cdCon+GitOpsCon 2023

Many real-world cloud-native apps are delivered together with heritage products. Teams face the challenge of supplying a complex assembly of products in a compliant way across multiple security boundaries and clouds. In this talk, we present a solution that began at SAP and re-imagines how to merge these requirements. We start with the Open Component Model (OCM), an open standard with an open-source toolkit to describe software components in a technology agnostic way. OCM maps the new onto the old. In addition to a SBoM, a Software Bill of Delivery (SBoD) like OCM can track artifacts and capture extensive metadata. Its machine-readable format serves as a single source of truth to drive automation for Day 1 and Day 2. With the help of Weaveworks, OCM integrates with Flux to create GitOps Localization. We present and demo the security, compliance, and automation benefits of OCM and GitOps Localization for air-gapped environments, end-to-end supply chain shielding, and lift and shift applications to the cloud. We will show you how to package, transport, and deploy signed, attestable, and verifiable artifacts into environments with limited or no connectivity and high-security clouds.