devopsy.kinsta.cloud

Author: Tony Bradley

BrowserStack Offers Free Microsoft Edge Browser Testing

Testing is a major element of development. Without effective testing, you’re essentially releasing beta software and forcing your customers to be the guinea pigs in discovering any flaws or issues. But Microsoft is making it easier for developers to test how things behave and execute within the Edge browser, thanks to a new partnership with BrowserStack.

BrowserStack provides live, web-based browser testing with access to all variations of mobile and desktop browsers across all operating systems and platforms. The company claims to offer more than 1,100 desktop browser variants, including the latest versions of Internet Explorer, Edge, Chrome and Firefox on its cloud-based infrastructure.

BrowserStack is free to open source projects, but commercial use of BrowserStack generally requires a subscription. It offers plans as low as $12.50 per month for freelancers and $2,499 per month or more for larger enterprise teams. However, for the Edge browser, BrowserStack testing is now available for free, thanks to Microsoft.

“Until now, developers who need to test against a specific version of Microsoft Edge have been limited to local virtual machines, or PCs with Windows 10 installed. However, there are many developers that don’t have easy access to Microsoft Edge for testing purposes,” Microsoft wrote in a blog post announcing the partnership.

As a result, developers now can sign in to BrowserStack and test Microsoft Edge for free. Developers can test sites and apps in the cloud-based Edge browser as if it were a locally installed instance, even if they’re working from macOS, Linux or another operating system that doesn’t natively support Edge.

To enable faster, automated testing, Microsoft is also offering BrowserStack’s Automate testing service for free. Microsoft describes it in the blog post, “This method of testing allows you to run up to 10 Microsoft Edge test sessions via script, which can integrate with your local test runners via the standardized WebDriver API. You can even configure your machine so that the cloud-based browser can see your local development environment.”

Developers will have access to three versions of Microsoft Edge within BrowserStack—the two most recent stable releases, and the most recent “Preview” release (the version available in the most current Windows Insider Preview Fast ring build). Testing for Microsoft Edge on the Windows 10 Anniversary Update is available now. EdgeHTML 15 will be available in the Windows 10 Creators Update—which will start rolling out to users on April 11. That version will be available on BrowserStack shortly after release.

I hope the developers of Tweetdeck will take advantage of this service. I use Edge as my primary browser. It worked fine up until the Anniversary Update, but since then it has suffered from memory leaks, lags and crashes—but it seems to be related almost exclusively to Tweetdeck. I’ve never been sure whether the blame should be placed on Microsoft or Tweetdeck, but now that this service is being offered for free, hopefully the Tweetdeck developers can use it to identify and resolve whatever issues are causing the problem.

— Tony Bradley

April 3, 2017
Chef Report: DevOps Feeds the Need for Speed
“I feel the need … the need for speed!” ~ Maverick

According to a recent report from Chef, one of the driving motivations for companies is based on this Maverick quote from the movie “Top Gun”: The need for speed. Getting better products to market faster is a competitive advantage that gives companies an edge over rivals—and DevOps, microservices and containers provide the fuel to speed things up.

Chef conducted a survey to gain a better understanding of trends and technology adoption within the Chef customer community. A Chef blog post explains, “In the first few weeks of January we received over 1,500 responses. While that’s a small slice of our user base, we received responses from around the world, across all industry verticals. This varied sample pool allows us to get a pulse on the challenges most directly impacting the Chef community.”

In a nutshell, the Chef survey found that DevOps is having a fundamental impact on the shape and practices of IT organizations. Companies are embracing DevOps, cloud infrastructure, virtualization, microservices and containers—all in an effort to streamline development and deploy faster.

Here are a few of the highlights from the Chef report:
- The majority of teams surveyed are releasing changes to production not monthly, weekly or even daily, but on demand. Likewise, teams overwhelmingly report reducing the time it takes between an initial software commit and running code in production to mere hours from weeks and days.
- Cross-functional teams are 17 percent more likely than application teams to release changes to production on a continuous, on-demand basis. Further, cross-functional teams are 23 percent and 24 percent more likely than infrastructure and security teams, respectively, to release changes to production on demand.
- When a failure occurs in production, the majority of respondents (55 percent) are able to recover in one hour, the shortest possible recovery time in the survey. One-third of respondents (33 percent) are able to recover in the next window of four hours.
- The overwhelming majority (86 percent) of respondents have completed or are in progress of managing a project to migrate infrastructure from physical to virtual.
- Three quarters of all respondents are running cloud-based apps in a public or hybrid cloud and only 25 percent are running them purely in a private cloud.
- More than two-thirds of respondents (67 percent) are already running or plan to run containers in their infrastructure.
Chef sums up with an analysis of the survey results. The report states that building and maintaining a continuous enterprise requires teams to embrace emerging technologies to increase velocity.

Virtualization and automation drive speed. Chef also suggests, however, that teams should embrace the preferred services and tools of developers, and adopt those across other teams. The report also stresses that organizations should strive to integrate security and compliance earlier in the production cycle.

These tidbits only scratch the surface of the report. I recommend that you download the report and read it in full. The bottom line, basically, is that speed provides a competitive edge, and that technologies and practices such as DevOps, virtualization, microservices and containers enable organizations to produce better products faster.

— Tony Bradley
March 30, 2017
Atlassian Tightens Security for Bitbucket

Collaboration is part of the foundation of developing code in a DevOps environment. The ability to share code or leverage snippets from open-source projects enables developers to be more productive and efficient—creating better software, faster. Sharing code with others doesn’t necessarily mean you want it exposed to the public, though, which is why Atlassian recently introduced some new security controls for Bitbucket.

A platform like Bitbucket has a number of advantages in terms of collaboration and efficiency, but many organizations are reluctant (if not adamantly opposed) to putting potentially sensitive code out in the cloud. Atlassian added IP whitelisting and two-step verification to help organizations limit access to code. The IP whitelisting allows customers to restrict access to code to only designated IPs, while the two-step verification ensures it will take more than a simple password compromise for an unauthorized user to gain access to code.

Security policies obviously vary from company to company and industry to industry, but some organizations have a strict policy against working from home or require specific security controls or a secure VPN connection to allow users to connect. The IP whitelisting feature of the Bitbucket Premium plan gives companies the ability to designate which IPs can connect and limit access.

“For Limpid Logic customers, remote access and IP whitelisting are sometimes a legal requirement, especially for clients in highly regulated industries such as finance and health care. Our work often deals with sensitive intellectual property that requires limited geographic access to repos from a few specific IPs,” said Bachir El Khoury, managing director at Limpid Logic. “IP whitelisting is exactly what we need within our business and we’re thrilled to see this security feature in Bitbucket.”

The second new security feature is two-step verification. The problem with the traditional access control of a username and password is that it is easily compromised. Usernames often follow a simple and predictable pattern, and passwords have been shown in data breach after data breach to be a poor security control. They’re often far too easy to guess or crack, and even “strong” passwords are not invulnerable. That’s where a second layer of authentication can help.

Atlassian introduced the option for administrators to require two-step verification in Bitbucket. A Bitbucket blog post explains, “When you enable this option for your team, users will need to have two-step verification enabled in order to interact (view, push, clone, etc.) with your account’s private content: repositories, team settings, issue trackers, wikis, and snippets. If a user doesn’t have two-step verification enabled at the time of access, they’ll see instructions on how to enable two-step verification in the UI and continue.”

Both of the new security features are part of the Bitbucket Premium plan. The features are available as a free trial pending upcoming price changes. Once the changes are implemented, the cost for Bitbucket Premium will be $5 per user per month. You can sign up for Bitbucket here, and learn more about how to configure and use IP whitelisting and two-step verification here.

— Tony Bradley

March 10, 2017
Gain a Competitive Edge with DevOps
DevOps has attained mainstream status. It is no longer a cutting-edge concept that only startups and progressive companies embrace—it’s a business imperative that delivers a significant competitive edge. If you want evidence of the impact of DevOps, take a look at the 2016 State of DevOps report.

But what is it about DevOps that gives companies a strategic advantage over competitors?

“A DevOps approach enables companies to respond much more quickly to customer needs, competitive pressures and realize faster time to innovation,” says Sacha Labourey, CEO of Cloudbees. “Because DevOps is all about a culture of shared goals, and processes that accelerate software delivery through smaller, incremental releases, issued more frequently.”

However, Labourey cautions that DevOps doesn’t work to its full ability if the entire company is not on board. There needs to be strong communication and internal education within an organization to successfully implement a DevOps culture. You have to educate staff at all levels in the enterprise of the cultural and structural shift. Essentially, you have to break down barriers and get teams working together that haven’t typically worked together before. In fact, you need teams that may have been at war before, to now work together.

Struggles between teams often are driven by opposing goals and measures of success. DevOps empowers teams and individuals to work together and collaborate toward common goals more effectively. It’s a synergy that fosters cooperation rather than conflict.

Labourey says any company has the potential to transform to a DevOps culture. But there are some crucial questions organizations must answer before planning a DevOps transformation:
- Can the enterprise commit to putting the time and hard work in that is required to effect internal change and behaviors?
- Does the company environment support a DevOps culture and the values it brings with it?
- Is the executive team fully supportive, and maybe have even mandated, the change to DevOps?
“In order for DevOps to truly work, there must be a commitment to enable the change. This only happens with a lot of hard work, diligence and support from the top,” Labourey says. “Any company that needs to deliver quality software—and deliver it quickly—should care about DevOps and the supporting practice of CD.”

DevOps, and the culture of teamwork it instills in organizations, delivers significant benefits:
- A decrease in time to market—innovation is delivered rapidly. Additionally, experiments can occur, with a “fail fast” mindset.
- Internally, satisfaction with the overall software delivery process attracts and retains better IT talent.
- Employees can innovate quickly and just as quickly see the results of their innovation.
- Software is of higher quality, since releases are smaller, incrementally produced and have less impact on the overall application and infrastructure.
I know that this isn’t news to many companies and individuals, and that, to some extent, I am preaching to the proverbial choir. For those just climbing onto the DevOps bandwagon, though, or those who may have lost their way and have become frustrated with their DevOps experience, I think it’s important to remind everyone what the benefits of DevOps are supposed to be if you get it right.

— Tony Bradley
February 9, 2017
Illumio Extends Adaptive Security Platform for More Comprehensive Protection
Networks often are complex and expansive. It’s easy to think of them as a singular entity, but the array of devices that interconnect, route and segment the network can make monitoring and managing security a challenge. Illumio hopes to address that challenge and help organizations implement security that is simultaneously easier and more comprehensive with changes to its Adaptive Security Platform.

According to Illumio, the Adaptive Security Platform is being extended to enable companies to embrace network segmentation for data centers and cloud applications without sacrificing security.

“One of the biggest challenges in security is battling complexity and that’s amplified by increasing heterogeneity that we see in customer data centers and cloud environments. Legacy infrastructure combined with virtualization and cloud means there is opportunity for coordinated points of policy enforcement,” said Eric Hanselman, chief analyst of 451 Research. “We see segmentation in depth addressing a real requirement for customers who are looking to both strengthen security and simplify operations by centralizing and harmonizing policy and enforcement across different environments.”

“As segmentation becomes the core strategy for data center and cloud security, organizations are now looking at how other elements of their compute environment can be used to enforce these policies,” said PJ Kirner, chief technology officer and founder of Illumio. “Our customers have asked us to efficiently coordinate policy across their data center and cloud environments, simplifying management of the security control plane.”

Illumio shared some of the big features included in this update:
- Illumio can now program and control leading data center and cloud infrastructure—including Cisco Systems, Microsoft Azure, AWS and Arista—to deliver the most comprehensive segmentation solution in the market.
- Customers no longer need firewall chokepoints, SDN deployments or upgrade infrastructure to achieve robust segmentation-based security.
- The expansion of Illumio’s enforcement point programming gives customers a centralized and automated coordination of policy management between:
  - Hosts: Workloads (bare-metal, VM, containers)
  - Network: Cisco and Arista switches (NEW), F5 LTM & ATM
  - Public Cloud: AWS Security Groups, Azure Network Security Groups
- Customers can now write uniform security policies for hosts, the network and public cloud, improving security and reducing operational overhead.
Illumio ASP architecture

With the extension of Illumio ASP from bare-metal servers, virtual machines and containerized host to include additional security controls for the network and cloud, Illumio states that it reduces the need to manage multiple, disconnected policy models. Illumio claims that it helps eliminate security gaps generated by disparate security policies, reduces the operation overhead created by manual segmentation and stops the need for additional firewall chokepoints or SDN deployments.

“Despite the rapid increase in cybersecurity spending focused on implementing stronger security controls to limit access to sensitive data and applications—organizations of all sizes don’t always end up with more secure environments,” said Jon Oltsik, ESG’s senior principal analyst and founder of the firm’s cybersercurity service. “The ability to drive segmentation in depth throughout the data center and cloud can be a critical next step in securing data center and cloud environments.”

— Tony Bradley
February 6, 2017
3 Key Uses of a DevOps Toolchain

The ultimate goal of DevOps is to streamline development. DevOps doesn’t necessarily require tools and is not defined by its tools, but for most organizations, they play an integral role in automating tasks and ensuring processes run as efficiently as possible. When used together, a combination of DevOps tools form a DevOps toolchain, which enables teams to flow smoothly through the DevOps life cycle.

While the integration of DevOps is by no means ubiquitous, we’re witnessing its growing presence in the mainstream IT world. A plethora of tools and systems has emerged to facilitate continuous build, test, release and deploy, but constructing an effective DevOps toolchain to run efficiently can be a tricky undertaking. It often requires a good deal of experimentation and continuous refinement to ensure that critical processes and hand-offs are effectively automated.

While the specific tools and systems you utilize will depend on your organization’s unique needs, it’s helpful to keep three key uses of a DevOps toolchain in mind to guide your planning and organization. Let’s take a closer look at the primary ways that an organization can benefit from a DevOps toolchain.

1. Resolve Product Defects. The first use for a DevOps toolchain is to help resolve individual product defects more efficiently. Automation enables you to generate dependable, targeted alerts to your team about major IT incidents. This can not only improve the speed with which you resolve issues, but also help to proactively sidestep potential problems from escalating and damaging your customer experience.

2. Refine Incident Management. The second way to use your toolchain is to further refine your management of major incidents and to facilitate the rapid and automatic progression from pinpointing critical events to escalating targeted communications to the right team members and following through until the issues have been resolved. It’s especially important that communications are delivered only to the appropriate team members—mass notifications, particularly to teams of hundreds or thousands of personnel, are ineffective and don’t do anything to combat alert fatigue.

3. Innovate Faster. Finally, remember that your toolchain is meant to help you innovate faster by driving continuous build, test, release and deploy. Combining monitoring, diagnostics and continuous testing can help your organization ensure rapid delivery and follow best practices for agile development. Decentralized version control, for instance, is used by 85 percent of software organizations because it can help streamline the development process tremendously.

Which tools are best for you, and which combination of tools will work best for your DevOps toolchain, is a subjective exercise. Regardless of the tools you use, though, it’s clear that there are benefits for organizations that put together an effective DevOps toolchain that can help streamline and optimize the life cycle from beginning to end.

— Tony Bradley

February 2, 2017
DevOps is More Than Just Automation

DevOps is a lot of things. What DevOps is, what DevOps does and how an organization adopts and implements DevOps tools and practices are largely subjective, but there are some foundational elements that are fairly ubiquitous. One of which is automation. As pervasive as it is, though, DevOps is not automation and automation is not DevOps.

The Preface of “The DevOps Handbook” lists a number of prevailing myths about DevOps, including the idea that DevOps is just “infrastructure as code” or automation. The book goes on to explain:

While many of the DevOps patterns shown in this book require automation, DevOps also requires cultural norms and an architecture that allows for the shared goals to be achieved throughout the IT value stream. This goes far beyond just automation.

The book also shares an anecdotal quote from technology executive Christopher Little: “DevOps isn’t about automation, just as astronomy isn’t about telescopes.”

I prefer a golf analogy. If DevOps is the game of golf, then automation is like the putter. The game itself may be played for different reasons by different individuals—exercise, competition, just to get out and enjoy nature—but the fundamentals are the same no matter what the ultimate goal is. There is a wide variety of clubs available and strategies that can be employed to get the ball from tee to green, at which point the putter is somewhat indispensable. It is technically possible to tap the ball in using some other club, but everyone will agree that the putter is the best tool for the job. As necessary as a putter may be, though, the putter is not golf and golf is not the putter.

The important thing to remember is that automation is simply a tool or method for achieving the goal. It, like any other facet of DevOps, has to be part of a broader cultural shift and mindset.

It was about a year ago that I theorized that microservices could make the “Ops” in DevOps obsolete. If everything—infrastructure included—can be implemented in code and automated, will we still need people to be involved? The answer then—and now—is yes, because DevOps is about more than just automation. Its evolution is to one of enabler rather than job-killer. As more functions are automated, people can focus on bigger and deeper issues and create new innovations instead of focusing on mundane, repeatable tasks.

You can’t do astronomy effectively without a telescope, and you can’t play golf effectively without a putter. Similarly, you can’t effectively do DevOps without automation—but it is theoretically possible, because it is just one element of DevOps.

I can’t imagine why anyone would want to do DevOps without automation, though. It wouldn’t make any sense—like trying to look at the stars without a telescope, or sink a golf ball from 18 feet with an 8-iron. Although DevOps is more than just automation, the most effective and efficient way to succeed at DevOps is to automate everything that can be automated so you can stay focused on the big picture.

— Tony Bradley

January 12, 2017
Sauce Labs Streamlines DevOps with Sumo Logic

Log management and analysis is a crucial element of effective DevOps. In an effort to work more effectively and efficiently at the same time, gathering and analyzing feedback provides essential input that organizations can use to correct issues and enhance performance. There are a variety of log management tools out there, but Sauce Labs solved its log management and analysis challenge with Sumo Logic.

devopsy.kinsta.cloud recently had a chance to sit down with Joe Alfaro, VP of Products for Sauce Labs, to talk about the decision to go with Sumo Logic’s software-as-a-service (SaaS)-based log management solution.

Prior to making the switch to Sumo Logic, Sauce Labs was using an ELK stack for log management. Alfaro explained that the ELK stack was tedious to maintain. “Our ELK-based solution required constant care and feeding. We were always having to make sure we had enough disk space and we were always fixing bugs or adding new features. We had a small team dedicated to management of this solution. In addition, it was difficult to bring developers up to speed on the tool, since documentation was not always kept up to date and there were no training materials.”

The effort required to troubleshoot and maintain the tool itself got in the way of Sauce Labs’ ability to use the tool to debug production issues, and used precious developer resources that were needed elsewhere. Sauce Labs decided it needed a new tool—something that was very flexible and cloud-based, so the company wouldn’t need to worry about maintenance or storage.

To find this new tool, Sauce Labs did proof-of-concept testing with a handful of well-known vendors: Graylog, Loggly, Splunk and Sumo Logic. Alfaro was emphatic about the Sumo Logic experience. “Implementation was ridiculously easy. We were up and running within a day,” he said, adding, “Sumo won out as it has the combination of: ease of use, includes all of the features we wanted, is cloud-based and within our budget.”

The switch to Sumo Logic has also helped the company streamline its DevOps practices. Sumo Logic provides a communication tool between the developers and ops engineers, acting as a common language that allows DevOps teams to work together to identify the root of problems quickly and easily.

Alfaro shared that the bridge between Dev and Ops provided by Sumo Logic has led to improved service, as well as savings in both time and cost. “It also finds patterns in our logs that lead to better analysis in discovering problems. This machine-learning-like pattern discovery is invaluable to getting to the root is issues. These days we spend minutes finding problems rather that the hours or days we used to spend in the past, before Sumo. This leads to more uptime and more developer productivity.”

Of course, your mileage may vary. Graylog, Splunk and other log management and analysis tools are formidable in their own right. If you’re in the market for a new log management solution, though, Sumo Logic should be on your short list for consideration. If your results are anything like Sauce Labs’ results, it would be a crazy move not to check out Sumo Logic.

— Tony Bradley

December 22, 2016
Addressing Container Security Challenges

From month to month or even week to week, more organizations are developing with containers. The concept of containers isn’t all that new, but the dramatic rise in adoption of container technologies and the support from major tech vendors and platforms has helped containers become mainstream quickly. As with most emerging technologies, now that containers are hot there is a greater focus on some of the security issues of containers. So devopsy.kinsta.cloud worked with leading vendors to address that issue.

A new report from devopsy.kinsta.cloud, sponsored by Aqua Security and Microsoft, examines the weaknesses of containers and that the security concerns introduced by using containers, and provides a look at some of the approaches to addressing those issues. “Containers: Security Challenges and How to Address Them” contains insights from DevOps and containers experts to help you understand the challenges and how to solve them.

The report explains, “There is a general lack of awareness of existing container security concerns and best practices. Organizations need to understand the security issues that arise due to the differences in how VMs and containers function. Enterprises need to prepare for the glut of additional files that need protection with containers and the unwieldy nature of third-party libraries that containers use. Businesses also must consider configuration mistakes including those that grant root status to containers or simply make containers overly complex. Most importantly, organizations that adopt containers need to accept responsibility for security them, and should expect to keep tabs on new container vulnerabilities as the industry discovers them.”

“Containers add a layer of obscurity that reduces visibility,” warns Amir Jerbi, CTO of Aqua Security. “You have an operating system running a container engine, which in turn runs containers. The OS is not aware what containers are running—it only sees the container engine. The container engine knows what containers are running, but has no clue what the containers are actually doing. So, if you’re running a host-based security tool to monitor the OS, you will not see what containers are running and what they’re doing.”

Thankfully, there are solutions and best practices you can employ. The report describes how to use a combination of preventive measures, active detection and active response to protect container environments. It also covers some of the approaches to creating a more secure container in the first place using concepts such as isolating the containers with virtualization, as Microsoft does with Hyper-V Containers.

“What’s really important about Hyper-V Containers is that rather than trying to close existing holes, now we can implement a solution that is secure by default and already meets compliance requirements,” explains Taylor Brown, principal lead program manager at Microsoft.

You can download the free report from devopsy.kinsta.cloud by clicking here: “Containers: Security Challenges and How to Address Them.”

— Tony Bradley

December 21, 2016
Automic v12 Promises to Streamline Business Automation

Automic is in the business of automation. The company recently launched a unified suite of business automation tools called Automic v12 that promises to streamline operations even more.

I wrote about Automic about a year ago. At the time, I noted how the name Automic is a sort of double entendre that has “auto” right in the name but sounds like “atomic,” which makes it sound very dynamic and powerful. I also wrote about being confused by what exactly Automic was offering. It was dubbed “continuous everything,” even though it seemed to focus on only three areas, and I wasn’t sure what the actual name of the product or platform was.

That was then, this is now. Fast forward a year and it seems as though Automic—and its brand messaging—have both matured.

According to its mission statement, Automic strives to drive powerful outcomes for customers in today’s global economy by automating their critical business processes. In the wake of five successful acquisitions, Automic reports double-digit growth and 2,700 enterprise customers representing a variety of key industry verticals. Apparently, the business of streamlining automation is booming right now.

“Automic Release Automation (ARA) v12 is all about simplifying the steps necessary to utilize and maintain the solution to enhance the value proposition of the automation platform as a whole. The intelligent ‘Zero Downtime’ deployment and update capabilities are not simply about updating Automic agents with no downtime. They are also about removing infrastructure maintenance bottlenecks with intelligent software that can determine, for example, which agents are best updated at which time,” explains Julie Craig, research director at analyst firm Application Management Enterprise Management Associates in a press release statement. “With an enhanced REST API, customers can leverage ChatOps to use their favorite chat client to interact directly with the ARA platform while processes are in-flight, without going through a dashboard. Both of these new features are impressive differentiators which both current customers and prospects will likely appreciate.”

In my opinion, one of the most valuable aspects of Automic v12 is that it is designed to leverage the infrastructure you already have. Automic can help you implement and manage a hybrid environment and embrace DevOps principles and practices without ripping out everything you’ve got and starting over.

Beyond that, it is designed to facilitate automation, and automation is crucial for DevOps success. The new features in Automic v12 claim to remove maintenance windows, simplify management of core business apps and drive intelligent insights across your environment—connecting disparate islands of automation to enable more valuable business intelligence.

If you are looking for ways to improve automation and embrace the continuous continuousness of DevOps, you should take a look at what Automic has to offer. Automic v12 might help you streamline and manage your DevOps environment more effectively.

— Tony Bradley

October 20, 2016