Fatih Degirmenci

Delivering software fast is one piece of the CI/CD puzzle, but delivering it securely is the glue that keeps your puzzle from falling apart. Software supply chain attacks are on the rise with security exploits directly targeting open source projects, central repositories, and software package managers. Now that developers are the target of security attackers, how do you protect your DevOps pipeline?

This is a problem that the Continuous Delivery Foundation (CDF) is working to solve. To help ensure a secure SDLC, the CDF is investing in projects that provide security solutions and in 2022 announced a new incubating project, Pyrsia. This talk will highlight the importance of securing your software supply chain at the source and how Pyrsia is working to solve this problem.

New technologies such as Kubernetes and methodologies such as microservices are changing how software is developed, delivered, and deployed. Additionally, bringing new products to the hands of users is happening much faster than before, making Continuous Delivery a critical aspect of doing business. The way we do business is evolving at a tremendous pace and keeping up with the technology and tooling can often put strains on companies regardless of size or number of employees. Knowing where to start is one issue but then once you’ve started how do you scale. Do you need more tools, which tools do you need, what resources do you have to help you pick the right path to keep your company running efficiently, how do you train your developers while they continue to do their day jobs? The CD Foundation was formed and incubates projects that address these challenges in an open-source, vendor-neutral manner.

Using best practices from graduated projects like Jenkins and Tekton as well as incubating projects like CDEvents and Spinnaker, the CD Foundation is working on the CD Reference Architecture to help take the guesswork out of tooling and scaling and creating a blueprint on how to establish, structure or modernise your CI/CD infrastructure. This talk will go over some examples of the CD Reference Architecture and resources available to help make CD accessible for your organisation.

The emergence of virtualization, containers, and cloud native has resulted in tremendous advances in enabling organizations to develop new services and make them available to end users. In addition, new paradigms such as Continuous Integration (CI) and Continuous Delivery (CD) allow organisations to do this much faster than before, empowering them to go to market ahead of the competition.

Despite its many advantages, the CI/CD ecosystem has its challenges. This session will discuss issues arising from the lack of interoperability across proliferating CI/CD technologies. We will look at end user case studies, including existing integration initiatives such as that between Tekton and Jenkins X. However, these initiatives are localised to the projects involved and do not address the challenges holistically. We will highlight the necessity, and greater sustainability, of a holistic approach to interoperability in the CI/CD ecosystem and invite attendees to join community efforts.

This talk will explain the tight relationship between the OpenStack and OPNFV communities, using as a base the Cross Community CI project, and the benefits that both communities get from it.

Initially the OPNFV CI was based on the consumption of stable artifacts, including stable versions of OpenStack. Developers were not able to work with master versions, causing lack of testing and delay on delivering projects.

Cross Community CI project (XCI) enabled testing based on master versions of the different upstream components (OpenStack , OpenDaylight...). This caused to significantly cut the time of development and identify bugs earlier.

In this talk we will introduce that concept, and we will also explain the tooling used to achieve it (bifrost, openstack-ansible, ansible-opendaylight), showing how a deployment goes from end to end, how to reuse this project for your own needs, and how to start integrating your own project into XCI if that fits into the scope.