Category: Continuous Delivery

Continuous delivery is a software engineering discipline that allows organizations to consistently develop and release quality software at a rapid pace. It is achieved by automating the software development lifecycle, enabling tasks such as development, testing and release to occur concurrently and continuously.

  • Eclipse Foundation Launches Open Source Edge Computing Initiative

    Eclipse Foundation Launches Open Source Edge Computing Initiative

    The Eclipse Foundation in collaboration with the OpenAtom Foundation today launched the Oniro project and working group to create an independent implementation of OpenHarmony, an open source operating system.

    Created by the OpenAtom Foundation, the OpenHarmony operating system is based on a HarmonyOS originally created by Huawei. It is designed to support multiple kernels but uses the Linux kernel if a device has a large amount of memory.

    It also includes a DSoftBus capability for integrating physically separate devices into a single logical super device that enables one device to control others in addition to facilitating data sharing among distributed devices.

    Huawei, in collaboration with Linaro, Seco, Array, NOITechPark and Synesthesia, has also been contributing to a continuous integration/continuous delivery (CI/CD) platform that is part of the larger Oniro project.

    Mike Milinkovich, executive director of the Eclipse Foundation, said the goal is to provide a common layer of abstraction platform that can be employed across a wide range of embedded systems that are typically being deployed at the network edge. That level of fragmentation surrounding platforms that don’t provide a lot of significant differentiated value only results in slowing down the deployment of applications, noted Milinkovich.

    As part of that effort, a dedicated working group has been created to provide a vendor-neutral structure through which contributions to the project can be made with greater transparency. The OpenAtom Foundation was created in Beijing last year with the support of Alibaba, Baidu, Huawei, Inspur, Qihoo, Tencent and China Merchants Bank. The alliance with the Eclipse Foundation brings more traditional governance rules for building open source software to the OpenHarmony project.

    In general, DevOps teams should be tracking the development of proposed de facto standards for edge computing platforms closely. More applications are now being deployed on edge computing platforms that make it possible to process and analyze data at the point where it is being created and consumed. The DevOps challenges associated with building and deploying applications across a highly distributed computing environment are considerable.

    In many cases, organizations that never really attempted or mastered continuous delivery of applications and their associated updates will be sorely challenged when it comes times to support hundreds, possibly thousands of applications, running on embedded systems based on a wide range of processors.

    In addition, many of those same DevOps teams will start to see traditional batch-oriented applications being superseded by applications based on event-driven architectures that process data in near-real-time. In most cases, those applications are going to be built on microservices-based applications that are typically more challenging to build and deploy than a traditional monolithic application.

    Arguably, IT organizations are on the cusp of a new era of IT that assumes most organizations have not only mastered DevOps best practices but are now also embracing DevSecOps best practices to secure those application environments.

    It may be a while before the open source software that will be developed by the Orino project finds its way into production environments, but it should be apparent that reducing complexity at the network edge should be a high priority for all DevOps teams heading into 2022.

  • Managing Technical Debt is a Balancing Act

    Managing Technical Debt is a Balancing Act

    Technical debt is a nightmare for product managers. It can slow down teams and inhibit response time for delivering quality products to market. Yet, there are times when technical debt can be beneficial; but turning it from a headache to a positive is a balancing act. 

    Nimble project managers and developers should strive to develop an equilibrium that balances creating, reducing and accepting technical debt. The good news is: That’s attainable.

    The Shape of Technical Debt

    It’s essential for PMs to understand how technical debt can arise so they can identify its characteristics and manage the amount to carry or avoid to the team’s advantage.

    Laying too much brick and mortar will take software features too long to develop. It risks their rollout arriving well past due dates. But fixating on speed threatens to underdeliver on functionality. Circumstances like these will diminish the ability to deliver powerful results over time.

    Similarly, ignoring the power of third-party solutions to slot in and satisfy customer needs and speed-to-market is outdated thinking. For example, software like embedded analytics can arrive off-the-shelf to complete an architecture task quickly and affordably while freeing up the team to address other challenges. Remaining agile with all options available to the team is critical.

    Overall, the project manager’s goal should be to identify the indicators of technical debt and hone their skills to address each type.

    Building Architecture

    When a team is tasked with delivering new features or functionality, building upon the existing structure to support the new capability is not unusual. Lack of foresight or diligent planning about what’s necessary to enable this function can be a critical oversight that leads to a void in need resolution, i.e., incurring debt requiring payment.

    Speed versus Quality

    Delivering at the speed of modern business often means facing time constraints that can impact the quality of work. Faced with such limitations, teams may take shortcuts. Ultimately, those shortcuts can lead to an increase in technical debt.

    Quantity versus Speed

    On the opposite end of the spectrum, eagerly attacking a project that requires significant lead time can result in overbuilding. This leads to a different form of technical debt. Longer projects can be affected by technological change—an evolution that makes some previously completed structures outdated. Debt takes the form of teams forced to return upstream to make necessary changes when they should instead remain downstream.

    Near-Sightedness

    Unlike the oversight or overbuilding described above, if the team fails to consider future needs and focuses only on current tasks alone, it risks creating debt that arises by starting from scratch. If teams don’t anticipate the next feature or prepare for future functionality while in development, they will likely pay for this near-sightedness down the road.  

    To Build or Buy

    Developers want to build. It’s what they do. But it’s not always in the organization’s best interests. When a team faces complicated requirements, is extended beyond its capabilities or is simply well outside its repertoire, debt can be avoided by looking toward existing platforms that fulfill its needs. In such instances, a third-party solution saves significant time and money. For example, an embedded analytics tool built with the latest technologies and deployed turnkey frees the development team to remain focused on its expertise and apply its talents there. Think: Does the team need to invent a new wheel, or does one already exist? While choosing the former risks taking on debt, selecting the latter holds the promise of reducing it.

    Manageable Debt

    Still, technical debt can be a benefit. 

    Consider this example: You want to roll out a platform that delivers to the customer and market, but it’s a ground-breaking product. You don’t yet know everything you want or need to know about how end users will engage with it and what they’ll ask it to do. In situations like these, it’s reasonable to get the functional framework of the software into the hands of the market so that you can absorb reams of feedback, return to the platform and then build out or fine-tune its features and functionality. Actions like these are wise. PMs haven’t mortgaged the farm for a bag of magic beans—they’ve taken on a reasonable amount of debt to fertilize team knowledge into a product that will ultimately deliver the most value.

    Recognizing technical debt and its approach, avoiding or accepting it accordingly and then managing it with deliberate efforts to pay it down within acceptable limits is where PMs want to be. If you invest in paying it down or seek and accept third-party solutions to avoid it altogether, you’ll maintain team focus and velocity on the projects they excel in. 

  • Defining Availability, Maintainability and Reliability in SRE

    Defining Availability, Maintainability and Reliability in SRE

    In the world of reliability engineering, you’ll frequently encounter the three “-ability” words: Availability, maintainability and reliability. They sound similar and have similar meanings. In fact, these words may seem so similar that it can be tempting to use them interchangeably.

    That would be a mistake. Availability, maintainability and reliability all have distinct—if related—meanings, and they each play different roles in reliability operations.

    Definitions of Availability, Maintainability and Reliability

    Let’s start by succinctly defining each of the terms.

    Availability, Defined

    Availability is the extent to which an IT resource is ready to perform a task when requested.

    Thus, an application or server that is responding to requests is available (even if it takes longer to respond than desired or otherwise operates suboptimally, in which case it may have a reliability issue but not an availability issue).

    Availability is usually measured as a percentage. A resource that has 99% availability, for example, is one that is up and responding 99% of the time.

    Maintainability, Defined

    Maintainability is a measure of how quickly and easily a resource can be fixed when something goes wrong.

    If a buggy application release can be quickly fixed by rolling back to a stable version, the application would have a high degree of maintainability. On the other hand, if you have a server that needs to be rebuilt manually after it fails, it’s not very maintainable.

    Reliability, Defined

    Reliability is the extent to which a resource functions as required upon request (as opposed to simply being available).

    For example, if your users require an application to process each transaction within one second, and it does this 99%of the time while also maintaining a 99% availability level, that would be a relatively reliable application. In contrast, an application that responds to almost all requests but that suffers from high latency or error rates would not be very reliable, although it might be highly available.

    Differences Between Availability, Maintainability and Reliability

    The simplest way to spell out the differences between availability, maintainability and reliability is to highlight what’s unique about each concept.

    Availability

    Unlike maintainability and reliability, availability is an essentially binary metric, in the sense that a system is either available or it’s not. Although availability status can change over time, there is no such thing as varying degrees of availability.

    Availability also stands out because it is often the most important metric in defining SLAs and SLOs. Contracts typically specify that resources will achieve a certain level of availability, defined in percentage terms. They may sometimes also specify metrics like response times, which are a reflection of reliability, but availability is more likely to be the most important metric within service agreements.

    Maintainability

    Maintainability is unique in that it’s a pretty subjective concept. A system that one SRE considers easy to maintain could seem difficult to maintain to another SRE. The methodologies that engineers leverage to optimize maintainability could vary, too; for instance, someone from a DevOps background may be more likely to focus on optimizing maintainability within the software delivery chain than someone trained in classic site reliability engineering, which focuses on automating IT operations through code more than on the software delivery process.

    That said, automation tools help virtually every team maximize maintainability, no matter their preferences or background.

    Reliability

    Reliability stands out because it reflects how well a system performs. Here again, this is a somewhat subjective metric, because performance requirements may vary from one user to another. Nonetheless, reliability is the most effective means of measuring whether a system meets the performance levels it needs to, even if those requirements change over time.

    Why do availability, maintainability and reliability matter?

    Because availability, maintainability and reliability each measure different aspects of a system’s status, putting them together is a useful means of gaining insight into the overall reliability of a system.

    In order to be reliable, a system requires both availability and maintainability. A system can’t be reliable if it’s not available. It’s also unlikely to be highly reliable if it takes a long time to fix issues due to low maintainability.

    At the same time, by focusing on availability, maintainability and reliability individually, you can drill down into specific issues within the IT resources you manage. For instance, you might have systems that are high-performing when they’re available, but that have low reliability rates because of availability issues. In that case, you’ll know that an investment in increased availability is likely to yield the greatest reward for increasing overall reliability.

    The Bottom Line

    The bottom line: While availability, maintainability and reliability are all reflections of the quality of an IT resource, they measure quality in different ways. Tracking each category separately is important for ensuring that you know where your weakest links exist within overall system performance and health.

    At the same time, however, it’s important to compare and correlate availability, maintainability and reliability data so that you can achieve continuous insight into a resource’s status. When you can track each item separately but also combine them together to gain a complete picture of your system, you are in the best position to optimize reliability operations.

  • Bridging Departmental Divides for Successful Automation Projects

    Bridging Departmental Divides for Successful Automation Projects

    For too long, IT has been largely isolated from an organization’s core business. Any division between IT and lines-of-business (LOB) is even more detrimental when speed is not just a competitive advantage but an existential necessity in today’s accelerating digital economy. 

    As business leaders streamline and turbocharge every facet of their operations, savvy organizations are rushing to eliminate inefficient and damaging gaps between departments by putting more software tools in the hands of more employees. Analysts predict 80% of technology products and services will be built by those who are not technology professionals by trade by 2024. 

    This hits home amidst the booming trend toward robotic process automation (RPA), low-code/no-code and other automated solutions, which have only continued to grow as more businesses realize the vast benefits of automation: Accelerating operations while also reducing costs; elevating customer experiences and shifting employees to higher-value positions and laying the foundation for new data-driven revenue streams.

    Squandering Automation’s Advantages

    But these advantages are quickly squandered if there’s a turf battle between the business unit looking to optimize processes and the IT department responsible for deploying the tools to make that happen.

    When there isn’t collaboration and plenty of trust on both sides, automation initiatives are more prone to disappointments and delays. 

    This may happen if the IT department comes across as too smart for their own good, putting less value on feedback from their LOB colleagues and rushing to implement software with a focus on speed rather than outcomes. On the LOB side, leaders may assume their IT counterparts are too technical and don’t understand business objectives and choose to override important IT input about which vendors are best qualified when it comes to support, integration and security.

    The problem here is not the technology; hundreds of thousands of businesses across the world have successfully deployed process automation solutions. It’s the execution.

    When an automation initiative fails, there’s almost always blame to be shared on both sides of any divide. Likewise, success typically boils down to people across IT and every business department working better together to achieve a common goal. 

    To embrace a collaborative mindset and set up your automation projects for success from day one, I encourage you to follow these clear steps:

    1. Reinforce a shared mission: Whether it’s automating the customer onboarding process or deploying RPA bots to automate a repetitive, time-consuming process, communicating a shared mission is the crucial first step to pulling off a successful project. On the IT side, that involves talking with the LOB about their goals, objectives and business strategy. LOB leaders, meanwhile, can emphasize that IT is an equal business partner that has valuable insights and expertise to contribute.
    1. Establish visibility and transparency: Armed with a full understanding of business objectives, IT leaders can now evaluate tools built to give all stakeholders a full view of the processes that will be affected. By documenting and mapping out each process within an organization, leaders can better understand current processes and gain insight into areas that are ripe for standardization and automation. 
    1. Tailor solutions that match the problem: With heightened visibility across the organization, LOB and IT teams can then determine the scope of each problem and tailor solutions accordingly. Some processes can be kept and optimized; some can be tweaked with automation. Other processes may need to be reconfigured significantly before automating or shut down entirely because they are outdated or unnecessary. 

    A great example of this collaborative approach comes from Coca-Cola Beverages Florida, LLC (Coke Florida): Encumbered with a legacy process repository — a collection of PDFs, videos, pictures and spreadsheets outlining more than 600 processes — Coke Florida standardized and leveraged visual process mapping software to establish an easily accessible document repository that provides visibility and control over key processes, encourages collaboration and increases accountability. 

    Coke Florida continued an organization-wide initiative to digitize and automate its business processes with digital workflows, forms and RPA software, driving further efficiencies across its entire organization. As the company discovered firsthand, shared goals result in shared success. 

    When speed and high-quality outcomes become the norm, companies master the essential arts of urgency, resilience, visibility and collaboration. By bridging the divide between departments, organizations not only drive internal efficiencies but also gain a competitive advantage that is indispensable in today’s burgeoning digital economy. 

  • Software Design Patterns – Gary Gruver, Gruver Consulting & Dave Farley, Continuous Delivery Ltd.

    Software Design Patterns – Gary Gruver, Gruver Consulting & Dave Farley, Continuous Delivery Ltd.

    Gary Gruver has partnered with Dave Farley, co-author of “Continuous Delivery,” to supply trainees with key software design patterns and an understanding of how to avoid common mistakes along the way. This curated, wiki-style content library is based on Farley’s breadth of knowledge and decades of experience; Alan, Gary and Dave discuss. The video and a transcript of the conversation are below. 

    Intro: This is Digital anarchist.

    Alan Shimel: Hey, everyone, it’s Alan Shimel. Welcome to another TechStrong TV segment, here. I’m joined by an old friend a new friend, today, that I wanna introduce you to. Both of them are actually very well known in the dev ops world and to our dev ops audience, but let me introduce them to you. First, I wanna introduce you to Mr. Dave Farley. Hey, Dave, welcome to TechStrong TV.

    Dave Farley: Thanks. Nice to be here. 

    Alan Shimel: Pleasure to have you on. Dave, for those who may not be familiar with who you are and kind of, you know, where you are in the world, why don’t you share, if you can, a little bit of your background.

    Dave Farley: Sure. My background is as a professional software developer, for many, many years. Mostly, at probably the more difficult end of the spectrum in terms of the kinds of systems I was involved in building up. I led a team that built one of the highest performance financial exchanges in the world. But I’m probably best known for as being one of the authors of the continuous delivery book, which introduced dev ops and continuous delivery to many people. And I’ve got a new book coming out, soon, on software engineering, as well. So, I think and talk about continuous delivery, software engineering, those kinds of things. These days, I run a consultancy advising big companies on how to do this kind of stuff better.

    Alan Shimel: Fantastic, and welcome, and thank you. Next up is one of my older friends, not that he’s old, but I know him for as long as I’ve been doing DevOps.com, and that’s going on eight years now. He’s well-known dev ops author, dev ops practitioner, leader, Gary Gruver. Hey, Gary, how are you?

    Gary Gruver: I’m doing great, Alan. It’s good to see you again.

    Alan Shimel: Yup, I did my best to embarrass you, but why don’t you give people a little bit of your background.

    Gary Gruver: [Laughs] Well, you said I’m old, and I am kinda old, and I’ve been in this space for a while, and I’m not any smarter than anybody else, I just think I’ve been making mistakes in this space longer than anybody else. So, you know, probably where you hear the most about me is the transformation that led at HP, where we got a 2x to 3x improvement productivity leading a group of 800 developers around the world. And where Dave comes into this starting at the keyboard and working his way up, I start at the leadership level and working my way down towards the keyboard, but never quite on the keyboard type of thing. And, you know, really started doing things that later became dev ops, not to do dev ops or not to do CD. We were just trying to make the organization more productive and figure out what worked. So, years of trying to figure out how to help people realize the types of benefits that we got at HP with that type of transformation.

    Alan Shimel: Sure. And then, I mean, not to be your agent here, but from HP, you also went to macys.com and helped build that out from a dev ops perspective, and you’ve written several books around your experiences at HP and Macy’s and others, on leading the transformation and, you know, making the transformation. And I should note that that was before Covid, B.C., right, it was B.C., and before digital transformation became the buzzword that it has, you know, since Covid.

    Anyway, gentlemen, welcome, both of you, here. You guys have an announcement, some news we’re gonna break. Which one of you wants to go first?

    Gary Gruver: Well, let me give it a try, since I kind of started this.

    Alan Shimel: Okay.

    Gary Gruver: You know, [crosstalk] all of my time, whether it’s books or webinars or keynotes or whatever, I’ve been trying to help as many people as I can on this journey, because of the benefits that we realized. And, you know, I came up – what I realized is people weren’t making the progress that I felt like they needed to be. And what I realized is, I started looking at other industries, whether it was the manufacturing industry or organizational change management. One of the things that was out there was I realized that, in the 1980s, the automobile companies in the US started getting attacked by Japan and really losing out on quality, and they came to the conclusion that, you know, we really needed to copy what Toyota was doing. And they spent years doing that, and it didn’t work, which feels a lot similar to what we’re doing in software. We’re going and looking at the people who are doing it well and trying to copy what they did.

    Eventually, manufacturing realized the key to success was not copying, but coming up with a systematic approach to continuous improvement. So I’ve been really focused on that, and trying to do it in a way that overcomes the resistance to change, and coming up with a systematic approach and getting people excited about it. And then once people get excited about it, we really want’em to be able to be successful implementing these changes. A lot of them are new, and I’m looking for somebody that understands more, at the technology level, how to make all this stuff happen. And I ran across Dave and started reaching out to him, and what we realized is we started in different times and different places, but we ended up in a similar place, because they were the things that worked.

    And so, we’ve come together to create a training program to help people, and we’re both at a similar point in our career where we wanna help as many people as we can, and we continued to do that through traditional engagements. But we realized if we digitized this content and made it accessible to everybody, we could help more people and it would be more affordable for them, if they could learn how to do it for themselves instead of needing the hands-on engagement.

    Alan Shimel: Very cool, very cool. Dave, you wanna kind of fill in some of the gaps, here, or a little color to this?

    Dave Farley: Yeah, sure, so as Gary said, we kind of come at this from slightly different angles, but tend to have coevolved similar approaches. I’m a technologist and I think in technical terms, and I think that some of the ideas that underpin the approaches that Gary and I talk about have some fairly deep reasons why they work. I think that continuous delivery, in particular, and the kind of engineering approach to dev ops that I talk about is genuinely, defensively an application of scientific-style rationalism to solving problems in software, which is something that I would call proper software engineering. And if that were the truth, then we’d expect to get better results by doing that, because that’s how engineering works

    the disciplines. And I think we’ve got that.

    I think that if you followed our advice, we can’t guarantee you success, but we can guarantee you that you’ll have a better chance of success if you follow our advice. Because I think that’s the kind of input that we can deliver, with the approach to software development that we describe. It’s the approach that underpins many of the organizations that we think of as exemplary at software development. This is how the best organizations in the world practice software development. And Gary and I have been doing this for a long time and advising people for a long time, and as he said, we came to the conclusion that we’d be able to help more people by trying to digitize some of our understanding and knowledge in a way that can help more people, you know, than we can just do talking to them as consultants.

    Alan Shimel: Sure. You know, interestingly, you know, we’ve recently gone through a whole rebranding here, and we’re now the TechStrong Group and part of TechStrong TV, and we have TechStrong Media, TechStrong Associations, TechStrong Education. And as part of that exercise, we’ve been talking about just the whole way people learn today, right? I grew up where you wrote a whitepaper, right? A company wanted to tell you about their product, I wrote a whitepaper, or a series of whitepapers. When was the last time any of us read a whitepaper? You know, when was the last time someone wrote a whitepaper? But anyway, forget whitepapers for a second, just education in general, right?

    We went from, you know, in-person being the only way to do education. You know, we always understood people learn, you know, via vision, via hearing, or tactile via touching. We went from that in-person education to online education, we went from formal certification to informal learning as you go, we have virtual reality, augmented reality education, anything goes, love is love. But, so, I gotta ask you guys, how are you packaging this? How does our audience consume this? And why did you choose that particular methodology or method?

    Gary Gruver: Well, it starts with the white belt training, which is computer-based. And what I realized, when I was writing books, is I was hoping people would get’em and engage and then start reading them as an organization. And what I realized is, people would buy the books, and they’d sit around and gather dust. And one of the challenges is, how do you get people to absorb the content as it’s a computer-based system that can be integrated into your learning management systems, and there are large organizations that have integrated it into their employee development. So they buy an enterprise package and they’re having everybody take the training, and that’s a process that doesn’t tell them what to do, but it teaches them how to make their processes visible, and make the waste and the opportunities for improvement visible for everybody so they can align on those improvement ideas.

    And that includes videos and texts, and more importantly, it’s scenario-based assessments: “If you are this person in this role and you saw this data, what would you prioritize doing?” And I came up with a lot of those scenarios based on things that I saw customers doing in the industry that I interacted with. So it shows how to use the views of trying to identify it, but it also shows some of the things that people are doing wrong. So it helps to highlight those types of things, and we put that together, and then, you know, we leveraged a little bit off of Lean Six Sigma and manufacturing, not in exactly what to do, but with the idea that, to get higher levels of certification, you really need to do an improvement project.

    It’s more than just understanding the concepts and repeating them back. You’ve gotta go do a four- to six-month improvement project where you identify the issues, you highlight the problems, and you go to fix something, and you have metrics that quantify it. And the initial green belts were coming out with they’re saving, you know, over $50,000.00 in annual savings a year of waste _____ from the organizations. So we’re trying to motivate as many people to do that. And then, as we get’em motivated, we pulled in Dave to help’em avoid common mistakes and struggles along the way, and I’ll let him talk to that.

    Dave Farley: Yeah, so you were talking, a little bit earlier, Alan, about the start of the pandemic, and the start of the pandemic triggered me into starting a YouTube channel. And I started recording videos, short videos on different aspects of software engineering, continuous delivery, dev ops, software development, those kinds of things. And that kind of led me to kind of thinking more seriously and taking more seriously the ideas of education and the ways in which I can help more people do more stuff. And Gary reached out and started explaining his ideas about the white belt training, and so on. And so, I started working on that material that can help with those separate improvement projects, to allow people to solve problems. So, we’ve come up with a bunch of tools that will allow people to explore different ideas.

    So, my part of the offering is a multimedia wiki that will allow you to explore ideas as a wiki normally will and kind of jump around randomly. But also a bit like, when you’re going to visit the hospital and you follow the yellow track to get to x-ray, there are paths through the information that, if you follow those paths, they will guide you and give you advice on different ways of solving different parts of the problem. And that’s gonna be growing, over time, as we add more and more stuff, but already there’s a lot of useful information that can help people do things, like do more effective approaches to automated testing beyond deployment pipelines. And adopt the approaches of dev ops and continuous delivery into their discipline, and start to think about this engineering approach that we’ve both been talking about.

    Gary Gruver: And what I really like about it is there’s specific design patterns, but there’s actually code you can look at. So you can see why Dave coded it a way, and the implications of not coding it that way. ‘Cause we don’t want people to get excited about making improvements and go forward and to get frustrated and get stopped, and we don’t want’em to create something that’s really hard to maintain and brittle. So we wanna try to – we can’t answer all the technology and we can’t tell them how to do it, but if – you know, Dave’s been doing this for a lot of years and has done it wrong a lot of times, and so, if he can help people avoid those mistakes, they’re gonna be more successful and more likely to continue along their journey.

    Alan Shimel: Fair, fair. Guys, is this available now?

    Gary Gruver: Yes, and there’s another thing that I’ve struggled with. One is, how do you get leadership engagement? Right? For leadership engagement, they’ll say, “Yeah, go do safe, or go do this, or go do that, copy what they did, and I’m gonna measure you and I’m gonna drive you on metrics,” but the leaders don’t really take the time to engage and truly understand the problems. And it’s so important to do, because, you know, because the same team does product development and improvement of the process, the process improvements always get traded off. And we call that technical debt. In manufacturing you have different groups, but you have a group very focused on the process.

    If we can’t get the leaders to understand the opportunities for doing the process improvements, we’re not gonna get’em to champion that and put it in perspective with what they’re being demanded from the product standpoint. So we wanna get the leadership engaged, and we’ve tried to prototype processes working in a few large companies where they’ve had a lot of success. Well, we let the executives take the training together as a team, and we don’t say, “Go do the training,” ’cause it’s eight to ten hours and they’ll never get it done. We’ll say, “Can we put one more meeting on our agenda and we’ll do the training together, every week, for an hour. And then, it’s not just the training. We have somebody take the training ahead of them and bring examples from their organization.

    So it’s not just training for training’s sake. It’s, like, “Okay, here’s a way of thinking about it and viewing the problem, and here’s that applied to our organization,” and then we leave’em time to debate. And it takes a little longer for’em to get through the training, but the alignment across the executives goes much quicker. And this, having done a lot of these transformations, this executive alignment is so important that I’m willing to offer a free prototype of the training to any organization that can get a group of executives committed to it, and has a change management person who’s willing to lead it and start to collect the data to facilitate those conversations.

    And that’s available now, and you could just send the e-mail at garygruver.com, and I’ll help you get set up with the prototype. And the training’s available at garygruver.com, or you can go directly to engineering the digital transformation, and get all this training and certification that is available and is being used successfully at large companies today.

    Alan Shimel: Very cool. So it’s garygruver.com for the information, here.

    Gary Gruver: Yeah.

    Alan Shimel: Cool. Guys, we’re almost out of time, but I gotta tell ya, I’m really stoked to have the both of you together on this. I think it’s a powerful testament, right, that this is gonna be something that’s worthwhile, if the both of you are the folks behind it. So best of luck with it. Guys, you gotta come back on and give us a progress report, maybe in a month or so, what do you think?

    Gary Gruver: Yeah, sounds good to me.

    Alan Shimel: All right. All right, go check out, look, if you’re interested in learning and learning right, about continuous delivery, about dev ops, about, you know, leading the transformation, engineering the transformation, check out this series of questions. I think you’ll find it worthwhile. Gary, Dave, thanks for being on TechStrong TV. We’ll talk to you soon.

    Gary Gruver: Sounds great. Thanks for having us, Alan.

    Dave Farley: Thank you. Bye.

    Alan Shimel: Bye-bye.

    [End of Audio]

     

  • Atlassian Survey Shows Lack of Collaboration in Software Development

    Atlassian Survey Shows Lack of Collaboration in Software Development

    A survey of 750 IT and engineering leaders found that while a full 83% of respondents agree that interdepartmental communication is critical for successful software development, only 41% of respondents view cross-collaboration to be a priority.

    The survey gathered responses from within organizations that generated more than $50 million in annual revenue and was conducted by Forrester Consulting on behalf of Atlassian.

    Overall, more than two-thirds of respondents (68%) said more departments than ever are involved with software development. Overall, 80% said they need to improve collaboration with other departments, but 82% don’t feel particularly confident about their ability to accomplish that goal. Three quarters (75%) also noted the need to improve collaboration within their own department.

    Well under half of the respondents (42%) said their culture, processes and tools enable the real-time teamwork and free-flowing information that help leaders make sound decisions.

    Among the subset of respondents that are highly collaborative, however, more than (53%) said they see greater customer satisfaction, with 59% reporting increased revenue because of that increased customer satisfaction.

    Suzie Prince, head of product for DevOps at Atlassian, said the challenge organizations face is finding a way to successfully employ a mix of synchronous versus asynchronous communication mediums to better enable collaboration. In fact, collaboration as part of any DevOps culture needs to be a C-level discussion to consistently accelerate the rate at which software can be developed and deployed, she added. The core issue is that not every management team is equally comfortable with open communications between the various departments that make up an organization, said Prince.

    It’s critical for C-level executives to set that tone and lead by example; DevOps best practices can’t only be adhered to by development teams. The entire business needs to embrace DevOps best practices as an operating model for the business to really attain the maximum benefit.

    Unfortunately, DevOps practices within development teams have been unevenly adopted, so it’s often very difficult to get the rest of the business to embrace DevOps principles. Organizations that do embrace DevOps, however, tend to be much further down the path toward becoming a digital business and can more adroitly take advantage of business opportunities as they arise or shift strategy as changing business conditions may warrant. In fact, organizations that embraced DevOps best practices arguably fared better during the economic decline that followed the onset of the global COVID-19 pandemic that took every business and IT leader by surprise.

    It’s not clear from the Atlassian survey results if a DevOps divide is starting to emerge that makes some organizations more competitive than their rivals. In theory, at least, if every organization is now a software company that happens to build something or deliver a service, then the faster they can reliably build and deliver applications the greater the competitive advantage they can attain and sustain.

    There are, of course, a whole host of factors that determine how competitive any organization might be. However, in the age of digital business transformation, it’s clear that being able to build and deploy software at a fairly regular cadence is the new table stakes required for simple survival.

  • HashiCorp Previews Updates to Consul Service Mesh

    HashiCorp Previews Updates to Consul Service Mesh

    During an online HashiConf Global conference, HashiCorp today made available a beta of an update to its open source Consul service mesh for virtual machines and Kubernetes clusters that makes it possible for multiple administrators to share the same instance of a multitenant service mesh.

    Version 1.11 of Consul will also add support for a command line interface (CLI) for Kubernetes that will provide an alternative to Helm charts for installing Consul on those clusters.

    Raymond Austin, director of product marketing for HashiCorp, said it’s become apparent that there is a need for a higher level of abstraction for managing application programming interfaces (APIs) that is easy to deploy across both legacy IT environments based on virtual machines and cloud-native environments based on Kubernetes clusters.

    Of course, in many cases, those Kubernetes clusters are deployed on top of virtual machines. However, there are also now more instances of Kubernetes being deployed on bare metal platforms at, for example, the network edge.

    As IT environments become more complex, a service mesh makes it simpler to discover, access and secure APIs that are now rapidly proliferating across the enterprise. That transition requires a more dynamic approach to not only managing APIs but also the network services those APIs depend on, added Austin.

    HashiCorp is betting that many IT organizations will prefer to rely on a lightweight open source platform supported by a single vendor rather than relying on more complex open source service mesh offerings being developed under the auspices of a consortium.

    It’s still not quite clear who within an IT organization is assuming responsibility for deploying a service mesh. Most often, it’s a development team that makes the initial decision. However, as IT operations teams become more aware that service meshes represent a capability that needs to be horizontally made available across multiple applications, it may be only a matter of time before some organizations decide to standardize on a single service mesh to reduce operational overhead, noted Austin.

    Service meshes will also play a critical role in simplifying management of networking and security services at a higher level of abstraction within a larger DevOps workflow.

    It’s still early days as far as service mesh adoption in the enterprise is concerned, but there are already a large number of service mesh options. In fact, there may never be a single dominant service mesh platform. Interoperability standards still need to be ratified that enable organizations that have standardized on different service meshes to apply policies to microservices spanning hybrid cloud computing environments.

    Of course, not every IT organization requires a service mesh yet, either. Many IT teams can still get by using a traditional proxy server or an API gateway until the number of microservices-based applications deployed starts to achieve critical mass. One way or another, however, the more APIs there are to manage, the more inevitable it becomes that an IT team will deploy a service mesh.

  • Welcome to the New Field of Software Supply Chain Management

    Welcome to the New Field of Software Supply Chain Management

    Supply chain management is the newest ‘shiny object’ in both the DevOps and DevSecOps communities. But what does it mean in relation to software development?

    Historically, supply chain management is a commerce term that refers to tracking the logistics of goods and services moving between producer and consumer. This would include the storage and flow of raw materials with a focus on the channels that support the process.

    When we look at this concept from the perspective of software development, we will soon see that it is a new form of software configuration management. Yes, the new SCM is … SCM. The core of supply chain management is the process of controlling changes in software. The new SCM expands those old practices to include all ‘raw materials’ which we manage as part of our software build and package steps. For instance, when companies purchase and download open source libraries used in their in-house software. Supply chain management includes the interrogation of these ‘raw materials’ as well as all of the internal code and libraries. We will soon be hearing more about software bill of materials (SBOM) reports and difference reports, as they are critical for understanding the objects that flow through the software we create.

    The software supply chain or software configuration management practice hasn’t been talked about much until recently. This area of expertise has never been ‘sexy.’ That is, until the SolarWinds supply chain hack. The SolarWinds hack was a hard lesson to learn, but it taught us to take a closer look at how we consume our raw materials and to be more serious about how we build and package our software.

    According to FireEye, the firm that discovered the backdoor supply chain hack:

    “SolarWinds.Orion.Core.BusinessLayer.dll is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third-party servers. We are tracking the Trojanized version of this SolarWinds Orion plug-in as SUNBURST.”

    It was obvious, something went very wrong with the creation of that .dll. I don’t pretend to fully understand how this breach occurred. But I do understand the build process and have been talking about the potential for these types of breaches for over 25 years.

    There have always been big security gaps and vulnerabilities in our most basic software development practice—the compile/link process. Most build processes are imperatively defined using an Ant, Make or Maven script. Each time the build runs, it rebuilds all the binaries, even if the corresponding source code has not changed.

    This is a problem. Instead, we need a build that is incremental. Incremental builds are difficult to script because they need more advanced logic. Most developers are not given adequate time to create a better build process, one that only rebuilds the changes. This means it is next to impossible to audit why a binary was recompiled because they are always recompiled. If we only recompiled the binaries that had corresponding code updates, we could more carefully audit the code and make sure that only approved coding updates were included.

    This may not have caused the SolarWinds attack, but it could have. Once hackers have gotten past the firewall they can find the build directory, read through the build scripts and identify the perfect piece of code to update with their bad function. The next time the build runs, a ‘clean all’ recompiles everything and, like dark magic, a SUNBURST is created.

    In our not-too-distant past, the developer community had tools that controlled software builds beyond what an imperative script could do. OpenMake Software, for example, provided a build automation solution called Meister that ensured that incremental builds were easy. As part of the build, it generated SBOM reports and differences reports allowing teams to easily audit and compare the actual source changes to confirm that only approved code updates were included. Another example was Rational Software’s ClearCase which used a program called ClearMake. ClearMake used a process called ‘winkin’ to reuse ‘derived’ objects that had not changed. This process created an incremental build that could be easily audited.

    I realize that I am simplifying the overall problem, but it is a good example of the basic supply chain best practices and how potentially vulnerable our processes are.

    The time to carefully think about how we manage our raw materials and overall supply chain is now. I’m guessing that most monolithic practices will not change much; it is too costly and impactful to rewrite hundreds of CI pipelines. But that does not mean we can’t solve the supply chain puzzle as we shift into cloud-native development in a microservice architecture.

    In a microservices architecture, we need to begin thinking about what the supply chain looks like. How do we track raw materials that are in the form of hundreds of small ‘bounded context’ functions? The good news is there is an emerging microservice catalog market that can become part of the supply chain solution. A microservices catalog can track versions of services to versions of their consuming applications. Your new SBOM report will have two levels: First, an SBOM for the microservice. Second, aggregated data at an application level. Remember, in this new architecture a full build is not done.

    It’s important to understand that microservices are naturally incremental and are independently built, packaged and deployed. Managing these small services opens the door to more closely auditing their source code before they are released.

    As we shift from monolithic development to microservices, we have an opportunity to incorporate supply chain and configuration management best practices. This includes being able to carefully audit the code before a release is done. And remember, we must do this as fast as possible. It sounds like a big task, but it’s well worth the effort. Collectively, we will find the answers as we explore new ways to manage our DevOps pipeline and incorporate configuration management and DevSecOps principles.

  • Top 5 Must-Haves for IaC Automation Tools

    Top 5 Must-Haves for IaC Automation Tools

    These days, there are a lot of different DevOps tools to accomplish a lot of different jobs. Almost daily another startup comes out with a new and innovative product or a newer (maybe even better) version of existing tools. One of the biggest innovations has been infrastructure-as-code (IaC). Giving infrastructure admins and developers alike the ability to create, manipulate and destroy infrastructure using code files changes the way we administer our environments. Though these tools are revolutionary and can solve many problems, sometimes they come with a whole new set of issues—as can any type of tooling, really. 

    Generally, IaC tools are run locally at first. When an infrastructure admin or developer is just starting out with it, they store the files locally; maybe in a repository, then clone the files to execute locally. This is perfectly acceptable and a very common practice. The issues arise when it comes to scaling this practice to a team; for example, with regard to visibility and governance. If everyone is running their deployments locally, the team doesn’t have clear visibility into who is deploying what, when and with what variables. This is where IaC automation tools come into play.

    There are many different types of tools to solve these problems. Some are better than others. CI/CD pipeline tools, custom-built automation platforms, purpose-built IaC automation platforms—each has their pros and cons. Getting into all of that can be overwhelming and we could go on for hours about each option. But, we’re here to talk a bit more generically today. So, we’ll save all of that for another time. For now, let’s take a step back and talk about the top five must-haves for any infrastructure-as-code automation platform you’re considering. Because each company and use case is different, we’ll talk about these considerations in no particular order. 

    Role-Based Access Control (RBAC)

    This first factor is pretty important. I know I said I wasn’t discussing these in any real order, but this one should really be close to the top of the list for anyone looking into IaC automation. We talked about how automating IaC can cause visibility issues when you scale across a team. You may want to know who deployed what, when, where and why, for example. Usually, the reason you want that kind of visibility is that you would like to control all of these aspects. That way you can help limit waste, budget problems, security concerns and the like. You may want to provide self-service deployment access, but only within certain parameters; maybe only to certain people or teams. Having granular RBAC can help you design a security policy that makes the most sense for your organization and its needs. Some tools have this baked in, some take a bit of work to make it work. The point is that you should have some form of control over your deployment process. 

    Self-Hosted Agents/Runners

    Following the security thread: A lot of these IaC automation tools are SaaS platforms. SaaS can be very secure. But sometimes, for compliance or regulatory reasons, you may want to retain a bit more control over your deployments. This is where self-hosted agents or runners come in. This type of design allows you to keep your “secrets”—such as your cloud credentials and other sensitive variable information—secure in your own way. You can use whatever secrets management solution you want, be it something from your cloud provider or another third-party solution. It also allows you to keep your code secure. All of these tools, when deploying your code, have to get a copy of that code to deploy. So, they’ll do a ‘Git clone’ or some kind of file copy process to get your files from where they are stored, to execute them. If this is a SaaS solution, then they will essentially have access to your code. Again, this may not be a huge issue for some, but it very much is for others. If you don’t want to give a third party this level of access to your code and secrets, a self-hosted agent or runner can help keep it all secure and under your control. 

    Plan on Pull Request

    This feature is a big one when it comes to workflow. Some may not even know how important plan on pull request (PR) is until they realize how easy it can make their life. This feature may be called something different depending on the platform. Plan on PR, PR plan, speculative plan, etc. Essentially, this means that whenever you open a pull request against a branch, your automation platform will complete a deployment just up to the “plan” phase so that you can see exactly what this code change will do. For example, if you accidentally add an extra 0 to a variable or code file, you may end up with 100 instances instead of 10. Ideally, you’d like to know what was going to happen with a change before it is deployed, giving you the option to quickly fix a potential mistake before it actually goes through. In DevOps, you always want to ‘fail faster’ and close the loop so that big mistakes are caught before they happen. That is why this feature is so important. And if the automation platform you choose is doing this correctly, when it runs this plan phase it’ll automatically update the pull request directly with the possible changes as a comment. This way, your developers can see what is going to happen before they try to merge the deployment back to the main branch for deployment to production. And if they take it a step further by adding service checks to the pull request, you can even configure it so that if the deployment plan fails for any reason, developers are actually blocked entirely from merging the PR back until it is resolved. All of these features help to enable the ability to work in a GitOps methodology. Don’t get me started on the wildl misuse of the term GitOps—it is very specific. While one of the central pillars of GitOps is using your repository as your “single source of truth” for what should be deployed, it’s not just using Git to store your Terraform files; it is an infrastructure administration via pull request methodology. If you want more information about GitOps, you can read more here. 

    Continuous Deployment

    This feature is essential for most folks. But, depending on the workflow, it can be less important. Even if it isn’t a must-have now, it may be down the road when you evolve and grow into new workflows. Continuous deployment is the ability for your automation platform to have a webhook or other connection to your source code repository so that it can automatically trigger a deployment process whenever you commit or push to the repository. This feature goes hand-in-hand with the plan pull request feature we just spoke about. To make that feature function properly, a CD feature would be needed, as well. Now, I want to make sure I clarify. Just because you have continuous deployment enabled doesn’t mean it is just going to push to production in the middle of the day every time a commit or push is done. You should still be given the ability to pause the deployment process after the plan phase. This way you can validate that the plan looks acceptable before you approve the deployment. For some use cases, like developer sandboxes, you may “auto-approve” the deployments because you don’t care about having to get validation first. It all depends on your workflow and processes. A good platform will give you the ability to control all of this. 

    Shift Left Extensibility

    This one is a bit of a wild card. It can mean a lot of different things depending on the situation. Essentially, what I am talking about here is the ability to integrate—or at least be interoperable—with a multitude of other tools during the deployment process. There is a concept called continuous verification which means to shift some tools and processes left into the deployment process so that you can stay on top of problems before they start. In the PR plan feature section earlier, we talked about catching issues before deploying. This isn’t just for resource configuration issues. What about security issues? Compliance issues? Performance issues? Or even budget issues? If your IaC automation tool gives you the ability to integrate the processes and tools you are using to validate these things into the deployment process, they no longer have to be an afterthought. You never have to worry about going over budget if you are constantly validating the budget each time you deploy. You don’t have to worry about a security issue if you’re validating security during every deployment. This type of functionality can look and be named very differently between tools. But as long as you have the ability to get all of these other groups (security, finance, etc.) involved sooner, everyone will be better off. Like we talked about before, in DevOps, it’s always better to fail faster. And integrating these checks into your deployments can help you achieve this. 

    Conclusion

    We’ve made it through all five! We’ve talked about some basic security features. We talked about some automation workflow must-haves to make your life easier. And we even scratched the surface on some next-step-type things to look into such as continuous verification. That was a lot—hopefully this has been helpful for anyone looking into IaC automation platforms and you now have an idea what to look for. Some features may be named differently, but the ideas behind them are the same. If your platform can’t do these, it may not be the right one for you. Or, maybe it is and that feature just isn’t that important to you. As I mentioned, your mileage may vary. Every organization is different.


    To hear more about cloud-native topics, join the Cloud Native Computing Foundation and the cloud-native community at KubeCon+CloudNativeCon North America 2021 – October 11-15, 2021

  • Rethinking Your Approach to Ops Governance

    Rethinking Your Approach to Ops Governance

    The “You build it, you run it” approach has changed the mindset of modern organizations that are increasingly adopting DevOps practices. No longer completely beholden to the requirements of operations, engineering teams are continually acquiring more autonomy to deliver rapid innovation. At the same time, more organizations are adopting platform teams to accelerate development, empowering teams with easier access to services without requiring them to understand the underlying complexity. While this approach is helping teams build, scale and ship software faster, it’s also resurfacing previous areas of tension around operational governance. 

    Organizations are generally choosing between two governance approaches: Mandated or paved path. Each has a different perspective on the appropriate level of autonomy to grant development teams and where governance should sit within the development life cycle. But there’s a third approach—the “trust and verify” approach—that can provide both high levels of autonomy for development teams and the sophisticated governance that operations teams need to ensure compliance and security.

    What is a Platform Team and Why are Organizations Adopting the Model?

    A platform team provides a foundation of self-service APIs, tools, services, workflows and support that accelerates the delivery of digital services and products. Platform teams operate similarly to any R&D team; employing customer support, operations, development, SRE, product managers and other personnel. They use research, customer feedback and usage data to iteratively improve their services.

    Rather than each development team reinventing the wheel, the platform team builds shared services that shield developers from the underlying complexity of infrastructure and enable self-serve access to services. As engineering resources become even more in-demand and scarce, organizations are using platform teams to optimize resources and share outputs.

    Two Platform Governance Approaches: Mandated Vs. Paved Path

    Organizations today typically are using one of two approaches to platform governance: Mandated or paved path.

    A mandated approach solves the governance problem by mandating that all engineering teams use the platform. However, this approach puts the onus on the platform team to keep up with the changing demands of engineering. Organizations must invest in a platform team that can keep up with engineering requirements so they still feel like they can innovate and use the best tools.

    The second approach is a paved path, popularized by Jeff Lawson of Twilio. This allows for engineers to go outside the platform if they are willing to take on the SLAs the platform provides and are responsible for all the costs of maintaining their own alternatives. Lawson said in this McKinsey interview, “What you do is you create the incentive structure for teams to take the paved path. But if they really have to go a different route, you make it possible for them to do that.”  

    While the paved path approach offers more autonomy for engineering teams, it requires teams that veer off the path to maintain the integrity of their software. Without guardrails, operations must put full trust in teams to keep their services secure and compliant. It can often be difficult for operations teams to maintain visibility into the services and infrastructure that fall outside the core platform.

    So, given that a mandated approach restricts autonomy and a paved path can make compliance more difficult, what is the middle ground?

    Bridging the Gap Between Mandated and Paved Path

    First, it’s important to understand that governance is not synonymous with command and control. Instead, operations teams should think of governance as the practice of maintaining visibility and providing best practices. Rather than a mandated platform approach, organizations can choose an approach that offers more autonomy to engineering teams (similar to paved path) while also maintaining operational governance. This is a trust and verify approach. 

    Using the trust and verify approach, organizations should focus their efforts on technology, not people, to maintain compliance. The goal would be to have a platform that could easily connect to the entire toolchain any product team uses for complete visibility and context. In this way, operations can gain governance without adding friction for product teams. This requires a top-down approach within organizations: I&O leaders investing in engineering resources or an off-the-shelf platform that can enable this technology. Both engineering and operations can flourish in this modern environment. Approaching governance from a trust and verify perspective will expand access to innovation while ensuring compliance and security standards. 

    Governance Should be Over Technology, not People

    Creating a bridge to a trust and verify approach means placing the responsibility for governance on technology rather than people to maintain detailed audit trails of human and machine actions tied to identity and reduce the potential for human error through automation. This approach provides autonomy for engineering teams while also ensuring governance through visibility and process controls embedded into workflows and tooling. 

    Shellie Miller, senior manager, technology governance and compliance at Hulu, believes technology can support DevOps practices. “To have a successful DevOps organization, we don’t need to have command and control or have this clear line of separation between dev and operations. It’s putting the responsibility on the infrastructure, the platform and the tooling and the policies and the processes that you have to enable those self-serve capabilities,” Miller said. 

    Mitigating Human Error Through Automation

    This investment in technology should focus on automation and process controls that fit within teams’ current processes. “What auditors are really trying to do is mitigate human error,” said Miller. “Teams should really focus on automating controls, building those security practices and those best practices into the platform. That way, dev teams are just subscribing to that offering.” 

    Changes to applications, systems, data and code—one of the biggest culprits with regard to risk—is where automation and process controls embedded into platform offerings can make a huge impact. “From an engineering perspective, constant change is needed to support rapidly changing consumer demands,” Miller added. “However, from an audit perspective, these activities increase risk of material impact to viewer experience, revenue and/or financial reporting.”

    Investment in Governance Comes From the Top

    While technology holds the key to better governance and compliance standards, there’s an investment that must be made, whether that’s investing engineering resources in building automation or investing in an off-the-shelf platform that can enable automation.

    “Leadership and organizational backing is absolutely key,” said Miller. “You can’t get to compliance or governance or any kind of operational maturity, for that matter, when you’re doing a bottom-up approach.”

    Building a compliance and security program around technology and not people means having the proper skills and mindsets. A bottom-up approach could create friction, especially due to a lack of education and understanding of the why and how. A top-down approach ensures there are resources to both implement the technology and to foster a culture of understanding and education. 

    The most common question I get asked is, ‘Why can’t we trust our people?’” Miller said. “Compliance requirements don’t generally start with the thought that our people are being malicious. We should run an organization of trust, and through automated monitoring and governance, we can verify and govern without being intrusive and disruptive. Lack of training and the demand on teams is what drives the perception that there’s no trust. Security and compliance is intended to mitigate risk and prevent threats to the systems that enable the business.”

    Building on a “Trust and Verify” Platform Approach

    When it comes to governance, technology is our greatest asset. Of course, this investment can be substantial for many organizations that don’t have the engineering resources to build in-house. Today, new open source or off-the-shelf platforms enable operations teams to build self-service capabilities that provide guardrails against human error, an audit trail of human and machine actions and visibility across disparate tools and services. 

    No-code solutions that also provide a developer platform for deeper customization enable teams to build out these core requirements of governance without consuming considerable engineering resources. The door to a future where operations teams can provide more autonomy to development teams while maintaining governance is now open. Every organization has the ability to attain a “trust and verify” approach and meet the needs of both dev and ops.


    To hear more about cloud-native topics, join the Cloud Native Computing Foundation and the cloud-native community at KubeCon+CloudNativeCon North America 2021 – October 11-15, 2021