How DTCC uses GitOps to accelerate customer value and security

At the recent OpenShift Commons gathering in Atlanta, we had the opportunity to hear from Brian Cook, (director, Kubernetes site reliability engineer & Kubernetes security posture management), about how Depository Trust & Clearing Corporation (DTCC) is navigating a massive shift in how they operate. As the global heart of trading activities, DTCC faces intense global regulations and a critical need for velocity without compromising security. We learned how they transitioned from a legacy environment to a "zero touch" model built entirely on GitOps principles.

Facing a tight 10-month window

One of our primary takeaways from the session was the sheer scale of the challenge DTCC overcame. When the program began, the team was tasked with moving to Red Hat OpenShift 4 within 10 months. To meet this deadline while maintaining the integrity of their massive securities processing volume, they realized they couldn't rely on traditional manual processes. Instead, they embraced a declarative, "everything is code" strategy where no engineering platform changes are allowed in any environment unless they are made through Git.

"We have laid out what we call a zero touch model. This is built around GitOps. Everything is declarative, everything is code. No one on the engineering platform side...is allowed to make any changes in any environment." — Brian Cook, DTCC 

Managing complex network policies with Red Hat Advanced Cluster Management

We were particularly impressed by the quantitative results this shift produced. By leveraging Red Hat Advanced Cluster Management for Kubernetes, DTCC can now identify and roll out complex network policies across all environments in just 2.5 weeks—a process that used to take months. Further, they have achieved greater than 99% protection against configuration drift, so every cluster remains a "golden source of truth" that can be replicated or restored in minutes.

Image 2: The GitOps velocity model for applications at DTCC

The journey at DTCC also highlights that technology is only part of the equation, as the cultural shift was equally vital. The team focused on upskilling application developers and operations staff through custom Red Hat learning paths so everyone understood how their specific responsibilities fell under the GitOps model. This collaborative approach transformed the platform team from a bottleneck into a provider of self-service capabilities, allowing developers to create namespaces or update resource requirements in about 10 minutes without waiting for manual intervention.

"You have to be able to show what the value is. You have to be able to quantify it...In the GitOps journey, we don't run into [deployment] issues. Or if we do, we have a path to minimize it." — Brian Cook, DTCC 

Ultimately, this session reminded us that the journey to GitOps is never truly finished, it is an evolving process of fine-tuning and learning from each other. By using Red Hat OpenShift GitOps and Red Hat Advanced Cluster Management, DTCC has shown that even the most highly regulated financial institutions can achieve high velocity and zero impact in production.

Start your own GitOps journey

Are you ready to increase your deployment velocity and strengthen your security posture? We encourage you to explore the resources below to learn how Red Hat can support your transition to a modern, declarative infrastructure.

• Watch the session from OpenShift Commons in Atlanta
• Learn about the platform: Red Hat OpenShift GitOps Overview 

Explore cluster management with Red Hat Advanced Cluster Management for Kubernetes