RFC: Low effort GitOps on StackGuardian Platform

[Akshat0694]

1. Introduction

1.1 Background

As the StackGuardian platform evolves and the user's Infrastructure as Code (IaC) footprint grows, the need for low-effort, consistent, and automated deployment processes becomes more critical. GitOps, a paradigm that uses Git as the single source of truth for declarative infrastructure and applications, offers a promising solution but comes with a complicated setup. This RFC proposes the introduction of a GitOps-based system that leverages a StackGuardian manifest file to define and run Workflows and stacks based on version-controlled input, stored in the user's Git repositories alongside their IaC configurations. Alternatively, templates can be created on the StackGuardian platform for self-service use cases.

1.2 Objective

The goal of this RFC is to outline a system that leverages GitOps concepts and allows users to define Workflows and stacks in a manifest file, with provisions for automatically triggering these Workflows/Stacks based on changes or specific triggers originating from a Git repository. This system aims to enhance automation, consistency, and reduce GitOps complexity in our deployment processes, allowing users to utilize the StackGuardian Platform without needing to pre-configure its native constructs like Workflows, Stacks, or Templates.

2. Proposal

2.1 Overview

The proposed system will introduce the StackGuardian manifest file, where users can define their Workflows, Stacks, or Templates. These Workflows will be executed in StackGuardian using the inputs specified in the manifest file.

2.2 Manifest File Structure

The manifest file will be a YAML file that users commit to their repositories. The structure of this manifest will be closely related to the HTTP JSON API definition of a Workflow or Stack and will also be compatible with sg-cli. If left empty, a default Workflow, Stack, or Template configuration will be assumed.

2.3 Execution Logic

The system will interpret the manifest file and execute the defined flow accordingly:

• Monitoring: Repositories containing manifest files will be continuously monitored, and any changes will automatically trigger a Workflow/Stack in StackGuardian and/or create them if necessary, along with the workflow groups defined in the manifest file. This also applies to template revisions.
• Triggering: Workflows/Stacks/Template creation can be initiated by events in the Git repository, such as commits, merge requests, pushes, manual triggers, or using sg-cli.

3. Benefits

3.1 Benefits

• Low Effort Onboarding: It will be easier to start leveraging the SG platform capabilities without needing to set up Workflows and Stacks in advance on the platform to practice GitOps.
• Declarative Workflows/Stacks: Define and version control Workflows and Stacks definitions.
• Terraform on Auto-Pilot: Configure production-grade CI/CD for Terraform workloads in no time.
• Familiar Developer Experience: Use a single manifest in the Git repository to control workflow and stack deployments.
• Automation: The system will automate the deployment process, reducing manual intervention and errors.
• Consistency: By using a declarative manifest file, deployments will be consistent across environments.

4. Use Cases

4.1 Automated Testing and Validation

• Scenario: Before applying changes to the production environment, a team wants to validate their Terraform configurations by running automated tests.
• Monitoring: StackGuardian monitors commits to the Terraform configuration files in a feature branch.
• Triggering: A Workflow is triggered to run a series of tests, including syntax checks (terraform validate), security scans, and integration tests. If the tests pass, a merge request can be approved to trigger deployment to production.
• Benefits:
  • Ensures that only validated and tested configurations are applied, reducing the risk of introducing errors or security vulnerabilities.
  • Facilitates continuous integration by automating the testing and validation process before deployment.

4.2 Environment Management

• Scenario: Multiple environments (e.g., development, staging, production) are defined in different branches of a repository. Each environment has its own Terraform configuration and manifest file.
• Monitoring: StackGuardian monitors each branch for changes to the manifest file or Terraform configurations.
• Triggering: When changes are merged into a specific branch (e.g., staging), a Workflow is triggered to apply the Terraform configurations to the corresponding environment. This includes running terraform plan and terraform apply specific to that environment.
• Benefits:
  • Streamlines environment-specific deployments, ensuring consistency across all environments.
  • Supports controlled and gradual rollouts of infrastructure changes from development to production.

5. Conclusion

The proposed low-effort GitOps Workflow system will significantly enhance our platform’s deployment processes by providing automation, consistency, and scalability. By adopting a manifest-based approach, we align our Workflow management with modern best practices, ensuring that our platform remains competitive and efficient.

Feedback on this RFC is encouraged, and collaboration is welcome to refine the proposal.

[Akshat0694]

Other benefits also include:

• State management with SG
• Auto Drift detection
• Approvals processes in between workflow runs
• Best Practice enforcement