A Case Study on Runtime Verification of a Continuous Deployment Process

TL;DR

This paper presents a case study on applying runtime verification to a continuous deployment process using FluxCD, highlighting detection delays and the effectiveness of real-time monitoring tools.

Contribution

It demonstrates the practical application of runtime monitoring in a FluxCD-based deployment pipeline and evaluates its timeliness and performance.

Findings

FluxCD sometimes delays detection of new images beyond five minutes.

SyMon provides near-real-time monitoring capabilities.

Detection time varies between five and ten minutes in the studied setup.

Abstract

We report our experience in applying runtime monitoring to a FluxCD-based continuous deployment (CD) process. Our target system consists of GitHub Actions, GitHub Container Registry (GHCR), FluxCD, and an application running on Kubernetes. We monitored its logs using SyMon. In our setting, we regard a deployment update as detected when FluxCD's polling log resolves the latest image tag. Through the case study, we found that FluxCD did not always detect a new image within five minutes after it was pushed to GHCR, whereas it always did so within ten minutes in the collected logs. Moreover, our results show that SyMon is fast enough for near-real-time monitoring in our setting.