Author: David Geer

  • Top 3 Must-Haves in Development/IT Operations Project Handoffs, Part Two

    Top 3 Must-Haves in Development/IT Operations Project Handoffs, Part Two

    As you may recall, in part one we uncovered 1.5 of the top three must-haves in development/IT operations project handoffs. We now know that operations really needs to know what the normal and abnormal operating conditions are for any software that development produces. We know that development needs to share the accumulated technical debt for that software as well. And we had just begun to understand the role that Big-O Notation plays. If you have not read part one, you may want to do that first. Now here we go with part two.

    Here is an example of O(n). Given the goal of computing the sum of all elements in an integer array, for example, the algorithm would work like this: start with the first element, add the second, add the third, etc. In Big O Notation, this is O(n), which is linear, i.e. adding one element means executing an additional step in the algorithm.

    Here is an example of O(log n). Given the goal of finding a particular value in a sorted array of integers, the binary search algorithm would work like this:

    1. Find the middle element and check to see whether it is the value you are looking for. If it is, return it.
    2. If the middle element is bigger than the searched value, continue with step 1 over the first half of the array.
    3. If the middle element is smaller than the searched value, continue with step 1 over the second half of the array.

    In Big O notation, this is O(log n), which represents logarithmic complexity, i.e. adding one element will (usually) not increase the number of steps, but adding K elements will add one step.

    There are many types of algorithms that fall in different groups of Big O notations. The general rule of thumb is:

    O(log n) < O(n) < O(n log n) < O(n^2) < O(n^3)

    So, if for example operations knows that the algorithmic performance of a software component is O(n) (expected linear performance), but it behaves like O(n^2) (quadratic, i.e. adding one element exponentially increases the operations needed for processing) they will realize that there is something wrong from an operational perspective.

    “I would like to have that information because it helps me do capacity planning, it helps me understand dependencies and intricacies, it helps me do my job in an optimal way (no need to get that expensive 10G network controller if our current implementation is unable to hit 1Gbps),” says Vachkov.

    Number Three Must-Have: The Architectural Diagrams for the Overall System and Its Components

    “This is somewhat understood and followed. However, the diagrams and documentation are not usually comprehensive enough, if at all comprehensive,” says Vachkov. Many operations people have a deep understanding of the software development lifecycle. They need to know the inner-workings of software components to properly design reaction procedures, dependency checks or checklists, and run-books.

    Here are some examples. In many environments, operations personnel will develop their internal procedures in the form:

    If you see A -> do X
    If you see A, but B -> do Y

    This applies to reaction procedures, scripts, and runbooks, according to Vachkov.

    Dependency lists are a bit more complex, sometimes called checklists. These have the form:

    if you need to do A then:
    -> check if AA
    -> check if BB
    -> check if CC
    -> do X

    “These can be complex and cover different areas, from installation of software components to deployments of new tenants in multi-tenant systems to troubleshooting and post-mortem analysis,” says Vachkov.

    “When this kind of information is lacking, the software is a black box. Being a black box is bad for operations. I need to know that the software expects to find a MySQL server on the same host (because it only uses a UNIX socket to communicate with it) and I should not need to figure this out on launch day,” says Vachkov.

    Extra Pointer!

    “Very big Bonus Point to all developers who keep lists of all the hidden knobs and switches that operations can use in run-time to deal with a particular failure or abnormal scenario,” says Vachkov.

  • Top 3 must-haves in Dev/Ops project handoffs, Part one

    Top 3 must-haves in Dev/Ops project handoffs, Part one

    There isn’t much that makes IT operations happier than receiving that brand new application neatly boxed, wrapped, tied with a bow, and outfitted with exhaustive instructions for every what-if, what-then, and what now scenario.

    Before you give the gift that keeps on giving in all the wrong ways, take these top three must-haves in developer to IT operations project handoffs to heart.

    Number One Must-Have: Define Normal and Abnormal Operational Conditions

    What does the development team consider normal operational parameters? At what point does the software break? How? If, giving an extreme example, at 20K users per server IT operations should expect ~50-70% CPU load but at 2K users per server they should not see 100% CPU load, they need to know this.

    “Development can outline similar behavior/symptom scenarios for infrastructure (CPU, MEM, DISK, NETWORK) and application-specific (USERS, SESSIONS, USE LATENCY, TIME BETWEEN ACTIONS) metrics,” says Ivo Vachkov, whose title is literally DevOps Engineer, Xi-Group Ltd (Bulgaria; www.xi-group.com). This is the kind of information that helps operations to recognize when a software component is in trouble.

    This may sound like obvious information for developers to include in an application handoff. “But many developers (if not most) will not be able to precisely define what is the normal operational condition for their software,” says Vachkov, lecturer in networking and programming security, New Bulgarian University (http://nbu.bg/entrance.php).

    IT operations needs to know about factors that affect normal operation including whether the software is CPU-bound, i.e., whether its performance is directly related to the processing power of the computer it runs on. Another such factor is whether the application is IO-bound, whether its performance is directly related to the throughput of the IO (MEM, DISK, NET) subsystem.

    Development should prep operations about other software behaviors and risks. If the application will degrade gracefully under increased load, they need to know that. If it will come to a screeching halt under load, they need to know that even more. If the software will crash when it slams up against an administrative/technology timeout, operations can deal with it, if they know ahead of time.

    “As operations people, we usually don’t expect too much. I would usually be happy to know that at 50k users per server the main process will crash. And this is OK, because I can work around it. I have the tools to prevent a breach of that limit. I would be happy to know that every night there is a batch processing that will hit the DB hard, instead of being awakened by an alarm about my DB being inaccessible,” says Vachkov.

    Number Two Must-Have: Share the Known/Collected Technical Debt

    In many cases the technical debt is not obvious, i.e., the documentation states that the component needs library X to work properly, but due to some particular reason, the developers used a specific version of the library that is not available in the default package repository of the OS. Someone needs to build it in manually and take additional care to keep the configuration in sync to make the code work. “Technical debt may have many faces, from bad/rigid pieces of code to bad algorithms to unspecified dependencies,” says Vachkov.

    Technical debt is also commonly omitted by the development team. “Pride, politics, other considerations are in play here. Many developers will just not keep track of technical debt. But this is crucial for proper operations. I want to know the shortcomings of the piece of code I’ll be dealing with,” says Vachkov.

    IT operations wants to know, for example, whether that key algorithm is O(n) instead of O(log n) because this will enable them to correlate metrics and explain what’s going on. These notations are part of Big-O Notation, which is used in mathematical and algorithmic analysis and generally represents a function that describes the upper limit of performance of a particular piece of code in relation to the number of input elements it needs to work with, according to Vachkov.

    Cliffhanger!

    This concludes part one of “Top 3 Must-Haves in Development/IT Operations Project Handoffs”. Tune in for part two when we take up with technical debt and Big-O Notation, learn more about why the Big-O is so important to operations and to corralling unwieldy software, and discover the third and final must-have in development/IT operations project handoffs. Don’t touch that mouse or touchscreen! Stay tuned to www.devopsy.kinsta.cloud.

  • How Change Management Serves the Developer

    How Change Management Serves the Developer

    Change management first comes to mind as a means to keep errant, untested, unapproved code from entering production. But did you know that what is good for IT operations is good for developers, too?

    Developers appreciate change management. They enjoy the change management benefits of Linus Torvald’s popular Git version control system http://git-scm.com/, which maintains successive versions of the code in question, and spawned GitHub https://github.com/ where developers share and network with their community. Perforce is another version management tool http://www.perforce.com/.

    But what are the benefits to developers from change management as taken in the former sense? How does the same change management that protects the production environment help the coder?

    Lightening Developer Workload

    Change management saves developers a lot of work. Developers benefit by focusing on the work that stakeholders agreed on when discussing and scoping the project. These are the tasks that come from their lead developer, who receives it through proper channels.

    When developers do this instead of accepting countless requests from managers for adds / changes that fall outside the scope of the project that leadership agreed on, they save themselves from potentially repeating their work to replace those unauthorized changes with the coding implementations that the team leader originally tasked them with. Developers save themselves and the customer many headaches by completing planned, authorized project items rather than the requests that undermine the corporate vision.

    “Change that is not properly managed is destabilizing. Unapproved changes send ripples through every aspect of project task assignments. The ultimate outcomes are unpredictable,” says Steve McConnell, the oft-quoted author of “Code Complete” (Microsoft Press). And by the time upper-management hears of the scope creep and project dilution, the damage is far reaching.

    Yet, even stakeholders who felt they clearly communicated what they needed will come back at a project landmark or at mid-project to say that they require some feature that the development team is not addressing. This creates scope creep and additional person-hours that are out of the development team member’s hands. Clearly, developers see enough challenges such as this without managers visiting the developer’s cubicle once the project is in full swing, seeking adjustments for their users.

    “But this duality is a specific phenomenon that I and the industry have seen. There is the official workload and then there is the unofficial plan and workload consisting of favors garnered from individual developers, which undermines the project manager, creating work that causes work to go on with the PM unaware,” says McConnell. Following change management protocols and project structure is necessary so the right hand (PM) knows what the left hand (developer) is doing.

    Avoiding the Crossfire

    “Developers get caught in the crossfire between unofficial requests and change management. The proper chain of command funnels down blame to the developer when their task X is not done. Yet that only happened because the VP of Sales came directly to the developer, saying he needed another feature,” says McConnell. Because the developer saw the VP as his superior, he felt he couldn’t say no. Suddenly, the developer has several bosses. As a result, development staff don’t get project tasks out on time. “This leads to prioritization of work that does not reflect the priorities of the organization,” says McConnell.

    When a developer remains firm, however, sending the VP to the project manager or development team leader with any new requests, that can limit some of the crossfire.

    The Joy of Completed Work

    Another benefit to the developer in following change management protocols is the satisfaction of finished work, which is possible when they are not constantly changing direction. “Developers have a high desire to complete work successfully,” says McConnell. To not have to frequently change focus and to rather get work done day-to-day and week-to-week is very fulfilling for developers. “The Holy Grail for developers is to receive clear direction throughout the course of the project,” says McConnell. Developers like their work to move in a straight line. It is frustrating to change focus so often.

    Developers are most motivated by the work itself. They are task-oriented people who enjoy the relief that comes with task completion. If the work is constantly redefined, that can be demotivating for them.

    Coming Full Circle

    “There are benefits to the developer from change management including improvements in productivity and morale. But the largest benefits accrue to the business. Change management gets things done by investing more time in moving in the right direction,” says McConnell.

  • Internet of Things (IoT) poses challenges for DevOps and security

    Internet of Things (IoT) poses challenges for DevOps and security

    One of the hottest things in tech today is the Internet of Things (IoT).  Everything will be connected including every gadget, kitchen appliance, wearable device and vehicle. But one of the biggest areas for IoT are controllers embedded into just about everything. These controllers will report back, generating reports and information that can be analyzed and acted upon.  IDC says technology and services revenues rooted in components, processes, and IT support for the IOT will reach US$7.3 trillion by 2017, up from US$4.8 trillion in 2012. When you are throwing around numbers in the trillions that is no small feat.

    New IoT implementations require projects (such as application development and backend integration, for example) that many enterprise customers don’t have the resources or custom development experience for. Vendors such as Microsoft and AT&T are responding with IoT consulting services. These vendors must be flexible to meet the needs of enterprise customers whose IoT can include machines and devices from a variety of makers. As such the bigger vendors are generally agnostic towards partnering  with otherwise competing vendors in order to pool the necessary resources to complete an IoT project.

    When management contracts a vendor / consultant for this kind of engagement, a DevOps mindset really helps to ensure the new IoT ‘glove’ fits the existing IT and information security ‘hand’. As challenges appear, a DevOps approach utilizing best practices is the best way to meet them.

    A common challenge with IoT projects is the disconnect between management desires and IT realities. IoT projects often begin because management has a goal to receive specific information. Many IoT projects involve installing controllers in business and manufacturing to retrieve data from their IoT. The controllers themselves are of course hardware. This of course is a challenge to traditional DevOps approaches. By its very nature IoT is dealing with hardware that is difficult to upgrade. Of course more and more it is the software that is driving the innovation

    “In many cases, management may hear good things from a competitive company they know who uses a specific controller device that they really like,” says Jerry Irvine, CIO, Prescient Solutions. Management may request that the vendor pull in that maker and product and that IT work with them to make it work. Unfortunately, IT will often find that the device is not compatible with the proprietary systems they use. Then the business will often ask them to find a compatible substitute and may still want it by a given deadline. This is not how anyone should acquire controllers.

    The best practice solution is for the enterprise to have an R&D team including IT set up to work in an on-going fashion to provide requirements for the IT environment and the business function. “In this way, IT and executive management can proactively and consistently look for new offerings with compatible features and functionality,” says Irvine.

    Another way DevOps can help in IoT projects is to maintain the environment in the least customized way possible. When a vendor puts in a controller, they will certainly be able to customize it to provide the specific reports and functionality that the customer wants. If the customer wants to go beyond the standard reports and capabilities however it now can pose a challenge to automation and further development.

    The issue is that when the enterprise needs to apply updates to the hardware, device software, or management application, the vendor must customize that as well, and the updates come at a hefty premium rather than standard (gratis) with the product. The best practice solution, says Irvine, is for the enterprise to take the entire report that the controller can provide standard, and customize the data from the report on the end afterwards. Customize as little as possible.

    Security is another challenge for IoT projects. The fact that these devices are connected via the Internet can make them a target for hackers. Companies deploying controllers should ask themsevles “how sensitive is the data that IoT devices and wireless communications will handle, and how dangerous can the IoT machine or device be? ” If developers/IT and operations can say with a certainty that the IoT application will never handle extremely sensitive data such as credit card numbers, and that the IoT device is not a car, dangerous machinery, or a potentially dangerous medical device, for example, then of course security is less of a concern. But part of goal of DevOps should be how do we build security organically into the device, software and process.

    John Pescatore, Director of Emerging Security Trends, the SANS Institute. IT and management says we will have to limit what IoT applications can do. If the application must use sensitive data, it has to be encrypted and the end device has to have enough processing power to do encryption or it cannot be part of this application. Likewise, for security of life and death critical applications, there is a part of the DevOps model that does not make sense. That part is the “build a little/fail a little/fix” type model of the evolution and perfection of the device. “Letting your customers find failures in MRI machines or 787 Dreamliners is not a good idea,” says Pescatore.

    So how do we reconcile the DevOps model, along with security when building components for the IoT? The challenges are there, but they can be overcome when we are talking about trillions of dollars at stake.