datree
argo-cd
datree | argo-cd | |
---|---|---|
34 | 72 | |
6,410 | 16,209 | |
0.1% | 1.8% | |
5.2 | 9.9 | |
12 days ago | 2 days ago | |
Go | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
datree
-
Show HN: Datree (YC W20) ā End-to-End Policy Management for Kubernetes
Hi HN, Iām Shimon, the co-founder of Datree: A policy management solution for Kubernetes. We help DevOps engineers prevent misconfigurations in their Kubernetes by enforcing an organizational policy on their clusters. Engineers can define a custom policy or use one of Datreeās built-in policies, such as NIST/NSA Hardening Guide, EKS Security Best Practices, CIS Benchmark, and more.
Our website is at https://datree.io and our GitHub is here: https://github.com/datreeio/datree
This is not the first time I have shown Datree to the HN community: A little over a year ago, I posted here an earlier version of Datree (https://news.ycombinator.com/item?id=28918850). At that time, Datree consisted of a CLI tool to detect Kubernetes misconfigurations during the development process (locally or in the CI/CD), unlike the version I present today in which the enforcement happens in production.
We built the CLI tool because we detected a big problem among Kubernetes operators: Misconfigurations. Kubernetes is extremely complex and flexible, which makes it very easy to poorly configure it in ways that are not secure. And indeed, we talked to dozens of Kubernetes operators who suffered from various problems, starting with failed audits, all the way to downtime in production, all because of misconfigurations.
Our solution was simple: Give the developers the means to shift-left security testing during the development process with a CLI tool that can be integrated into the CI/CD. We thought this was the best way to approach the problem: It is easiest to fix misconfigurations in the development process before they are deployed to production, it prevents context-switching and relieves resources from the DevOps team.
While the CLI tool was very popular among the open-source community (it got over 6000 stars on GitHub), we soon realized that CI/CD enforcement is not enough. As we talked with Datreeās users, we realized we had made a fundamental mistake: We thought of misconfiguration prevention in technical terms rather than organizational terms.
Indeed, from a technical point of view, it makes sense to shift-left Kubernetes security. But when considering the organizational structure in which it takes place, it simply isnāt enough. DevOps engineers told us that they love the shift-left concept, but they simply cannot rely on the goodwill of the engineers to run a CLI tool locally or to monitor all the pipelines leading to production. They need governance, something to help them stay in control of the state of their clusters.
Moreover, we realized that many companies who use Kubernetes are heavily regulated, and cannot take any chances with their security. Sure, these companies want the engineers to fix misconfigurations during development, but they also want something to make sure that no matter what, their clusters remain misconfiguration-free.
Based on this understanding, we developed a new version of Datree that sits on the cluster itself (rather than in the CI/CD) and protects the production environment by blocking misconfigured resources with an admission webhook. It has a centralized policy management solution to enable governance, and native monitoring to get real-time insights into the state of your Kubernetes.
I look forward to hearing your feedback and answering any questions you may have.
- Is OPA Gatekeeper the best solution for writing policies for k8s clusters?
- datreeio/datree: Prevent Kubernetes misconfigurations from reaching production (again š¤ )! Datree is a CLI tool to ensure K8s configs follow stability & security best practices as well as your organizationās policies. See our docs: https://hub.datree.io
- Question for the Argo-Verse
-
How to create a react app with Go support using WebAssembly in under 60 seconds
Go is a statically typed, compiled programming language designed at Google, it is syntactically similar to C, but with memory safety, garbage collection, structural typing, and CSP-style concurrency. In my case, I needed to run Go for JSON schema validations, in other cases, you might want to perform a CPU-intensive task or use a CLI tool written in Go.
- Techworld with Nana: Enforce K8s Best Practices with Datree
-
Gatekeeper vs Kyverno
I worked with both of them and from my experience Gatekeeper is more solid and accountable, I even wrote an article about Gatekeeper. Both Gatekeeper and Kyverno require a lot of heavy lifting work. On the one hand, Gatekeeper will probably require more configuration work however the community and the tool itself are more stable than Kyverno. On the other hand, Kyverno policy-as-code capabilities are much easier to use/understand. This way or another, for me using Kyvernoās policy language or Rego for my policies, wasnāt such a pleasant experience. I personally believe in GitOps and shifting left so if youāre looking for tools I would highly recommend you to review Datree, which is an open-source CLI (Disclaimer: Iām one of the developers at Datree). Datree is a more centralized policy management solution rather than a policy engine. Unlike Kyverno/Gatekeeper Datree was built to help DevOps teams to shift left and practice GitOps by delegating more responsibilities to the developers more efficiently. In practice, Datree already comes with built-in rules and policies along with YAML and schema validation for K8s resources and CRDs such as Argo CRDs. Datreeās policies are written in JSONScheme which is a common solid policy language supported by the community for many years. Additionally, Datreeās CLI also comes with a dashboard app where you can monitor the policies in your organization. You can modify and update your policies, review which policies are being used in practice, and control who can create/delete/update your policies. The major difference is that at the moment, unlike Kyverno/Gatekeeper Datree doesnāt provide native policy enforcement in the Kubernetes cluster at the moment but we expect to release this support very soon. At the moment, we provide a way to scan the cluster using a kubectl plugin. Feel free to check it out :)
-
Working with Datreeās Helm Plugin
$ helm plugin install https://github.com/datreeio/helm-datree Installing helm-datree... https://github.com/datreeio/datree/releases/download/1.0.6/datree-cli_1.0.6_Darwin_x86_64.zip % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 673 100 673 0 0 1439 0 --:--:-- --:--:-- --:--:-- 1469 100 6901k 100 6901k 0 0 1852k 0 0:00:03 0:00:03 --:--:-- 2865k helm-datree is installed. See https://hub.datree.io for help getting started. Installed plugin: datree
-
Adding custom rules in Datree
GitHub
- Learn from Nana, AWS Hero & CNCF Ambassador, how to enforce K8s best practices with Datree.
argo-cd
-
ArgoCD Deployment on RKE2 with Cilium Gateway API
The code above will create the argocd Kubernetes namespace and deploy the latest stable manifest. If you would like to install a specific manifest, have a look here.
-
5-Step Approach: Projectsveltos for Kubernetes add-on deployment and management onĀ RKE2
In this blog post, we will demonstrate how easy and fast it is to deploy Sveltos on an RKE2 cluster with the help of ArgoCD, register two RKE2 Cluster API (CAPI) clusters and create a ClusterProfile to deploy Prometheus and Grafana Helm charts down the managed CAPI clusters.
-
14 DevOps and SRE Tools for 2024: Your Ultimate Guide to Stay Ahead
Argo CD
-
Implementing GitOps with Argo CD, GitHub, and Azure Kubernetes Service
$version = (Invoke-RestMethod https://api.github.com/repos/argoproj/argo-cd/releases/latest).tag_name Invoke-WebRequest -Uri "https://github.com/argoproj/argo-cd/releases/download/$version/argocd-windows-amd64.exe" -OutFile "argocd.exe"
-
Verto.sh: A New Hub Connecting Beginners with Open-Source Projects
This is cool - I can think of some projects that are amazing as first contributors, and others I can think of that are terrible.
One thing I think the tool doesn't address is why someone should contribute to a particular project. Having stars is interesting, and a proxy for at least historical activity, but also kind of useless here - take argoproj/argo-cd [1] as an example - 14.5k stars, with a backlog of 2.7k issues and an issue tracker that's a real mess.
Either way, I think this tool is neat for trying to gain some experience in a project purely based on language.
[1] https://github.com/argoproj/argo-cd/issues?q=is%3Aissue+is%3...
-
Sharding the Clusters across Argo CD Application Controller Replicas
In our case, our team went ahead with Solution B, as that was the only solution present when the issue occurred. However, with the release of Argo CD 2.8.0 (released on August 7, 2023), things have changed - for the better :). Now, there are two ways to handle the sharding issue with the Argo CD Application Controller:
-
Real Time DevOps Project | Deploy to Kubernetes Using Jenkins | End to End DevOps Project | CICD
$ kubectl create namespace argocd //Next, let's apply the yaml configuration files for ArgoCd $ kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml //Now we can view the pods created in the ArgoCD namespace. $ kubectl get pods -n argocd //To interact with the API Server we need to deploy the CLI: $ curl --silent --location -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/download/v2.4.7/argocd-linux-amd64 $ chmod +x /usr/local/bin/argocd //Expose argocd-server $ kubectl patch svc argocd-server -n argocd -p '{"spec": {"type": "LoadBalancer"}}' //Wait about 2 minutes for the LoadBalancer creation $ kubectl get svc -n argocd //Get pasword and decode it. $ kubectl get secret argocd-initial-admin-secret -n argocd -o yaml $ echo WXVpLUg2LWxoWjRkSHFmSA== | base64 --decode
-
Ultimate EKS Baseline Cluster: Part 1 - Provision EKS
From here, we can explore other developments and tutorials on Kubernetes, such as o11y or observability (PLG, ELK, ELF, TICK, Jaeger, Pyroscope), service mesh (Linkerd, Istio, NSM, Consul Connect, Cillium), and progressive delivery (ArgoCD, FluxCD, Spinnaker).
-
FluxCD vs Weaveworks
lol! Wham! Third choice! https://github.com/argoproj/argo-cd
-
Helm Template Command
If you mean for each app, I don't think it's listed anywhere though you may find it in `repo-server` logs. Like so
What are some alternatives?
KubeArmor - Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (BPF-LSM, AppArmor).
drone - Gitness is an Open Source developer platform with Source Control management, Continuous Integration and Continuous Delivery. [Moved to: https://github.com/harness/gitness]
polaris - Validation of best practices in your Kubernetes clusters
flagger - Progressive delivery Kubernetes operator (Canary, A/B Testing and Blue/Green deployments)
kube-score - Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Kubernetes.
Jenkins - Jenkins automation server
polaris - Shopifyās design system to help us work together to build a great experience for all of our merchants.
terraform-controller - Use K8s to Run Terraform
reviewdog - š¶ Automated code review tool integrated with any code analysis tools regardless of programming language
werf - A solution for implementing efficient and consistent software delivery to Kubernetes facilitating best practices.
Kyverno - Kubernetes Native Policy Management
atlantis - Terraform Pull Request Automation