo\u010d\u00edv\u00e1 v tom, \u017ee p\u0159in\u00e1\u0161\u00ed \u0159adu osv\u011bd\u010den\u00fdch praktik - kategorick\u00fdch a regulativn\u00edch - pro implementaci t\u011bchto n\u00e1pad\u016f v kontextu Kubernetes. Tato t\u00e9ma <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/search?q=gitops&amp;src=typd\">byla n\u011bkolikr\u00e1t prob\u00edr\u00e1na<\/a><\/noindex>, v\u010detn\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/gitops-high-velocity-cicd-for-kubernetes\">blogu Weaveworks<\/a><\/noindex>.<\/p>\n<p>Family Insurance se rozhodla zav\u00e9st GitOps. Nyn\u00ed m\u00e1 spole\u010dnost automatizovan\u00fd model provozu kompatibiln\u00ed s Kubernetes a kombinuje <i>rychlost<\/i> s <i>stabilitu<\/i>, proto\u017ee:<\/p>\n<ul>\n<li> zjistili, \u017ee v\u00fdkon t\u00fdmu se zdvojn\u00e1sobil a nikdo se p\u0159i tom nezbl\u00e1znil;<\/li>\n<li> p\u0159estali spravovat skripty. M\u00edsto toho se nyn\u00ed mohou soust\u0159edit na nov\u00e9 funkce a zlep\u0161ov\u00e1n\u00ed in\u017een\u00fdrsk\u00fdch metod - nap\u0159\u00edklad zav\u00e9st kan\u00e1rkov\u00e1 nasazen\u00ed a zlep\u0161it testov\u00e1n\u00ed;<\/li>\n<li> vylep\u0161ili proces nasazen\u00ed - nyn\u00ed se \u010dasto nerozb\u00edj\u00ed;<\/li>\n<li> z\u00edskali schopnost obnovovat nasazen\u00ed po \u010d\u00e1ste\u010dn\u00fdch poruch\u00e1ch bez ru\u010dn\u00edho z\u00e1sahu;<\/li>\n<li> z\u00edskali v\u011bt\u0161\u00ed d\u016fv\u011bru v dodac\u00ed syst\u00e9my. Alice a Bob zjistili, \u017ee mohou rozd\u011blit t\u00fdm na skupiny zab\u00fdvaj\u00edc\u00ed se mikroslu\u017ebami a pracuj\u00edc\u00ed paraleln\u011b;<i>o<\/i>mohou prov\u00e1d\u011bt 30-50 zm\u011bn v projektu ka\u017ed\u00fd den d\u00edky \u00fasil\u00ed ka\u017ed\u00e9 skupiny a zkou\u0161et nov\u00e9 techniky;<\/li>\n<li> mohou denn\u011b prov\u00e1d\u011bt 30-50 zm\u011bn v projektu vynalo\u017een\u00edm \u00fasil\u00ed ka\u017ed\u00e9 skupiny a zkou\u0161et nov\u00e9 techniky;<\/li>\n<li> snadno p\u0159itahuj\u00ed nov\u00e9 v\u00fdvoj\u00e1\u0159e do projektu, kte\u0159\u00ed maj\u00ed mo\u017enost nasazovat aktualizace na produkci pomoc\u00ed pull request\u016f ji\u017e za n\u011bkolik hodin;<\/li>\n<li> snadno proch\u00e1zej\u00ed auditem v r\u00e1mci SOC2 <i>(na shodu poskytovatel\u016f slu\u017eeb s po\u017eadavky na bezpe\u010dn\u00e9 \u0159\u00edzen\u00ed dat; v\u00edce si p\u0159e\u010dt\u011bte nap\u0159\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.imperva.com\/learn\/data-security\/soc-2-compliance\/\">zde<\/a><\/noindex> \u2014 pozn. p\u0159ekl.)<\/i>.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Co se stalo?<\/h3>\n<p>\nGitOps \u2014 to jsou dv\u011b v\u011bci:<\/p>\n<ol>\n<li> Model provozu pro Kubernetes a cloud native. Poskytuje sadu osv\u011bd\u010den\u00fdch postup\u016f pro nasazen\u00ed, spr\u00e1vu a monitorov\u00e1n\u00ed kontejnerovan\u00fdch cluster\u016f a aplikac\u00ed. Elegantn\u00ed definice v podob\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/vitorsilva\/status\/999978906903080961\">jednoho slajdu<\/a><\/noindex> od <noindex><a rel=\"nofollow\" href=\"https:\/\/2018.agilept.org\/speaker_luis_faceira.html\">Luis Faceira<\/a><\/noindex>:\n<\/li>\n<li> Cesta k vytvo\u0159en\u00ed v\u00fdvoj\u00e1\u0159sk\u00e9ho prost\u0159ed\u00ed pro spr\u00e1vu aplikac\u00ed. Pou\u017e\u00edv\u00e1me pracovn\u00ed postup Git jak pro provoz, tak pro v\u00fdvoj. V\u0161imn\u011bte si, \u017ee se nejedn\u00e1 pouze o Git push, ale o organizaci cel\u00e9ho souboru n\u00e1stroj\u016f CI\/CD a UI\/UX.<\/li>\n<\/ol>\n<p><\/p>\n<h3>P\u00e1r slov o Gitu<\/h3>\n<p>\nPokud nejste obezn\u00e1meni se syst\u00e9my spr\u00e1vy verz\u00ed a pracovn\u00edm postupem zalo\u017een\u00fdm na Git, d\u016frazn\u011b doporu\u010dujeme se je nau\u010dit. Pr\u00e1ce s v\u011btvemi a pull requesty se na za\u010d\u00e1tku m\u016f\u017ee zd\u00e1t jako \u010dern\u00e1 magie, ale v\u00fdhody stoj\u00ed za vynalo\u017een\u00e9 \u00fasil\u00ed. Zde je <noindex><a rel=\"nofollow\" href=\"https:\/\/codeburst.io\/trunk-based-development-vs-git-flow-a0212a6cae64\">dobr\u00fd \u010dl\u00e1nek<\/a><\/noindex> k za\u010d\u00e1tku.<\/p>\n<h2>Jak funguje Kubernetes<\/h2>\n<p>\nV na\u0161em p\u0159\u00edb\u011bhu se Alice a Bob obr\u00e1tili na GitOps pot\u00e9, co n\u011bjakou dobu pracovali s Kubernetes. Opravdu, GitOps je \u00fazce spjat s Kubernetes \u2014 je to model provozu pro infrastrukturu a aplikace zalo\u017een\u00e9 na Kubernetes.<\/p>\n<h3>Co Kubernetes poskytuje u\u017eivatel\u016fm?<\/h3>\n<p>\nZde jsou n\u011bkter\u00e9 hlavn\u00ed schopnosti:<\/p>\n<ol>\n<li> V modelu Kubernetes lze v\u0161e popisovat v deklarativn\u00ed form\u011b.<\/li>\n<li> API server Kubernetes p\u0159ij\u00edm\u00e1 tento deklaraci jako vstupn\u00ed data a neust\u00e1le se sna\u017e\u00ed uv\u00e9st cluster do stavu popsan\u00e9ho v deklaraci.<\/li>\n<li> Deklarace jsou dostate\u010dn\u00e9 k popisu a spr\u00e1v\u011b \u0161irok\u00e9ho spektra pracovn\u00edch z\u00e1t\u011b\u017e\u00ed \u2014 \"aplikac\u00ed\".<\/li>\n<li> V d\u016fsledku toho doch\u00e1z\u00ed ke zm\u011bn\u00e1m v aplikaci a clusteru z d\u016fvodu:\n<ul>\n<li> zm\u011bn v obrazech kontejner\u016f;<\/li>\n<li> zm\u011bn v deklarativn\u00ed specifikaci;<\/li>\n<li> chyb v prost\u0159ed\u00ed \u2014 nap\u0159\u00edklad p\u00e1d kontejner\u016f.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<h3>Skv\u011bl\u00e9 schopnosti Kubernetes v konvergenci<\/h3>\n<p>\nKdy\u017e spr\u00e1vce provede zm\u011bny v konfiguraci, orchestrace Kubernetes je aplikuje na cluster, dokud jeho stav <i>se nep\u0159ibl\u00ed\u017e\u00ed nov\u00e9 konfiguraci<\/i>. Tento model funguje pro ka\u017ed\u00fd zdroj Kubernetes a roz\u0161i\u0159uje se pomoc\u00ed Custom Resource Definitions (CRDs). Proto maj\u00ed nasazen\u00ed Kubernetes n\u00e1sleduj\u00edc\u00ed \u00fa\u017easn\u00e9 vlastnosti:<\/p>\n<ul>\n<li> <b>Automatizace<\/b>: aktualizace Kubernetes poskytuj\u00ed mechanismus pro automatizaci procesu aplikace zm\u011bn spr\u00e1vn\u011b a v\u010das.<\/li>\n<li> <b>Konvergence<\/b>: Kubernetes se bude i nad\u00e1le sna\u017eit o aktualizace, dokud nebude \u00fasp\u011b\u0161n\u00fd.<\/li>\n<li> <b>Idempotence<\/b>: opakovan\u00e9 aplikace konvergence vedou ke stejn\u00e9mu v\u00fdsledku.<\/li>\n<li> <b>Determinismus<\/b>: za dostate\u010dn\u00fdch zdroj\u016f je stav aktualizovan\u00e9ho clusteru z\u00e1visl\u00fd pouze na po\u017eadovan\u00e9m stavu.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Jak GitOps funguje<\/h2>\n<p>\nDostate\u010dn\u011b jsme se nau\u010dili o Kubernetes, abychom mohli vysv\u011btlit principy fungov\u00e1n\u00ed GitOps.<\/p>\n<p>Vra\u0165me se k t\u00fdm\u016fm Family Insurance, kter\u00e9 se zab\u00fdvaj\u00ed mikroslu\u017ebami. \u010c\u00edm se obvykle zab\u00fdvaj\u00ed? Pod\u00edvejte se na seznam n\u00ed\u017ee (pokud se v\u00e1m n\u011bkter\u00e9 polo\u017eky zdaj\u00ed podivn\u00e9 nebo nezn\u00e1m\u00e9, pros\u00edm, zdr\u017ete se kritiky a z\u016fsta\u0148te s n\u00e1mi). Toto jsou jen p\u0159\u00edklady pracovn\u00edch proces\u016f zalo\u017een\u00fdch na Jenkinsu. Existuje tak\u00e9 mnoho dal\u0161\u00edch proces\u016f p\u0159i pr\u00e1ci s jin\u00fdmi n\u00e1stroji.<\/p>\n<p>Hlavn\u00ed je, \u017ee vid\u00edme, \u017ee ka\u017ed\u00e1 aktualizace kon\u010d\u00ed proveden\u00edm zm\u011bn v konfigura\u010dn\u00edch souborech a Git repozit\u00e1\u0159\u00edch. Tyto zm\u011bny v Gitu vedou k tomu, \u017ee \u201eGitOps oper\u00e1tor\u201c aktualizuje cluster:<\/p>\n<p>1. Pracovn\u00ed proces: \u201e<i>Jenkins build \u2014 master v\u011btev<\/i>\u00bb.<br \/>\nSeznam \u00fakol\u016f:<\/p>\n<ul>\n<li> Jenkins pushuje tagovan\u00e9 obrazy do Quay;<\/li>\n<li> Jenkins pushuje konfiguraci a Helm grafy do bucketu hlavn\u00edho \u00falo\u017ei\u0161t\u011b;<\/li>\n<li> Cloudov\u00e1 funkce zkop\u00edruje konfiguraci a \u0161ablony z master storage bucketu do Git repozit\u00e1\u0159e master;<\/li>\n<li> GitOps oper\u00e1tor aktualizuje cluster.<\/li>\n<\/ul>\n<p>\n2. <i>Jenkins build \u2014 release nebo hotfix v\u011btev<\/i>:<\/p>\n<ul>\n<li> Jenkins pushuje netagovan\u00e9 obrazy do Quay;<\/li>\n<li> Jenkins pushuje konfiguraci a Helm grafy do bucketu staging \u00falo\u017ei\u0161t\u011b;<\/li>\n<li> Cloudov\u00e1 funkce zkop\u00edruje konfiguraci a \u0161ablony ze staging storage bucketu do Git repozit\u00e1\u0159e staging;<\/li>\n<li> GitOps oper\u00e1tor aktualizuje cluster.<\/li>\n<\/ul>\n<p>\n3. <i>Jenkins build \u2014 develop nebo feature v\u011btev<\/i>:<\/p>\n<ul>\n<li> Jenkins pushuje netagovan\u00e9 obrazy do Quay;<\/li>\n<li> Jenkins pushuje konfiguraci a Helm grafy do bucketu develop \u00falo\u017ei\u0161t\u011b;<\/li>\n<li> Cloudov\u00e1 funkce zkop\u00edruje konfiguraci a \u0161ablony z develop storage bucketu do Git repozit\u00e1\u0159e develop;<\/li>\n<li>GitOps oper\u00e1tor aktualizuje cluster.<\/li>\n<\/ul>\n<p>\n4. <i>P\u0159id\u00e1n\u00ed nov\u00e9ho klienta<\/i>:<\/p>\n<ul>\n<li> Manager nebo administr\u00e1tor (LCM\/ops) spou\u0161t\u00ed Gradle pro po\u010d\u00e1te\u010dn\u00ed nasazen\u00ed a nastaven\u00ed s\u00ed\u0165ov\u00fdch vyrovn\u00e1va\u010d\u016f zat\u00ed\u017een\u00ed (NLB);<\/li>\n<li> LCM\/ops commituje novou konfiguraci k p\u0159\u00edprav\u011b nasazen\u00ed na aktualizace;<\/li>\n<li> GitOps oper\u00e1tor aktualizuje cluster.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Kr\u00e1tk\u00fd popis GitOps<\/h3>\n<p><\/p>\n<ol>\n<li> Popi\u0161te po\u017eadovan\u00fd stav cel\u00e9ho syst\u00e9mu pomoc\u00ed deklarativn\u00edch specifikac\u00ed pro ka\u017ed\u00e9 prost\u0159ed\u00ed (v na\u0161em p\u0159\u00edb\u011bhu t\u00fdm Boba ur\u010duje v\u0161echny konfigurace syst\u00e9mu v Gitu).\n<ul>\n<li> Gitov\u00fd repozit\u00e1\u0159 je jedin\u00fdm zdrojem pravdy ohledn\u011b po\u017eadovan\u00e9ho stavu cel\u00e9ho syst\u00e9mu.<\/li>\n<li> V\u0161echny zm\u011bny v po\u017eadovan\u00e9m stavu se prov\u00e1d\u011bj\u00ed prost\u0159ednictv\u00edm commit\u016f v Gitu.<\/li>\n<li> V\u0161echny po\u017eadovan\u00e9 parametry clusteru jsou tak\u00e9 pozorovateln\u00e9 v samotn\u00e9m clusteru. Tak\u017ee m\u016f\u017eeme ur\u010dit, zda se po\u017eadovan\u00e9 a pozorovan\u00e9 stavy shoduj\u00ed (konverguj\u00ed, <i>converge<\/i>) nebo li\u0161\u00ed (diverguj\u00ed, <i>diverge<\/i>) po\u017eadovan\u00e9 a pozorovan\u00e9 stavy.<\/li>\n<\/ul>\n<\/li>\n<li> Pokud se po\u017eadovan\u00e9 a pozorovan\u00e9 stavy li\u0161\u00ed, pak:\n<ul>\n<li> Existuje mechanismus konvergence, kter\u00fd d\u0159\u00edve \u010di pozd\u011bji automaticky synchronizuje c\u00edlov\u00fd a pozorovan\u00fd stav. O to se v clusteru star\u00e1 Kubernetes.<\/li>\n<li> Proces je spu\u0161t\u011bn okam\u017eit\u011b s upozorn\u011bn\u00edm \u201ezm\u011bna potvrzena\u201c.<\/li>\n<li> Po ur\u010dit\u00e9m nastaviteln\u00e9ho \u010dasov\u00e9m intervalu m\u016f\u017ee b\u00fdt odesl\u00e1no upozorn\u011bn\u00ed \u201ediff\u201c, pokud se stavy li\u0161\u00ed.<\/li>\n<\/ul>\n<\/li>\n<li> Tak\u017ee v\u0161echny commity v Gitu vyvol\u00e1vaj\u00ed kontrolovateln\u00e9 a idempotentn\u00ed aktualizace v clusteru.\n<ul>\n<li>Rollback je konvergence k d\u0159\u00edve po\u017eadovan\u00e9mu stavu.<\/li>\n<\/ul>\n<\/li>\n<li> Konvergence je definitivn\u00ed. O jej\u00edm dosa\u017een\u00ed sv\u011bd\u010d\u00ed:\n<ul>\n<li> Nedostatek upozorn\u011bn\u00ed \u201ediff\u201c po ur\u010dit\u00e9m \u010dasov\u00e9m intervalu.<\/li>\n<li> Upozorn\u011bn\u00ed \u201econverged\u201c (nap\u0159\u00edklad webhook, ud\u00e1lost Git writeback).<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/p>\n<h3>Co je divergence?<\/h3>\n<p>\nOpakujme znovu: <i>v\u0161echny po\u017eadovan\u00e9 vlastnosti clusteru by m\u011bly b\u00fdt pozorovateln\u00e9 v samotn\u00e9m clusteru.<\/i>.<\/p>\n<p>N\u011bkolik p\u0159\u00edklad\u016f divergence:<\/p>\n<ul>\n<li> Zm\u011bna v konfigura\u010dn\u00edm souboru v d\u016fsledku slou\u010den\u00ed v\u011btv\u00ed v Gitu.<\/li>\n<li> Zm\u011bna v konfigura\u010dn\u00edm souboru v d\u016fsledku commitu v Gitu, proveden\u00e9ho GUI klientem.<\/li>\n<li> V\u00edcen\u00e1sobn\u00e9 zm\u011bny v po\u017eadovan\u00e9m stavu v d\u016fsledku PR v Gitu s n\u00e1sledn\u00fdm sestaven\u00edm kontejnerov\u00e9ho obrazu a zm\u011bnami v konfiguraci.<\/li>\n<li> Zm\u011bna stavu clusteru v d\u016fsledku chyby, konfliktu zdroj\u016f vedouc\u00edmu k \u201e\u0161patn\u00e9mu chov\u00e1n\u00ed\u201c, nebo prost\u011b n\u00e1hodn\u00e9ho odklonu od p\u016fvodn\u00edho stavu.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Co p\u0159edstavuje mechanismus konvergence?<\/h3>\n<p>\nN\u011bkolik p\u0159\u00edklad\u016f:<\/p>\n<ul>\n<li> Pro kontejnery a clustery poskytuje mechanismus konvergence Kubernetes.<\/li>\n<li> Tent\u00fd\u017e mechanismus lze pou\u017e\u00edt pro spr\u00e1vu aplikac\u00ed a konstrukc\u00ed zalo\u017een\u00fdch na Kubernetes (nap\u0159\u00edklad Istio a Kubeflow).<\/li>\n<li> Mechanismus pro \u0159\u00edzen\u00ed pracovn\u00edho interakce mezi Kubernetes, repozit\u00e1\u0159i obraz\u016f a Gitem poskytuje <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/weaveworks\/flux\">GitOps oper\u00e1tor Weave Flux<\/a><\/noindex>, kter\u00fd je sou\u010d\u00e1st\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.weave.works\/\">Weave Cloud<\/a><\/noindex>.<\/li>\n<li> Pro z\u00e1kladn\u00ed stroje mus\u00ed b\u00fdt mechanismus konvergence deklarativn\u00ed a autonomn\u00ed. Na z\u00e1klad\u011b na\u0161ich zku\u0161enost\u00ed m\u016f\u017eeme \u0159\u00edci, \u017ee <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.gruntwork.io\/why-we-use-terraform-and-not-chef-puppet-ansible-saltstack-or-cloudformation-7989dad2865c\">Terraform<\/a><\/noindex> se nejv\u00edce bl\u00ed\u017e\u00ed tomuto vymezen\u00ed, p\u0159esto v\u0161ak vy\u017eaduje lidskou kontrolu. V tomto smyslu GitOps roz\u0161i\u0159uje tradice Infrastructure as Code.<\/li>\n<\/ul>\n<p>\nGitOps spojuje Git s vynikaj\u00edc\u00edm mechanismem konvergence Kubernetes, nab\u00edzej\u00edc\u00ed model pro provoz.<\/p>\n<p>GitOps n\u00e1m umo\u017e\u0148uje \u0159\u00edct: <i>k automatizaci a kontrole podl\u00e9haj\u00ed pouze syst\u00e9my, kter\u00e9 lze popisovat a sledovat<\/i>.<\/p>\n<h3>GitOps je ur\u010den pro cel\u00fd cloud native stack (nap\u0159. Terraform atd.)<\/h3>\n<p>\nGitOps nen\u00ed jen Kubernetes. Chceme, aby cel\u00fd syst\u00e9m byl \u0159\u00edzen deklarativn\u011b a vyu\u017e\u00edval konvergenci. Pod cel\u00fdm syst\u00e9mem rozum\u00edme souhrn prost\u0159ed\u00ed pracuj\u00edc\u00edch s Kubernetes \u2013 nap\u0159\u00edklad 'dev cluster 1', 'production' atd. Do ka\u017ed\u00e9ho prost\u0159ed\u00ed pat\u0159\u00ed stroje, clustery, aplikace a tak\u00e9 rozhran\u00ed pro extern\u00ed slu\u017eby, kter\u00e9 poskytuj\u00ed data, sledov\u00e1n\u00ed atd.<\/p>\n<p>V\u0161imn\u011bte si, jak d\u016fle\u017eit\u00fd je v tomto p\u0159\u00edpad\u011b Terraform pro probl\u00e9m bootstrappingu. Kubernetes mus\u00ed b\u00fdt n\u011bkde nasazen, a pou\u017eit\u00ed Terraformu znamen\u00e1, \u017ee m\u016f\u017eeme aplikovat stejn\u00e9 pracovn\u00ed postupy GitOps pro vytvo\u0159en\u00ed \u0159\u00eddic\u00ed vrstvy, kter\u00e1 le\u017e\u00ed na z\u00e1klad\u011b Kubernetes a aplikac\u00ed. To je dobr\u00e1 praxe.<\/p>\n<p>Velk\u00e1 pozornost je v\u011bnov\u00e1na aplikaci koncept\u016f GitOps na vrstvy nad Kubernetes. V sou\u010dasn\u00e9 dob\u011b existuj\u00ed \u0159e\u0161en\u00ed typu GitOps pro Istio, Helm, Ksonnet, OpenFaaS a Kubeflow, stejn\u011b jako nap\u0159\u00edklad pro Pulumi, kter\u00e1 vytv\u00e1\u0159ej\u00ed vrstvu pro v\u00fdvoj aplikac\u00ed pro cloud native.<\/p>\n<h2>Kubernetes CI\/CD: srovn\u00e1n\u00ed GitOps s jin\u00fdmi p\u0159\u00edstupy<\/h2>\n<p>\nJak bylo \u0159e\u010deno, GitOps je dv\u011b v\u011bci:<\/p>\n<ol>\n<li> Model provozu pro Kubernetes a cloud native, popsan\u00fd v\u00fd\u0161e.<\/li>\n<li> Cesta k organizaci orientovan\u00e9 na v\u00fdvoj\u00e1\u0159e pro spr\u00e1vu aplikac\u00ed.<\/li>\n<\/ol>\n<p>\nPro mnoh\u00e9 je GitOps p\u0159edev\u0161\u00edm pracovn\u00ed postup zalo\u017een\u00fd na Git push\u00edch. To se n\u00e1m tak\u00e9 l\u00edb\u00ed. Ale to nen\u00ed v\u0161e: pod\u00edvejme se nyn\u00ed na CI\/CD pipeline.<\/p>\n<h3>GitOps zaji\u0161\u0165uje kontinu\u00e1ln\u00ed nasazen\u00ed (CD) pod Kubernetes<\/h3>\n<p>\nGitOps nab\u00edz\u00ed mechanismus kontinu\u00e1ln\u00edho nasazen\u00ed, kter\u00fd eliminuje pot\u0159ebu samostatn\u00fdch 'nasazovac\u00edch syst\u00e9m\u016f'. Celou pr\u00e1ci za v\u00e1s vykon\u00e1v\u00e1 Kubernetes.<\/p>\n<ul>\n<li> Aktualizace aplikace vy\u017eaduje aktualizaci v Git. To je transak\u010dn\u00ed aktualizace do po\u017eadovan\u00e9ho stavu. \u201eNasazen\u00ed\u201c je pot\u00e9 prov\u00e1d\u011bno uvnit\u0159 clusteru samotn\u00fdm Kubernetes na z\u00e1klad\u011b aktualizovan\u00e9ho popisu.<\/li>\n<li> Vzhledem k povaze fungov\u00e1n\u00ed Kubernetes jsou tyto aktualizace konvergentn\u00ed. To zaji\u0161\u0165uje mechanismus pro kontinu\u00e1ln\u00ed nasazen\u00ed, kde jsou v\u0161echny aktualizace atom\u00e1rn\u00ed.<\/li>\n<li> Pozn\u00e1mka: <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.weave.works\/\">Weave Cloud<\/a><\/noindex> nab\u00edz\u00ed GitOps oper\u00e1tora, kter\u00fd integruje Git a Kubernetes a umo\u017e\u0148uje prov\u00e1d\u011bt CD prost\u0159ednictv\u00edm souladu po\u017eadovan\u00e9ho a aktu\u00e1ln\u00edho stavu clusteru.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Bez kubectl a skript\u016f<\/h3>\n<p>\nJe t\u0159eba se vyhnout pou\u017e\u00edv\u00e1n\u00ed Kubectl pro aktualizaci clusteru, zejm\u00e9na skript\u016f pro seskupov\u00e1n\u00ed p\u0159\u00edkaz\u016f kubectl. M\u00edsto toho m\u016f\u017ee u\u017eivatel aktualizovat sv\u016fj cluster Kubernetes prost\u0159ednictv\u00edm GitOps pipeline.<\/p>\n<p>V\u00fdhody zahrnuj\u00ed:<\/p>\n<ol>\n<li> <b>Spr\u00e1vnost<\/b>. Skupinu aktualizac\u00ed lze aplikovat, konvergovat a nakonec ov\u011b\u0159it, co\u017e n\u00e1s p\u0159ibli\u017euje k c\u00edli atom\u00e1rn\u00edho nasazen\u00ed. Naopak, pou\u017eit\u00ed skript\u016f neposkytuje \u017e\u00e1dn\u00e9 z\u00e1ruky konvergence (v\u00edce o tom n\u00ed\u017ee).<\/li>\n<li> <b>Bezpe\u010dnost<\/b>. <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/kelseyhightower\/status\/939003832805179392?lang=en\">Cituji<\/a><\/noindex> Kelsey Hightower: \"Omezte p\u0159\u00edstup k clusteru Kubernetes automatiza\u010dn\u00edm n\u00e1stroj\u016fm a administr\u00e1tor\u016fm, jejich\u017e \u00fakolem je jeho lad\u011bn\u00ed nebo \u00fadr\u017eba funk\u010dnosti.\" V\u00edce informac\u00ed viz <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/gitops-compliance-and-secure-cicd\">moji publikaci<\/a><\/noindex> o bezpe\u010dnosti a soulad\u011b technick\u00fdch podm\u00ednek, stejn\u011b jako <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@vesirin\/how-i-gained-commit-access-to-homebrew-in-30-minutes-2ae314df03ab\">\u010dl\u00e1nek o hackov\u00e1n\u00ed Homebrew<\/a><\/noindex> zp\u016fsobem z\u00edsk\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f z nedbale sestaven\u00e9ho Jenkins skriptu.<\/li>\n<li> <b>U\u017eivatelsk\u00e1 zku\u0161enost<\/b>. Kubectl odhaluje mechaniku objektov\u00e9ho modelu Kubernetes, kter\u00fd je velmi slo\u017eit\u00fd. Ide\u00e1ln\u011b by u\u017eivatel\u00e9 m\u011bli interagovat se syst\u00e9mem na vy\u0161\u0161\u00ed \u00farovni abstrakce. Zde se znovu odvol\u00e1m na Kelsey a doporu\u010d\u00edm pod\u00edvat se na <noindex><a rel=\"nofollow\" href=\"http:\/\/superuser.openstack.org\/articles\/kubernetes-boring\/\">takov\u00e9 shrnut\u00ed<\/a><\/noindex>.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Rozd\u00edl mezi CI a CD<\/h3>\n<p>\nGitOps zlep\u0161uje existuj\u00edc\u00ed CI\/CD modely.<\/p>\n<p>Modern\u00ed CI server je n\u00e1stroj pro orchestraci. Vytv\u00e1\u0159\u00ed to konkr\u00e9tn\u011b n\u00e1stroj pro orchestraci CI pipeline. Ty zahrnuj\u00ed build, test, merge to trunk atd. CI servery automatizuj\u00ed spr\u00e1vu slo\u017eit\u00fdch v\u00edcestup\u0148ov\u00fdch pipeline. Roz\u0161\u00ed\u0159en\u00fdm poku\u0161en\u00edm je vytvo\u0159it skript pro sadu aktualizac\u00ed Kubernetes a prov\u00e9st jej jako prvek pipeline pro push zm\u011bn do clusteru. Opravdu, takto \u010din\u00ed mnoz\u00ed odborn\u00edci. Nicm\u00e9n\u011b, to nen\u00ed optim\u00e1ln\u00ed, a tady je d\u016fvod, pro\u010d.<\/p>\n<p>CI by m\u011bla b\u00fdt pou\u017e\u00edv\u00e1na k aplikaci aktualizac\u00ed do trunku a Kubernetes cluster by se m\u011bl m\u011bnit na z\u00e1klad\u011b t\u011bchto aktualizac\u00ed, aby spravoval CD \u201eintern\u011b\u201c. Naz\u00fdv\u00e1me to <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/gitops-compliance-and-secure-cicd\">pull-modelem pro CD<\/a><\/noindex>, na rozd\u00edl od CI push-modelu. CD je sou\u010d\u00e1st\u00ed <i>runtime-orchestrace.<\/i>.<\/p>\n<h3>Pro\u010d by CI servery nem\u011bly prov\u00e1d\u011bt CD prost\u0159ednictv\u00edm p\u0159\u00edm\u00fdch aktualizac\u00ed v Kubernetes<\/h3>\n<p>\n<i>Nepou\u017e\u00edvejte CI server pro orchestraci p\u0159\u00edm\u00fdch aktualizac\u00ed v Kubernetes ve form\u011b sady CI \u00faloh. To je anti-patern, o kter\u00e9m jsme <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/kubernetes-anti-patterns-let-s-do-gitops-not-ciops\">u\u017e mluvili<\/a><\/noindex> na na\u0161em blogu.<\/i><\/p>\n<p>Vra\u0165me se k Alici a Bobovi.<\/p>\n<p>S jak\u00fdmi probl\u00e9my se pot\u00fdkali? CI server Boba aplikuje zm\u011bny do clusteru, ale pokud v procesu sel\u017ee, Bob nebude v\u011bd\u011bt, v jak\u00e9m stavu se cluster nach\u00e1z\u00ed (nebo by m\u011bl b\u00fdt) a jak ho opravit. Tot\u00e9\u017e plat\u00ed i v p\u0159\u00edpad\u011b \u00fasp\u011bchu.<\/p>\n<p>P\u0159edstavme si, \u017ee Bob\u016fv t\u00fdm vytvo\u0159il nov\u00fd obraz a pot\u00e9 aktualizoval sv\u00e9 nasazen\u00ed, aby nasadil obraz (to v\u0161e z CI pipeline).<\/p>\n<p>Pokud se obraz vytvo\u0159\u00ed spr\u00e1vn\u011b, ale pipeline sel\u017ee, t\u00fdm bude muset zjistit:<\/p>\n<ul>\n<li> Byla aktualizace nasazena?<\/li>\n<li> Spou\u0161t\u00edme novou sestavu? Povede to k ne\u017e\u00e1douc\u00edm vedlej\u0161\u00edm \u00fa\u010dink\u016fm \u2013 s mo\u017enost\u00ed m\u00edt dv\u011b sestavy stejn\u00e9ho nem\u011bnn\u00e9ho obrazu? <\/li>\n<li> M\u00e1me \u010dekat na dal\u0161\u00ed aktualizaci, ne\u017e spust\u00edme sestavu?<\/li>\n<li> Co p\u0159esn\u011b se pokazilo? Kter\u00e9 kroky je t\u0159eba zopakovat (a kter\u00e9 je bezpe\u010dn\u00e9 zopakovat)?<\/li>\n<\/ul>\n<p>\n<i>Organizace pracovn\u00edho postupu zalo\u017een\u00e9ho na Gitu nezaru\u010duje, \u017ee Bob\u016fv t\u00fdm nebude \u010delit t\u011bmto probl\u00e9m\u016fm. Mohou st\u00e1le ud\u011blat chybu s push\u00ed commitem, s tagem nebo jin\u00fdm parametrem; nicm\u00e9n\u011b tento p\u0159\u00edstup je p\u0159esto mnohem bl\u00ed\u017ee k explicitn\u00edmu v\u0161emu nebo ni\u010demu.<\/i><\/p>\n<p>Shrneme si, pro\u010d by CI servery nem\u011bly d\u011blat CD:<\/p>\n<ul>\n<li> Aktualiza\u010dn\u00ed skripty nejsou v\u017edy deterministick\u00e9; snadno se v nich d\u011blaj\u00ed chyby.<\/li>\n<li> CI servery se neslu\u010duj\u00ed s deklarativn\u00edm modelem clusteru.<\/li>\n<li> Je obt\u00ed\u017en\u00e9 zaru\u010dit idempotentnost. U\u017eivatel\u00e9 mus\u00ed rozum\u011bt hlubok\u00e9 semantice syst\u00e9mu.<\/li>\n<li> Je obt\u00ed\u017en\u011bj\u0161\u00ed prov\u00e1d\u011bt obnovu po \u010d\u00e1ste\u010dn\u00e9m selh\u00e1n\u00ed.<\/li>\n<\/ul>\n<p>\n<i>Pozn\u00e1mka k Helm: pokud chcete pou\u017e\u00edvat Helm, doporu\u010dujeme ho spojit s GitOps oper\u00e1torem, jako je <noindex><a rel=\"nofollow\" href=\"https:\/\/www.weave.works\/blog\/managing-helm-releases-the-gitops-way\">Flux-Helm<\/a><\/noindex>. To pom\u016f\u017ee zajistit konvergenci. S\u00e1m o sob\u011b nen\u00ed Helm ani deterministick\u00fd, ani atom\u00e1rn\u00ed.<\/i><\/p>\n<h2>GitOps jako nejlep\u0161\u00ed zp\u016fsob pro realizaci Continuous Delivery pro Kubernetes<\/h2>\n<p>\nT\u00fdm Alice a Boba zav\u00e1d\u00ed GitOps a zji\u0161\u0165uje, \u017ee pr\u00e1ce se softwarov\u00fdmi produkty, udr\u017eov\u00e1n\u00ed vysok\u00e9ho v\u00fdkonu a stability se st\u00e1v\u00e1 mnohem jednodu\u0161\u0161\u00ed. Ukon\u010deme tento \u010dl\u00e1nek ilustracemi, kter\u00e9 ukazuj\u00ed, jak vypad\u00e1 jejich nov\u00fd p\u0159\u00edstup. Vezm\u011bte na v\u011bdom\u00ed, \u017ee se p\u0159ev\u00e1\u017en\u011b bav\u00edme o aplikac\u00edch a slu\u017eb\u00e1ch, ale GitOps lze pou\u017e\u00edt pro spr\u00e1vu cel\u00e9 platformy.<\/p>\n<h3>Model provozu pro Kubernetes<\/h3>\n<p>\nPod\u00edvejte se na n\u00e1sleduj\u00edc\u00ed diagram. Zn\u00e1zor\u0148uje Git a \u00falo\u017ei\u0161t\u011b kontejnerov\u00fdch obraz\u016f jako spole\u010dn\u00e9 zdroje pro dva orchestr\u00e1ln\u00ed \u017eivotn\u00ed cykly:<\/p>\n<ul>\n<li> Pipelines neust\u00e1l\u00e9 integrace, kter\u00e9 \u010dtou a zapisuj\u00ed soubory do Gitu a mohou aktualizovat repozit\u00e1\u0159 kontejnerov\u00fdch obraz\u016f.<\/li>\n<li> Pipelines Runtime GitOps, kter\u00e9 kombinuj\u00ed nasazen\u00ed s \u0159\u00edzen\u00edm a sledov\u00e1n\u00edm. \u010cte a zapisuje soubory do Gitu a m\u016f\u017ee stahovat kontejnerov\u00e9 obrazy.<\/li>\n<\/ul>\n<h3>Jak\u00e9 jsou hlavn\u00ed z\u00e1v\u011bry?<\/h3>\n<p><\/p>\n<ol>\n<li> <b>D\u011blen\u00ed probl\u00e9m\u016f<\/b>: V\u0161imn\u011bte si, \u017ee oba pipelines si mohou vym\u011b\u0148ovat data pouze aktualizac\u00ed Gitu nebo repozit\u00e1\u0159e obraz\u016f. Jin\u00fdmi slovy, existuje firewall mezi CI a runtime prost\u0159ed\u00edm. Naz\u00fdv\u00e1me jej \u201efirewallem nem\u011bnnosti\u201c <i>(immutability firewall)<\/i>, proto\u017ee v\u0161echny aktualizace repozit\u00e1\u0159\u016f vytv\u00e1\u0159ej\u00ed nov\u00e9 verze. Pro v\u00edce informac\u00ed k tomuto t\u00e9matu se pod\u00edvejte na slajdy 72-87 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.slideshare.net\/weaveworks\/continuous-lifecycle-london-2018-event-keynote-97418556\">t\u00e9to prezentace<\/a><\/noindex>.<\/li>\n<li> <b>Lze pou\u017e\u00edt jak\u00fdkoli CI a Git server<\/b>: GitOps funguje s jak\u00fdmikoli komponenty. M\u016f\u017eete nad\u00e1le pou\u017e\u00edvat sv\u00e9 obl\u00edben\u00e9 CI a Git servery, repozit\u00e1\u0159e obraz\u016f a testovac\u00ed sady. T\u00e9m\u011b\u0159 v\u0161echny ostatn\u00ed n\u00e1stroje pro Continuous Delivery na trhu vy\u017eaduj\u00ed sv\u016fj vlastn\u00ed CI\/Git server nebo \u00falo\u017ei\u0161t\u011b obraz\u016f. To m\u016f\u017ee b\u00fdt omezuj\u00edc\u00edm faktorem v rozvoji cloud native. V p\u0159\u00edpad\u011b GitOps m\u016f\u017eete pou\u017e\u00edvat zn\u00e1m\u00e9 n\u00e1stroje.<\/li>\n<li> <b>Ud\u00e1losti jako n\u00e1stroj integrace<\/b>: Jakmile jsou data v Git aktualizov\u00e1na, Weave Flux (nebo Weave Cloud operator) o tom informuje runtime. Kdykoli Kubernetes p\u0159ijme sadu zm\u011bn, Git se aktualizuje. To zaji\u0161\u0165uje jednoduch\u00fd model integrace pro organizaci pracovn\u00edch tok\u016f pro GitOps, jak je uk\u00e1z\u00e1no n\u00ed\u017ee.<\/li>\n<\/ol>\n<h2>Z\u00e1v\u011br<\/h2>\n<p>\nGitOps poskytuje z\u00e1sadn\u00ed z\u00e1ruky aktualizac\u00ed, kter\u00e9 jsou nezbytn\u00e9 pro jak\u00fdkoli modern\u00ed n\u00e1stroj CI\/CD:<\/p>\n<ul>\n<li> automatizace;<\/li>\n<li> konvergence;<\/li>\n<li> idempotentnost;<\/li>\n<li> determinismus.<\/li>\n<\/ul>\n<p>\nJe to d\u016fle\u017eit\u00e9, proto\u017ee nab\u00edz\u00ed provozn\u00ed model pro v\u00fdvoj\u00e1\u0159e v oblasti cloud native.<\/p>\n<ul>\n<li> Tradi\u010dn\u00ed n\u00e1stroje pro spr\u00e1vu a monitorov\u00e1n\u00ed syst\u00e9m\u016f jsou spojeny s provozn\u00edmi t\u00fdmy, kter\u00e9 p\u016fsob\u00ed v r\u00e1mci runbooku <i>(sady rutinn\u00edch procedur a operac\u00ed \u2014 pozn. p\u0159.)<\/i>, v\u00e1zan\u00e9ho na konkr\u00e9tn\u00ed nasazen\u00ed.<\/li>\n<li> V \u0159\u00edzen\u00ed cloud native syst\u00e9m\u016f je n\u00e1stroj pro sledov\u00e1n\u00ed nejlep\u0161\u00edm zp\u016fsobem, jak vyhodnotit v\u00fdsledky nasazen\u00ed, aby na n\u011b v\u00fdvojov\u00fd t\u00fdm mohl rychle reagovat.<\/li>\n<\/ul>\n<p>\nP\u0159edstavte si celou \u0159adu klastr\u016f rozlo\u017een\u00ed po r\u016fzn\u00fdch cloudech a mno\u017estv\u00ed slu\u017eeb se sv\u00fdmi vlastn\u00edmi t\u00fdmy a pl\u00e1ny nasazen\u00ed. GitOps nab\u00edz\u00ed \u0161k\u00e1lov\u011b invariantn\u00ed model pro spr\u00e1vu cel\u00e9 t\u00e9to rozmanitosti.<\/p>\n<h2>P.S. od p\u0159ekladatele<\/h2>\n<p>\nP\u0159e\u010dt\u011bte si tak\u00e9 n\u00e1\u0161 blog:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/456754\/\">GitOps: srovn\u00e1n\u00ed metod Pull a Push<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/434160\/\">P\u0159edstavujeme knihovnu kubedog pro sledov\u00e1n\u00ed zdroj\u016f Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/449096\/\">Roz\u0161i\u0159ujeme a dopl\u0148ujeme Kubernetes (p\u0159ehled a video z p\u0159edn\u00e1\u0161ky)<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p class=\"for_users_only_msg\">Pouze registrovan\u00ed u\u017eivatel\u00e9 se mohou \u00fa\u010dastnit ankety. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/auth\/login\/\">P\u0159ihlaste se<\/a><\/noindex>, pros\u00edm.<\/p>\n<h2 class=\"default-block__polling-title\">V\u011bd\u011bli jste o GitOps p\u0159ed vznikem t\u011bchto dvou p\u0159eklad\u016f na habru?<\/h2>\n<ul class=\"content-list content-list_polling\">\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Ano, v\u0161echno jsem v\u011bd\u011bl(a)<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Jen povrchn\u011b<\/p>\n<\/li>\n<li class=\"content-list__item content-list__item_polling\">\n<p>                    Ne<\/p>\n<\/li>\n<\/ul>\n<p>    Hlasovalo 35 u\u017eivatel\u016f. 10 u\u017eivatel\u016f se zdr\u017eelo.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/458878\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u041f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430 \u043e \u043c\u0435\u0442\u043e\u0434\u0430\u0445 pull \u0438 push \u0432 GitOps \u043c\u044b \u0443\u0432\u0438\u0434\u0435\u043b\u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441 \u043a \u044d\u0442\u043e\u0439 \u043c\u043e\u0434\u0435\u043b\u0438 \u0432 \u0446\u0435\u043b\u043e\u043c, \u043e\u0434\u043d\u0430\u043a\u043e \u0440\u0443\u0441\u0441\u043a\u043e\u044f\u0437\u044b\u0447\u043d\u044b\u0445 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u043d\u0430 \u044d\u0442\u0443 \u0442\u0435\u043c\u0443 \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0441\u043e\u0432\u0441\u0435\u043c \u043c\u0430\u043b\u043e (\u043d\u0430 \u0445\u0430\u0431\u0440\u0435 \u0438\u0445 \u043f\u043e\u043f\u0440\u043e\u0441\u0442\u0443 \u043d\u0435\u0442). \u041f\u043e\u0441\u0435\u043c\u0443 \u0440\u0430\u0434\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u0442\u044c \u0432\u0430\u0448\u0435\u043c\u0443 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044e \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u2014 \u043f\u0443\u0441\u0442\u044c \u0438 \u0443\u0436\u0435 \u043f\u043e\u0447\u0442\u0438 \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438! \u2014 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Weaveworks, \u0433\u043b\u0430\u0432\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-35941","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-zhe-takoe-gitops\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u0436\u0435 \u0442\u0430\u043a\u043e\u0435 GitOps? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-zhe-takoe-gitops\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:07:41+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Co je to GitOps? | ProHoster","description":"Pozn.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-zhe-takoe-gitops","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u0436\u0435 \u0442\u0430\u043a\u043e\u0435 GitOps? | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-zhe-takoe-gitops","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:07:41+00:00","article:modified_time":"2019-10-31T19:07:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35941","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 01:21:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:53:31","updated":"2026-01-22 01:21:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=35941"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/35941\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=35941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=35941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=35941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}