# Blog: CNCF Talk: Increased security and scalability with OCI

DevFeed: [Blog: CNCF Talk: Increased security and scalability with OCI](<https://devfeed.tech/articles/blog-cncf-talk-increased-security-and-scalability-with-oci-48618.md>)

Original publisher: [Read original article](<https://fluxcd.io/blog/2022/10/cncf-talk-flux-oci/>)

Author: Dholbach

Published: 2022-10-26T13:20:00Z

Content type: article

Language: en

Sources: [Flux - Blog](<https://devfeed.tech/sources/flux-blog.md>)

Topics: [Scalability](<https://devfeed.tech/topics/scalability.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitOps](<https://devfeed.tech/topics/gitops.md>), [flux](<https://devfeed.tech/topics/flux.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [IAM](<https://devfeed.tech/topics/iam.md>), [Helm charts](<https://devfeed.tech/topics/helm-charts.md>), [Terraform](<https://devfeed.tech/topics/terraform.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [cncf](<https://devfeed.tech/tags/cncf.md>), [code](<https://devfeed.tech/tags/code.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-containers](<https://devfeed.tech/tags/docker-containers.md>), [gitops](<https://devfeed.tech/tags/gitops.md>), [helm](<https://devfeed.tech/tags/helm.md>), [helm-charts](<https://devfeed.tech/tags/helm-charts.md>), [iam](<https://devfeed.tech/tags/iam.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux-foundation](<https://devfeed.tech/tags/linux-foundation.md>), [oci](<https://devfeed.tech/tags/oci.md>), [scalability](<https://devfeed.tech/tags/scalability.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

This article summarizes Flux's integration of Open Containers Initiative (OCI) artifacts across recent releases and discusses a CNCF talk with a practical demonstration. It explains how OCI supports Helm repositories, Kubernetes manifests, Kustomize overlays, Terraform code, artifact signing with cosign, scalable application delivery, and infrastructure access through Kubernetes workload identity and IAM.

## Source excerpt

Integrating OCI into Flux was one of the most-requested features of all times. We listened to your feedback and in the past couple of releases, OCI was integrated more deeply into Flux. Here is a brief summary of what landed when: v0.31 (Jun 2022): Support for Helm repositories of type OCI v0.32 (Aug 2022): Kubernetes manifests, Kustomize overlays and Terraform code as OCI artifacts v0.33 (Aug 2022): More configurability of OCI settings v0.34 (Sep 2022): More flexibility when interacting with OCI artifacts/repositories v0.35 (Sep 2022): verify OCI artifacts signed by cosign v0.36 (Oct 2022): verify OCI helm charts signed by cosign plus lots of new tooling to interact with OCI using the Flux CLI To bring you up to speed with what's possible, Max Jonas Werner, Flux Core Maintainer and Senior Software Engineer at Weaveworks, gave a talk in the CNCF Online Programme series to give some background and do a practical demo. First off, Max explained the core GitOps concepts and gave an overview of the architecture of Flux. In the next step, he dived into how Docker and others created the Open Containers Initiative (OCI) which is a part of the Linux Foundation. One of the key points Max is making is that we went through a transformation from Docker containers to generic application and configuration containers. More and more OCI is becoming an application delivery format. OCI registries (which implement the distribution spec) are a commodity in the cloud space. This means that it's very easy to get enhanced scalability this way, because pulling an OCI image is much less resource-intensive compared to a full or shallow Git clone. Additionally, high available registries are available everywhere. It also provides many ways to secure your infrastructure. Flux leverages Kubernetes workload identity and IAM when pulling OCI artifacts from managed registries. So no more key management, no more SSH keys to generate, no more proprietary API usage for token generation. You use the sam