CNCF-hosted Co-located Events North America 2024

The Argo Project, an open-source, container-native workflow engine tailored for orchestrating parallel jobs on Kubernetes, is a highly sought-after skill as organizations increasingly adopt cloud native computing. In response to the growing demand, the CNCF has recently introduced the all-new certification, Certified Argo Project Associate (CAPA), specifically designed to validate a candidate's knowledge in the Argo Project ecosystem. In this talk, Al-Hussein shares his firsthand experience of successfully preparing for and passing the CAPA certification exam. You will get an insider's look at his preparation strategy, practical tips, and a curated selection of resources that helped him most, including official thought out documentation.

NVIDIA has embarked on an innovative journey to streamline their Kubernetes operations by leveraging the power of Python CDK, GitOps, and various cutting-edge tools. In this session, we will explore why NVIDIA chose Python CDK as their Infrastructure as Code (IaC) tool for creating EKS clusters We will examine the implementation of a GitOps mechanism for EKS Fleet Management using ArgoCD ApplicationSets, known as the GitOps-Bridge for Addons. Learn how NVIDIA is onboarding application teams through GitOps, managing Tenant/Namespace ArgoCD Projects, and utilizing Helm Charts for application delivery and centralizing application Helm Charts. The talk will cover the integration of External Secret Operator (ESO) with Vault for secrets management, and how teams are onboarded with GitOps for secure secret management. Additionally, we'll discuss NVIDIA's ongoing experiments with GitOps for AWS Infrastructure using Crossplane, and their future plans to implement Backstage.

Upstream, Argo Workflow’s CI uses Github Actions. In a true "eating our own dog food" moment, we embarked on a journey to migrate Argo Workflows CI to Argo Workflows itself on our local fork.

Our goals were:
- Boost Efficiency & Reliability: Streamline CI processes for faster development cycles.
- Fork Power: Enable quicker patch releases on our Argo Workflows fork.
- Real-World Inspiration: Provide a practical CI example for Argo Workflows users.

Dive deeper with us:
- Uncover the journey involved in migrating from GitHub Actions to Argo Workflows.
- Explore the challenges and solutions of running Kubernetes inside Kubernetes.
- Learn how we tackled various technical hurdles encountered during the migration.
- Discover the performance, cost, and reliability gains achieved through this self-hosted CI solution.

The Argo CD UI is renowned for its powerful capabilities, but granting users full-time control over applications in production environments can present significant risks. Direct mutations from the UI can disrupt GitOps practices and induce state drift, making issues difficult to debug. In this talk, we will delve into the challenges posed by Argo CD UI's powerful features and how we are addressing them to ensure safer and more compliant operations at scale. We will introduce a new Argo CD extension that enables ephemeral UI access, aimed at reducing risk, improving change management tracking, and minimizing Mean Time to Recovery (MTTR). This extension also enables integration with various compliance requirements, such as change request creation. Join us to learn how to effectively manage Argo CD UI capabilities while enhancing safety and compliance.

IT departments adopt hybrid cloud strategies to leverage the strengths of multiple public clouds like AWS, GCP, and Azure, while also maintaining private on-prem solutions to meet stringent security and regulatory compliance requirements. The challenge, however, lies in managing these diverse infrastructures consistently and efficiently. Complex hybrid environments leads to increased operational costs, security vulnerabilities, and a tangled web of provider-specific management tools that can overwhelm even the most seasoned IT teams. Support becomes fragmented, and the promise of a seamless, agile infrastructure seems out of reach. This session will explore how Argo Workflows can serve as the linchpin in a cloud-agnostic infrastructure strategy, enabling teams to manage resources across platforms and providers with unparalleled ease.

As organizations increasingly adopt GitOps and infrastructure-as-code, accurately visualizing manifest changes before they merge has become crucial. Mentally parsing Helm templates and Kustomize patches is too unreliable for catching configuration errors. Join us as we review the current landscape of tools and methods used for visualizing code changes in Argo CD, highlight their limitations, and introduce a new method that leverages ephemeral clusters and Argo CD to render accurate diffs of Helm Charts and Kustomize overlays directly on pull requests. The presentation showcases a tool illustrating this new approach and discusses its overall design. We will demonstrate how the approach can be seamlessly integrated into CI/CD pipelines to prevent deployment errors and streamline code reviews, all without access to live infrastructure. Finally, we'll conclude with an honest assessment of the method's capabilities and limitations and discuss potential areas for future development.

ArgoCD has the capability to manage more then one cluster, the question is how to securely connect to those remote clusters? This session will explore how to securely connect your remote clusters, regardless of if they're cloud managed or on-prem, using ArgoCD's own native Kubernetes identity through a token exchange to get an identity for that remote cluster. We'll start with the challenge of connecting to remote clusters securely, detail how token exchange works, then walk through updating the ArgoCD container with custom tools, creating Secrets to represent remote clusters, and ApplicationSets to generate the Application without any static tokens. The session will demo management of cloud hosted clusters, on-prem clusters, and clusters that support Kubernetes' beta of AuthenticationConfiguration in 1.30. By the end of this session you'll see where the configuration points are in ArgoCD to secure your GitOps infrastructure without relying on a single cloud provider's IAM.

Incidents caused by accidental actions can have far-reaching consequences. At Intuit, developers encountered a series of such incidents due to unintended actions performed through the Argo CD UI, including deletion of Replica Sets and Argo Rollouts. To prevent these types of unintended actions, we extended the current RBAC system to implement fine-grained policies. With this policy model, developers can now make changes with confidence, free from the fear of inadvertently impacting production systems. In this talk, we will delve into the intricacies of our journey, the strategies we employed to accomplish our goals, the future of Argo CD RBAC and what is yet to come. Join us as we explore the transformative power of fine-grained permissioning in preventing incidents and cultivating a culture of secure development.

With the right setup, you can bootstrap everything using Argo CD and good GitOps practices. With that power comes the ability to delete everything at once too! In this talk we’ll do a deep dive into how app deletion works in Argo CD and real scenarios on how teams have accidentally deleted a lot more than they planned. In the worst cases, items permanently stuck in deletion can prevent recovery. We’ll set finalizers, change deletion propagation and break the application set controller to create cascading failures and, better yet, show you how to avoid accidents. Every admin and Argo CD user should attend this talk.

In modern cloud-native environments, GitOps practitioners face a significant challenge: managing dynamically generated resource values across Infrastructure as Code (IaC) tools like Terraform and Kubernetes manifests. This disconnect often leads to manual interventions, hard-coded values, and cumbersome update processes that compromise the efficiency and security of GitOps workflows. This talk introduces the Terraform Bridge, an innovative solution to seamlessly integrate dynamically generated cloud resource attributes with Kubernetes resources. We present a novel controller that leverages Terraform's output feature to automatically update Kubernetes objects such as ConfigMaps and Deployments. This approach eliminates the need for manual updates and hard-coding of sensitive or randomly generated values, thereby enhancing both security and automation in GitOps pipelines.

As organizations increasingly adopt cloud-native technologies, ephemeral environments have become critical for testing, development, and continuous integration. These temporary environments provide advantages like increased developer productivity, isolation, and scalability, but they also present challenges.

In this session, we’ll explore the good, the bad, and the ugly of ephemeral environment practices:

• The Good: Enhancing CI/CD pipelines, improving productivity, and providing robust testing environments. 
• The Bad: Managing state, ensuring consistency, and handling resource constraints.
• The Ugly: Real-world failures and lessons learned, including using the Argo Pull Request generator and implementing ephemeral environments at scale.

We’ll demonstrate best practices for leveraging Argo CD to manage ephemeral environments, automate creation and teardown, use ApplicationSets and GitOps workflows for consistency, and integrate ephemeral environments into your deployment strategy.

For the Collibra data intelligence platform, a tenant is a combination of applications provisioned on a mixture of virtual machines and single—and multi-tenant Kubernetes services. This combination makes tenant lifecycle management non-trivial. In this session, we’ll explore using Argo Events, Workflows, and CD to build a global tenant management system. The system supports tenant lifecycle events like create, update, suspend, backup, and restore across various application types and infrastructure without exposing Argo-specific constructs to the application teams. This abstraction, called bridged workflows, allows teams to hook into the lifecycles in a simple Kubernetes native way, providing operations and developers the same simple participation in the global tenant management lifecycle. The case study will give you ideas for building a global tenant management system using the Argo suite.

Argo CD has a lot of settings and this has only proliferated in each new release of Argo CD. Some settings and values are universally useful and should always be enabled while others are only needed for very specific niche use cases. In this talk we will review many of these settings and values using the always fun and informative concept of the Tier List. Tiers for the settings/values include “Make this the default”, “Almost always useful”, “Good in places”, “Meh?” and finally “Nobody needs this”. Audience participation will be encouraged in this session with audience members helping to rank settings and values by show of hands.

ArgoCD pulls and applies resources from Git repositories, CI/CD pipelines act based on events emitted by repositories, and developers interact with and debug the resources managed by both. Unfortunately, GitOps controllers, CI/CD pipelines, and developers all have different identities and different RBAC models. How can we find harmony in these approaches and effectively manage permissions across them? We’ll show how we’re using OAuth2-Token Exchange (RFC 8693) with Dex and GitHub Teams with ArgoCD AppProjects to provide consistent permissions to repositories, people, and CI pipelines with just OIDC. We also show how we designed a just-in-time RBAC approach by programmatically managing the ArgoCD AppProjects based on the repository manifests.