The State of Pipelines: Past, Present & Future – Part 1 – The CD Pipeline EP 1

Hey everyone, welcome to the CD pipeline continuously delivering software from A to Z. This is a brand new video series. We're running here on Textron TV, and we're partnering with our good friends at the CDF the CD Foundation part of the Linux Foundation to bring you this show on a regular basis where we're going to talk about relevant topics.

to folks who are interested in continuous delivery and continuously delivering software from A to Z. And that's the tagline. Let me introduce you to our very first panel.

We're very excited. I'm gonna get into the subject matter in a second, but I want to introduce you to our very first panel here today, and we're going to start off with Andrea. Fratelli and if I mispronounce Andrea, I apologize, but why don't you give them your name and you and introduce yourself?

Yeah. Hi everyone. Yeah, I am Andrea Frittoli.

I was really good. Thanks Ellen. I'm a developer Advocate at IBM and I've been working on tecton for a few years guess since 2000 18.

And yeah, I'm a maintainer of the project and part of the governance team. Thank you and Andrea, welcome next up. I want to introduce you all the lee bernick.

Lee welcome and maybe if you wouldn't mind introducing yourself to the audience. Absolutely. Yeah, thank you.

I'm Lee. I'm a maintainer of the pipelines project. I've been working on tecton for about a year now, and I'm missing yourself for engineer at Google.

Fantastic and Lee welcome and thank you for joining us and then next up we have divio. mushairi muha G And I'm sure I messed that up. I apologize give you one that you say it right introduce yourself.

Sure. Yeah, my name is Divya. Mukushi.

I'm a software engineer at Google. I have been with techton since 2019 or so. It's been about three years three years.

And so I'm maintainer of the technology project. I'm also part of the governance governing booking Andrea. So happy to be here.

Thank you and welcome for joining and thank you for doing what you do here last but not least. I want to introduce you to my co-host on this show not only on this show but on the whole series to person I've known for years already. She well, I'm gonna let her introduce herself Laurie LaRue.

So Laurie welcome introduce yourself. Thank you, Alan and thank you for letting the CDF be a part of your text wrong TV series. We're very excited to be launching the CD Pipeline with you.

So my name is Lori Lorusso. I am the open source program manager at jfrog and the mark marketing Outreach chair at CDF. So super excited to be talking about our projects and continuous delivery with you and the audience.

Fantastic, and I'm so can tell you happy. I have to have you on board with me Lori. This is kind of really cool.

We work together, you know at various events for years and having you on here is great and thank you for what you're doing with CDF, you know for just not a commercial but a quick note CD Foundation is about I want to say two to three years old already is the Linux Foundation foundation and but recently have gone through a bit of a relaunch a bit of a rebranding a bit of a revitalization with some great corporate members and and really the strength of CDF is the projects. That have been donated and under their auspices if you will and we're going to talk about a really great project today Lori if you don't mind. You're the co-host.

Why don't you kind of lay out for our folks watching? You know what we want to talk about today? Okay.

Well as you realized by the introductions, we are talking about tech Don today and the tech town is one of the CDF projects and it is an open source framework for creating CD systems and allows developers to build tests and deploy across Cloud providers and on-prem systems. It's one of our oldest projects and we couldn't be more happy to have the panelists here that are maintainers and also governance board members to talk a little bit about the past present and where they see the future of tecton going. Absolutely.

All right. So if we're going to do the Christmas carol thing I guess we should start with the ghost of tecton path who who feels confident enough to kind. You know, let's assume someone watching this out there.

They don't know Tech time. There are cyber security person. They haven't dealt with that time.

Right. How would you how would you? Explain to them what what tecton is how you know how it came about or maybe a little bit of its history any of our panel.

Feel free to Jump Right In don't make me do it. Go ahead good. I guess I can't again get started.

I mean Yeah going back with history techton was actually born initially in the canadive ecosystem. So part of the kinetic project. So Canadian with the time at a component can build which was about taking your software and getting into a container image that you could run on kubernetes, right and that evolved then into a pipeline because well developers didn't want just to run a single Bill step, but maybe do something more sophisticated than maybe running tests before deploying your software to production and then eventually the project moved out of the canadive ecosystem to become its own project and was rename to the techton.

Yeah, and then donated to to The Continuous delivery Foundation as one of the founding projects. Um, so if folks are familiar with kubernetes and a bit kubernetes as a orchestrate orchestrator for containers and it provides a resources and apis and what techton is is kind of an extension of kubernetes for doing pipelines, right? So it gives you kubernetes resources for running pipelines on top of kubernetes that's in a nutshell a short introduction.

And yeah, so that was stacked on in the beginning single core component tecton Pipeline and yeah, I don't want to spoil the future past but I think we have grown a bit since then and I'll stop here. All right. Yeah.

It's interesting you. So obviously it's a strong Google interest. In Tech time Lee I wondered maybe you want to share with us.

here Well Chuck Thomas meant to be a platform for building ci/cb system. So it's lower level and Uh companies are able to kind of build a CI/CD platforms on top of tecton. So Google is definitely pretty heavily invested.

In fact on future. So I would like to just kind of follow up with how did you all get involved in tecton individually because there are so many open source projects out there. Like were you assigned tecton or what about tecton kind of was appealing to you?

We work on pipelines. Why don't you start? Absolutely.

I'm a previously worked on a different team at Google and a super excited just to be able to kind of work on this open source project that I shouldn't just very useful to. to Google and to the ecosystem I think there's just a lot of exciting work going on in pipelines right now. And that's kind of where I focused the majority of my time, you know thinking a lot about Storage and pipelines and and I'm working on our V1 release of the project.

I'm also going to be kind of working a bit on workflows, which is a little bit of a higher level API for getting people set up with kind of all the parts of the techtime ecosystem as they fit together, so including pipelines and triggering and just Yeah, nicer kind of a bit of a higher level experience. So that's what I'll be working on going forward. Very cool.

What about the rest of the panel? How did you guys get involved in Tech time? Sure, I can go so I have been involved with like continuous celebrate the ICD for like a few years.

I did that like internally those Source stuff for a few teams at Google and then after that I was working on Spinnaker, which is like another like CD Foundation project and on that is mainly focused on continuous delivery. And then that was around like the 2018 2019 time frame which is when like tecton started popping up and that seemed like a very exciting like new project. So I shifted to like working on that and some point in 2019 so still in the same place, but like I found is more, you know.

Flexible more focused on like, you know, not just deployments but the whole icicd pipeline Etc so and it was very young. So it seemed like a very interesting. Yeah.

Interesting so it but tecton and Spinnaker not. You know mutually competitive right? I I thought there were cases where you use them both.

Oh, absolutely, you know so technology, you know is it's more of like, you know, as we mentioned it started like a ground zero experience where we you know, you start with like the building blocks of the ICD. Well Spinnaker is a very well established like project that focuses more on like, you know, like business logic you need for like continuous deployments across like VMS across Cloud providers and it is absolutely possible to use, you know technical for your CI. I find for all your bills and then rely on the negative to do all your deployments.

So in fact that is actually a very pretty good pattern to follow because it has like a lot of you know good a lot of you know that's practices built in that you can utilize especially if you're doing things like, you know VM deployments like that. Absolutely. Andrea how did you get involved in Tech time?

And yeah, so right I was before working on openstack for several years. I was leading somebody QA and CIA efforts in there. So was heavily involved in.

And in the kind of testing and infrastructure side of things there and it was a very big project and we had a lot of teams and we we had to do like Ci at scale. So it was very interesting and I got to be really to like the subject. And yeah after some time.

I joined IBM and then and I was kind of looking for a new open source project to work on as open sectors becoming more mature and established and needed less resources, I guess. And tecton was yes, I was coming. It was getting born and yeah, it seemed like an interesting project for IBM as well.

And so it sounded like a perfect fit. So I started looking at it and I immediately loved the community. I mean, it was really with coming a lot of fun to work.

Um, yeah, so I stick around and here I am. actually Excellent. Hey, Laurie.

I got to turn it around on you a little bit if it's okay, you know, this is our first a lot. There's our first show a lot of people out here aren't familiar with CD Foundation CDF. We've spoken about we've mentioned tecton obviously and and we mentioned Spinnaker but and those are both CDF projects, right?

Continuous delivery Foundation projects but wait, there's more right what give our audience share like some of the projects that are part of CDF? Okay spot that we have eight projects. So we've talked about tecton.

We've talked about Spinnaker. And I'm going through to make sure I don't miss any so we have Jenkins which I think everyone knows kind of like the grandfather. It's our first graduated project.

There's screwdriver. There's ortelius. There's Jenkins X just in the process of getting ready.

And their City events and then we also have shipwrite. So those are the projects and we will be bringing on a new project soon. But back to kind of I think what Andrea was saying, I don't mean to like turn this around but it was about community and I think you know, everyone here on the panel is a maintainer and then we have two governance board members.

So can you kind of maybe share a little bit about what it's like to work with the tech talk community and you found it really fun and interesting like so I think there are a lot of people that are nervous about joining a community whether it's the CDF in general or specific open source project and I think it would be great to hear like sort of what it's been like for you and what the community is like to you. starting with whoever Lee why don't you go first Sure. Absolutely.

Yeah, um. Yeah, I've had a really positive experiences with the tecton community. This is my first job where I've actually been able to work with developers from other companies.

And yeah, I just feel like that provides a lot of really kind of valuable experience and different perspectives. We have kind of a process for growing people from new contributors to maintainers to kind of working my way up the contributor ladder was. Yeah, I think a really good learning experience.

So I think that's been very positive for me. Absolutely. It's a great way to meet people but it's also from a career path.

Right. It really helps you move along. I mean Dre you mentioned you were involved in was it open shift?

Or no, excuse me. Open stack and then moved you know, how how did how has it been for you is you know, it's part of it's part of this kind of Journey. Right.

Yeah, I guess in in the very beginning starting with openstack with yeah and with open source in general. You don't know what to expect. Because the first time you work with people from other companies and you know, you know, you need to learn how to reach out to them and how to you know build relationship with them and often it's remote.

Even you know, like many years ago. A lot of Open Source communication like in openstack case went through our AC you don't get always to meet people face to face. So yeah, it's it's a it's a learning experience, but it's very rewarding.

Um, yeah, so you you get to build like trust relationship with other people from different countries different places around the world different cultures. And yeah, it's really it's really good. It's it's demanding in a way because you know, you need to learn how to communicate with different people to make sure you know, your inclusive in your way of speaking and relating to the others and But yeah, it's really rewarding experience for me.

And when I joined tecton, I found very welcoming Community. You know, when you when you just getting started you need to learn and so you other contributors kind of guide you through the process. What is expected and what's the best for you to To grow within the community we mentioned our contribution contribute to ladder.

So you start, you know, reading the code getting to know the people and then you continue making contributions not only to the code but also to the community in general joining working groups helping others. And yeah, and then you continue growing in the community. Great great to give you you started with Spinnaker and moved over to tecton.

Andrea was on other open source projects as well Lee you seem like this is maybe one of the first projects you've really kind of, you know been heavily involved with how does how does one know when it's time to go to a different project or is it is it strictly following your heart? Right and then hearts are meant to be broken or or you know, what what makes you decide? Yeah.

That's the project. I want to jump in on. Well, you know, it's it's not a one or the other choice, you know, like you can like, you know something.

You can still be contributing to multiple projects. It may be hard to do like both at the same level of contribution. But like, you know something Andrea mentioned was like it's not just code contributions that are important like a lot of like open source communities about like contributions to like, you know tree aging issues helping answer questions from users helping other newer contributors ramp up with your knowledge that you have which is like, you know, a super rewarding part of the process of being like in the open source communities.

So there's so many ways to be involved in the community that I don't think it's one of the other choice for me personally. It just happened that way that you know, I was like finishing up my projects on Spinnaker and then Tech on seemed interesting. So I moved over to that whole time.

I was still involved with clinical for like a little bit after that like helping, you know, answer questions and all that like but you know, let's just work but in general like we at least we're trying to like, you know, try to make like tecton open to everyone not just like people who are just full-time. You know working on tecton, but you know, we try to make it easy to like in all of our working group meetings are public. They're recorded.

We try to do it try to do all of our discussions out in like open source. So people can chime in across different time zones, you know, like across different countries. So, you know, we try to make it as inclusive as we can, you know, so like people even if you have like only a little bit of time to contribute and so get involved So I think there's I'm sorry that I think there's something that you guys all touched on that I think is very interesting and awesome.

And it's right in line with the CDF and it's this ability to work across different organizations, right? We're a vendor neutral foundation and we believe in community and the way to really Advance this technology in general is if we all have this open source framework to work work towards and one of the things I kind of wanted to talk about. A supply chain security because that is something that is affecting everyone the there's been a 650% increase in supply chain security attacks in 2021 that was in the state of devops report.

I believe and I was just kind of wondering so techton has a tool called chains. And what were you what what are your thoughts on supply chain security and how is tecton working to help kind of bring that awareness to people that use the the tool and how are we trying to how are we all trying to make things safer for Developers? Sure, I can get a started on this one.

So for supply chain security, I mean, obviously that's like the big buzzword these days. You can either hear about solarwinds and all the other attacks. So, you know and like, you know changes like you can see like there's been a lot of work on going and chains.

So yeah, it's super critical that you know technology is secure by default and like, you know, we provide a way like ensure people. Then have like a secure. Build pipe not just a build pipeline the entire supply chain is secure with technetate score.

So we have been like collaborating like pretty closely with like others in this community. Like, you know, like there's been a lot of ongoing work not just in Chains, but also in pipelines to do it. So one example is like, you know, like the six store folks are pretty have this extra Community is pretty heavily involved with like chains and like to make sure you know, it works.

Well, we are also working to include things like sticky Inspire support in Tech on Pipeline so we can you know, make guarantees about like identity and like education. So there's this definitely like, you know, we have an s3c working group where we have like a list of topics that we want to go through. So there's there's a lot of like ongoing work in this area is super exciting.

And the year your baby's pipeline. So do you want to expand on that? Uh I I actually have not been very involved with this flight Gene security work.

So I think DPO gave a great overview and I don't know if anything bad there. Sorry. Okay, you don't don't feel obligated.

It's okay, Andrea. You've been exposed to chains and what's going on here with softly so forth supply chain. And yeah, I think I mean Divya gave a great introduction to what we are doing and I think there are two two aspects and one is to we want to provide features for techno users to be able to make their supply chain or their builds secure so that they can build from you know, they can create pipelines that are secure but and that's one aspect.

The other aspect is the build system itself, which is techno needs to be secure so I can there kind of two two directions that you're working on and one is making tecton secure and things that we've done there. I mean we have done like a security audit with a third party. This was sponsored by The Continuous delivery foundation.

And I think it was a very good learning experience for us. I mean it went I would say well in the sense that we didn't find many issues and the ones the the few ones that we were found. We addressed them the most critical ones.

So we have a report published recently with their continues delivery Foundation blog about this. and also we we introduced more some more testing to make sure that we know continuously verify that. We are working as dbset with.

Six store so we have we use chains for building tecton itself. So we use tag them to build techton has changed along it along with it. And so what chains provide there is basically the ability to sign our container images.

So techton is distributed in the form of container images and those container images are signed. By sixth or through chains. So now I'm going around in words.

I would like I'm engineer. I would like to have a diagram and you know show arrows and things but Well, we'll work on it for the next episode of but you know what I find fascinating guys. So I I come from the cyber world.

I've been in security. It wasn't called cyber security, but I've been in security 25 years. It does that some level it does my heart good to hear.

How security is becoming very important? In a project such as tecton, right because security is becoming important in everything we're doing and it has to be going forward. Unfortunately, I also know from my experience in the world of tech that that's not always the it wasn't always the case.

Right when tacton maybe was originally kind of envisioned and started, you know catching on security may not have been. Paramount, right the most important. Well one of the top three important things So my question then to all three of you and to Lori as well.

Feel free is okay. So today's important what's important tomorrow? Right.

What else are we right as we look at the future of tecton? Where do you think we need to be making some bets? Where do you think we need to, you know kind of dive in and feel free any feel free anybody jump in and we can go from there.

You must have some thoughts. Andrea you're shy, but I'm gonna pull it out of you. What do you think?

right, um the future of Dayton well I think today techton is. Especially successful in like larger companies Enterprise because or companies at least that they have a platform team. Because it's basically your Legos for building your ci/cd system.

Right? So it's it's very powerful very flexible, but it requires some engineering on top, you know to make it like usable. And so one of the things one of the project that was mentioned already.

I think by Lee and has workflows and that's one interesting project. It kind of gives you more. and abstraction on top or like then and over a layer on top that brings a lot of pieces of tecton together and gives a bit more opinionated View.

And so the idea is that if you if you're a small project and you want to run CI system and you want to start using tecton, you shouldn't have spent like mounts building years system. You should just take on and start using it. And so that's that's an interesting direction for the future.

I guess something that we've been already looking at. But that's I think continues to be very interesting for the future and very important for the future is interoperability. Um, so I mean tecton is not Denial in the world.

So I mean a lot of people use a spectrum and other tools, it uses spinacher and it uses Jenkins and what's if you're in your organization you use a combination of tools and then you need to You know know what's going on with a different tools. So I think it's important to for them to be interoperable to have some common way of. Presenting what they're doing to some way to communicate with each other if you want to start something on technocide and hand off to spinacher.

So I think interoperability is very important and it's I know it's something that it's the heart of CDF as well in the heart of CDF as well. So I see that as a very important future for topic for the future Excellent. Thank you.

panel members any anything to add or Yeah, sorry, go ahead to be. Okay. Sure.

So I was just gonna call it interoperability too. It's like a big thing not just across the CDF thing. But like, you know, one of technical has been to You have like you usable set of like things that you like, you know best practices in a catalog that can be reused across, you know, your pipelines Etc.

So, you know, we just started working with like artifact Club to like have like one single Hub where you can like have all your like tasks and pipelines, you know, like maybe all your secure tasks and trusted tasks and pipelines in one place. You can just like get it from there are and so that's one big thing fitting into like other CD projects is obviously another big one and the supply chain security work is you know, we are only like at the very beginning like that. So like there is a lot quite a bit to go there in terms of like how do we make like not just technically with everything secure.

So, yeah. actually I think yeah, it's just gonna agree with with what Andrea said about kind of making it easier for people to put the tecton building blocks together. So we've done a really great job so far of making the project really flexible and kind of allowing people to express really a whole bunch of different pipelines and workflows, and I think we just want to make it easier for you know the large number of times where people kind of want to do some very Common workflows, you know make it easier to kind of get set up to to.

repo with some triggers some just easier configuration for events and connecting that to pipelines and easy way and so, you know, I think for me kind of workflows will be the at least the future of my work contact on in the medium term. Yeah. Gloria I'm wondering do you have other topics you want to touch on?

The only thing I kind of wanted to just ask the panel is if I am looking to get involved in a project what part of techton are you guys looking for for contributors? Or you know, how do you how do you get started? Like if I workflows is something that's very interesting to me.

Like how do you get started with tecton? I think it's kind of what I was wondering like, this is your this is your product pitch. This is your opportunity to really like try and get the community a little bit more engaged where maybe you need some holes so filled so what would what would you all be looking for?

Well, I mean we have many Communication channel out and I would say jump on our slack. We have a slack and if you go to techton City Community slash Community, then you find out how to join your slack and how to find yeah to to get all the different channels. If synchronous communication is not for you.

I mean we have other options we have distribution lists also in the community repo you can find them or just go on GitHub and we have issues there you can create issues that can discuss on the issues. But yeah, don't be shy. I mean if we have we have working groups that you can join so we have a public calendar again in the community repo you can find all the details for how to reach out to us.

But yeah, don't be afraid we are friendly bunch. And so and there are really yeah. No, we don't bite and there are so many areas where we can get contributions.

I mean and many different languages. I mean tecton a lot of techton is really didn't go but we also like a dashboard where you can use, you know, like JavaScript we have small bits here and there in python as well. We really welcome like editors for always getting out of documentation better or writing new tutorials.

People again helping out and you know running the the working groups answering our users and techtons. So there is a lot of different kind of work that can be done. And so you can start from really tiny things get to know the people and then and then grow there.

excellent Lee W, I need you know, I think Lori I want to paraphrase what your question which is hey for people watching out here we're saying I'd like to get involved. All right, you know and I may want to get involved. What's the best advice you can give them?

Right. How do you get started? I mean you Lee you mentioned it earlier, right?

You work your way up, but I'm talking with someone who doesn't even have their foot in the door yet. What do you what do you do? How did they what did they do?

Yeah, actually I just get started by by using tecton and figuring out like what are the parts that are confusing? What are the parts that Could use some improvement reaching out to us on on our select channels filing issues. You know helping with improving our docs or renting tutorials are all like really great places for new contributors to get started.

I'll add as well as the CLI team is looking for contributions. So that's another great place for for new contributors. I'd say if tecton's like any of the other open source projects I've been involved in over.

A really long time there is no lack of things that need another hand, right? There's always there's always work to be done that we because even in a sponsored organization like the CDF and the Linux Foundation it relies on volunteers. And and so there's no one that I'm talking to people watching this out there now yet these three folks.

You see here. It's nothing in particularly special about them. They're great people.

But you know, what is special about them? They made they made a commitment to volunteer and help. And you know, it's not necessarily for personal Glory it certainly not for the money, but they even Laurie doing this on the board there these are volunteers and and these organizations run on volunteers.

So if you have some time to spare or you you find this really kind of you know tecton and the whole CDF or the whole, you know, CI/CD thing fascinating. Get involved. It's a great way to meet people as well.

speaking of meeting people and getting involved You know, you're watching this. It's October 11th later this month kubecon and CDF con is being Held up in Detroit and along with that I believe is a CD F event, Lori or CDF will be there. Yes.

So on October 25th, we have the CD Summit. So we're really excited about that. I believe the agenda is about to be released or well if it's October 11th, it's already out there.

So that's great. And so if you go to the cubecon website and then you check co-located events and you scroll down you'll see the continuous delivery Summit where we'll have an entire day full of sessions. I will be co-hosting with the GM fatty.

So that'll be cool. We're going to be announcing a new project. It was it's going through the process right now.

So we're really excited about that. In addition. We'll have project maintainers.

There's going to be a maintainer panel, which is really cool and it's a good opportunity to be able to kind of work with the people on the low level that are doing the projects. I'm not sure if anyone here will be there in addition to me, but I think it's a great. Opportunity to learn more about what continuous delivery is how it impacts your business how it impacts the community.

As well as just like we're talking today the past present and the future like what started as a tool to help people deliver fast is now transitioning into all of these amazing things with workflows and delivering fast and delivering securely and making sure that there's interoperability and that there's events and that you can work with other tools. So I think you know tecton is a great example of how one project can work with multiple projects that are not only within the CDF but within other organizations like Sig store, which is an open ssf. And so again, I think this idea of community and working together is what the CDF is all about cross collaboration regardless of the company that you work for collaboration on multiple levels to your point, whether it's helping update docs creating demos or just using the tool and creating issues and seeing what's working.

And what's not working. I think everybody on the panel today has a great experience with tecton and open source and have good stories to tell so if you're not a part of their slack Channel yet, I think you should become a part of it and maybe ask them questions so that you can kind of get there inside of you of what it's like to work on an open source project. Let me ask a stupid question.

How does one join the slack channel for Tech time? Where do they go? anybody See, they're all looking right now God.

No, there is a oh good debut. Yeah, I was gonna say if you go to technology on CD slash Community. We have links to join our slack our shared calendar all are working groups.

Basically everything you need our mailing lists, basically everything you need to get involved. That's what we're looking for. Okay.

Thank you Divya. Hey, we're about out of time on our first show. I will be at a cubecon CD con and everything as well.

We'll be doing actually we're broadcasting live from Detroit next Cloud later this month. So if you there come by and join come by say hello and then next month. We'll be back with another show.

Highlighting another project in in the CDF. I'm looking forward to it. I want to thank all three of our panel members, you know, look this is not what you signed up for when you're right who signs up to be a maintainer or a board member of an open source project.

Oh and by the way, you guys do some video, you know, so I want to thank you all for coming in here and putting yourself out there with it Lori. I wanted to leave you with the last word if you can bring it home. Thank you.

I think if you are looking forward or looking to learn more about the CDF in general, if you go to CDOT Foundation, you can find out about all of the projects that we have and to everyone's point. There are mailing lists calendars list serves that you can be a part of go talk to your company. You might be a member already of the Linux Foundation or CDF and see what's out there we have training we have tools and as you seen today, we have an awesome community of contributors maintainers governance members that are here and they want to help you get involved in open source.

Alright everyone. Thank you. Hopefully we'll see you in Detroit.

If not, we'll see you on the next CD pipeline. This is Alan Shimel for Textron Lori lewiso for the CDF. Have a great day.