Category: DevOps in the Cloud

  • 6 Key Considerations When Migrating to AWS

    6 Key Considerations When Migrating to AWS

    Every day, more and more organizations take the plunge and migrate to the Amazon Web Services public cloud. What they leave behind is the cumbersomeness of the traditional data center, but despite the cloud’s benefits in scalability, agility and efficiency, they discover a new set of challenges that need to be overcome.

    Gartner estimates that more than 50 percent of enterprises will have adopted a hybrid cloud approach by 2017. Transitioning from a traditional on-premise IT infrastructures to a public cloud can be daunting, however, and success requires a different mindset and range of skills. This shift can be particularly challenging for traditional enterprises because they have a lot at stake. Here are the five main challenges in moving to the AWS cloud.

    Cloud Finances

    Different organizations have different financial approaches, and their choices of IT infrastructure reflect this fact. For some, the on-premise approach of making a large, upfront capital expenditure to purchase infrastructure and then capitalizing the investment over time may be the favorable option because they prefer to keep complete control over their IT environment. However, for others, a heavy initial expense is not ideal, so a cloud approach with only ongoing, operational costs is more fitting. This option may be particularly suitable for organizations with fluctuating needs on a monthly basis, as an on-premises data center will not offer them the flexibility they require.

    Regardless of the approach, it is important to compare the respective costs before deciding which one is most suitable. The best option may be to combine both on-premise and cloud to create a hybrid cloud environment. This will allow for steady workloads to be kept onsite while bursts in demand can be processed by an on-demand, public cloud.

    Security, Availability

    The idea of handing over all of your data to a public cloud provider can be a daunting because of the obvious security and availability concerns. However, public cloud providers must adhere to strict compliance protocols and can implement and maintain much higher security levels than on-premise installations because they have more available resources.

    In fact, enterprises have avoided migration to the cloud for a long time due to security concerns. However, this is slowly changing, as IT leaders now realize that running on the public cloud actually can bring the advantage of greater security because AWS has industry-compliant cloud infrastructure (HIPAA and PCI-DSS standards, for example).

    Nonetheless, AWS customers must understand their responsibility in protecting user data and implementing a service level agreement (SLA). For more information, take a look at the AWS “sharing the responsibility” model.

    Rehost (Lift and Shift) vs. Rebuild (Re-architect)

    Migration to the cloud requires some amount of preparation before in-house applications can be moved. Gartner describes five different methods of application migration, and two of them are specifically relevant when discussing IaaS—rehosting and rebuilding.

    Rehosting (also known as the “lift-and-shift” approach) involves taking an application and re-deploying it to a different hardware environment without making changes to the application’s architecture. Although this is a quick-fix solution that will have your application up and running on the cloud quickly, rehosted applications probably will not be able to utilize the main advantages of the cloud (such as horizontal scalability) because they were built on top of custom vertically integrated hardware. Rehosting allows organizations to get away from high on-premises infrastructure costs, but the approach is suited mainly to applications with easily defined patterns.

    Resource-intensive apps (such as those used for image rendering or big data analysis) are more suited to the rebuild (or “re-architect”) approach, in which the original code is scrapped and replaced with new code. These types of applications naturally rely on commodity hardware and have the ability to scale, so keeping them in closed, on-premise silos could mean you end up with performance issues and high costs.

    Rebuilding is naturally a time-consuming and costly process. The solution, therefore, lies somewhere between the two approaches, with the main deciding factors being cost and security of the workloads.

    Get it Right from the Start

    At the beginning of the process, be careful in selecting which apps or services you move to the cloud. If the first few are successful, that will set the tone for the whole migration. If some of the early projects fail, enthusiasm for the migration will dwindle and make it more difficult to complete.

    Be smart by choosing projects that are most likely to be successful, such as non-critical applications or services that can be migrated easily. Make sure your environment is transparent from the start by using modern monitoring and logging systems that can collect large amounts of log data and then parse it to find events and provide insightful information.

    In addition, knowing your cloud environment will significantly increase your success rate. Don’t get too ambitious and try to do it all at once. Follow each small success with another, and your team will ensure a smooth migration.

    Beware of Staff Apprehension

    Any dramatic change within an IT environment will face staff apprehension. You might expect the shift to be met with resistance from corporate management, but the real doubts will come from your IT team. After working with on-premise infrastructure for years, administrators will not welcome any changes they think could jeopardize their jobs. Help your team embrace this shift by making sure they receive suitable training to prepare them for a new set of challenges.

    Log Analysis and Metric Collection

    Organizations moving to AWS suddenly find themselves managing a highly scalable and highly dynamic environment that requires a new type of log analytics and metric collection. The need for centralization of data is crucial in dynamic environments because often you find yourself trying to troubleshoot a problem on servers that no longer exist.

    During the most recent re:Invent, AWS CTO Werner Vogels emphasized the need for centralized log collection as necessary for success in AWS migration:

    IT organizations suddenly gain access to thousands of servers running more applications than ever that also wind up generating more log files than most IT organizations can possibly cope with. … In order to be successful in the cloud, IT organizations need to relentlessly measure how both systems and applications are performing. The problem is that log collection and processing is painful.

    All of the individual components Vogels described each have their own outputs of important log data that need to be analyzed. To ensure a successful AWS migration, logs from your applications, infrastructure and S3 Access buckets—and much more—all must be monitored to ensure all of the parts of your new AWS environment are operating in a way that is secure, highly available and scalable. (To help IT organizations, we have published a free e-book on AWS log analytics with the open source ELK Stack.)

    AWS: A Final Note

    AWS is the preferable public (IaaS) cloud choice for enterprises today, and it looks set to stay this way. To achieve a successful transition during a migration of workloads and products to AWS, the process needs to be carefully planned and implemented in a step-by-step fashion that will prove the benefits of the move to all of the stakeholders.

  • Top 5 Reasons to Back Up Your OpenStack Environment

    Top 5 Reasons to Back Up Your OpenStack Environment

    I am a big fan of lists. If you recall the movie “High Fidelity,” John Cusack’s character Rob and his co-workers—armed with an encyclopedic knowledge of all things musical—compile “top five” lists for every conceivable occasion, openly mock the tastes of people, and, every so often, sell a few records. In the spirit of a lists, here are the top five reasons to back up your OpenStack environment. We thought that it would be helpful to many.

    If you’re currently working with OpenStack clouds, or are in the process of embracing it, you need to include backup and recovery for OpenStack on your list of to-dos from the start. You may ask, “Why? I have orchestrated/automated everything, I just need to spin resources up and down.” Cloud environments are fundamentally different from the virtualization we have become used to. Virtualization relies on infrastructure for resiliency. In the cloud, distributed applications are responsible for their own resiliency, and are independent of the underlying infrastructure. Therefore, cloud apps need backup and recovery options, lest you face a complete machine, data or file meltdown.

    We’ve compiled the top five reasons to backup your OpenStack environment. Take a read and it will become clear why you must include backup in your OpenStack plans.

    1. Compliance — Compliance may seem like an issue for only certain industries—finance and health care come to mind—but nearly every organization has to deal with compliance issues. For some, it’s compliance to external regulations, while for others it’s simply complying with internal policies and best practices. Backup for OpenStack is an essential component for compliance; it ensures the availability of the data at a specific point in time within your OpenStack applications. I was recently involved in a dialogue/string on LinkedIn watching experienced OpenStackers go back and forth debating “pet vs. cattle.” “I am getting tired of it,” one person said. “This is cloud. It’s about scaling up and out … With automation and orchestration there is no need for cattle.” This conversation went on for days. Theory is great. Practice is reality. What people failed to discuss is that compliance or the business units will drive many requirements (such as backup) either today or tomorrow. End of story.
    2. DevOps — Backup is often the forgotten tool for DevOps. Containers are great to use, but the ability to test with real data is an issue. The reason to use backup is quite simple: test and development. With a copy of a production environment, you now can test upgrades and new features in your agile development process. Furthermore, if you lose a machine or your data, or you end up with corrupted files while in the middle of testing or development, your life will be much easier if you have an appropriate backup solution in place. Restoring machines, data and files is a better option than re-creating them entirely. Cookbooks and recipes are great as well, but you still need to couple it with the appropriate “ingredients.” It is like playing with a fake kitchen as a child … do you want to make breakfast with plastic pancakes and toast? Nothing beats the real thing. Yes, more resources are required for one over the other, but when something goes wrong—it is unfortunate—people point fingers.
    3. Disaster recovery plans — While the terms “backup” and “disaster recovery” often are used interchangeably, they are actually not the same thing. You might have what appears to be a great recovery environment (ideally one that mirrors your production environment for high availability), but without a comprehensive backup solution, your recovery might not be the painless experience you expect it to be. Perhaps the solution for intelligent disaster recovery is to marry backup with a Swift environment so you can recover from any point in time, anywhere in your organization.
    4. Save time — Often recovery can be a frantic process, driven by a business need to have the machine, data or files recovered as soon as possible. Or, more likely, sooner than possible. If you are trying to re-create something under that type of environment, there’s a likelihood that mistakes could be made. This becomes increasingly true the more complex and mature your cloud becomes (think about the growing number of workloads and applications). A much easier approach—one that provides you with peace of mind—is to have a comprehensive backup solution ready and available for when you need it. There’s also another reason backup can save you time: When you have to re-create the lost information, you are taking your time away from something else—and that means you are taking a big hit to your productivity. Save yourself and your organization a big headache with backup.
    5. Security and forensics — You never know when you are going to be asked to provide data or files related to a security issue or a forensics investigation. The right backup solution not only makes it easier to assist with the activity, but think how good you’ll look by being able to deliver the information the forensics team needs quickly.

     Are you currently looking into backup solutions for OpenStack? Now that you know why you need backup for OpenStack, learn more about how to backup OpenStack.

  • Testing Mobile Apps? Consider a Mobile Device Cloud

    Testing Mobile Apps? Consider a Mobile Device Cloud

    Market demand for mobile app development services is expected to grow at least five times faster than internal IT organizations’ capacity to deliver by 2017, according to Gartner. As a result, enterprises must use the most efficient, effective and secure methods possible for their mobile app development processes, including mobile app testing.

    Today’s users expect the highest quality user experience from their mobile applications, so testing should be a top priority for enterprise IT departments that want to keep up with these expectations. Mobile testing is more complex than legacy application testing, however, because of the myriad platforms, networks, OSes and devices on which the applications run. To ensure their mobile apps perform reliably for every user, businesses must test on key variations of this growing universe of mobile devices.

    Sharing a single large pool of mobile devices across large or geographically distributed testing teams creates a number of challenges that risk bleeding IT and QA testing budgets dry. Mobile device access management has been plagued with inefficiency and risk, requiring IT teams to purchase an unreasonable number of devices to cover their enterprise’s growing needs. Inevitably, many of these devices remain unused or become lost, which can stall testing and result in idle mobile engineers.

    In addition to the cost and inefficiencies of having multiple mobile devices, security has become a top concern for today’s enterprises, thanks to the rise in data breaches. To avoid complications, enterprises must hold mobile testing practices to the highest security standards. A data breach during app testing can create significant cost for an enterprise and harm its reputation. Plus, for industries that must adhere to Sarbanes-Oxley, HIPAA or other federal privacy regulations, a data breach or unauthorized user access can create a regulatory compliance issue.

    The Mobile Device Cloud Option

    A mobile device cloud may be the answer to the cost, security and compliance issues enterprises face in their mobile app testing environment. It can serve developers looking to test and debug applications and QA teams performing manual or automated testing, and facilitates collaboration among these groups and other stakeholders such as marketing and customer support.

    A mobile device cloud offers organizations four significant benefits: security, accessibility, speed and cost. Let’s explore each in a bit more detail:

    Security

    On-premises, private mobile device clouds access a centrally managed pool of devices and mobile apps and enable testing within an enterprise’s corporate infrastructure and behind the firewall.  This creates a highly secure environment for proprietary apps and sensitive data throughout the testing process, which is managed in-house. In addition, private, cloud-based mobile testing can improve compliance with regulatory standards by reducing the chances of a data breach or unauthorized user access.

    Accessibility

    Private mobile device clouds can still meet the enterprise need for global access—developers, testers and mobile engineers can securely access centrally managed mobile devices from locations anywhere across the globe without compromising corporate data security.

    Speed

    Technology advancements in mobile application testing platforms now allow automated, continuous testing simultaneously on multiple devices. This allows private mobile device clouds to be even more effective in increasing an enterprise’s app testing speed and quality without compromising security.

    Cost

    With IT budgets for QA and testing increasing 9 percent over just the last year, reaching 35 percent of enterprise IT team’s total budget in 2015 according to Capgemini’s “World Quality Report 2015,” IT teams need affordable options that still maintain efficiency, effectiveness and security. Private mobile device clouds often are much more cost-effective than off-premises, public device clouds, while also providing an agile, efficient and effective solution.

    BI Intelligence predicts that mobile phone sales will surpass 2 billion in 2016, which means demand for enterprise applications will continue to increase rapidly. More enterprises already have begun using on-premises, private mobile device clouds and are seeing the benefits of this secure, agile, affordable option for their mobile application QA needs.

    For those enterprises that haven’t yet considered private mobile device clouds, 2016 is a great opportunity to upgrade your mobile testing with an improved solution and to meet both employees’ and customers’ high expectations for enterprise mobile user experience.

  • A Guide to Public Cloud Security Tools

    A Guide to Public Cloud Security Tools

    Why is an arrangement of servers—which are constructed of hard metal, tend to run hot and weigh thousands of pounds—called a “cloud”? It only makes sense from the standpoint of an engineering diagram, in which data travels by an undefined pathway from origin to endpoint. In that respect, the cloud refers to the randomized packet transfer protocol that underlies modern computing.

    Although no one can know with certainty where the term “the cloud” originated, it’s clear what it represents. “The cloud is a metaphor for the Internet,” Cloud Camp co-founder Reuven Cohen told the MIT Technology Review in 2011.”It’s a rebranding of the Internet.” But for those with a security-first mindset, that metaphor is a problem. The Internet is a dangerous place that is filled with malicious people who enjoy misappropriating or damaging data. Storing private company and customer data anywhere on the Internet is a potentially hazardous course of action without the proper security controls firmly in place.

    Private vs. Public Cloud
    Private clouds are exclusive to a single enterprise—such as a enterprise company’s internal storage system. They are usually easier to secure but not as flexible in terms of rapid scalability. Private clouds also tend to have higher capital and operational costs. Public clouds, on the other hand, are operated by third parties that usually offer the cloud as service. Some of the most recognizable names are Amazon Web Services, Microsoft Azure and Rackspace in addition to the Google Cloud Platform and IBM’s cloud service.

    Private Cloud Security: Riskier Than You Think
    As Roger A. Grimes notes at InfoWorld, both private and public clouds come with risks. Private clouds may seem safer at first because they are under the enterprise’s tight control, but one of the biggest drawbacks is that many companies cannot afford the same level of security as Amazon or IBM. Even a company’s own employees are risk factors—they might do malicious acts or cause unintentional accidents. Private cloud networks rarely have geographic failover options, so all of its valuable data is more at risk. Public clouds, on the other hand, are supported by data centers all around the world—often making them more secure and efficient.

    Public Cloud Security: Still Facing Challenges
    Still, businesses typically consider these three specific security concerns when deciding whether to use public clouds:

    • Multitenancy: Sharing a cloud with other businesses—especially competitors—is the top concern of many corporate executives. Companies in public clouds must be confident that neither their private data nor their customer data will leak into other users in the space.
    • Virtualization: Exploits are grabbing headlines with increasing frequency. As identities across devices have become more fluid, access and authentication systems are having to work harder to approve the right users.
    • Ownership: Many public cloud providers are silent on the issue of ownership in their user agreements—leaving open the possibility that they could try, for example, to profit from the storage of the data.

    There are many ways to approach these challenges. The U.S. National Highway Traffic Safety Administration, for example, found a way to make the public cloud safe and accessible in less than one month by using some of the latest cloud security tools. The rapidly growing industry of cloud security firms and related software—such as those listed below—is evidence of the fact that cloud security is entering a new era. Businesses looking into a public cloud solutions may want to explore these options as additional ways to protect their data.

    The Top Public Cloud Security Resources

    • AppRiver – looks at messaging security for SaaS-based e-mail and web tools
    • Awareness Technologies – brings its SaaS-based DLP model to analyze mobile and the cloud
    • Barracuda Web Security Service – offers malware protection, URL filtering and application control
    • Bitglass – acts as a cloud-access security broker to secure applications and mobile devices
    • Bitium – handles identity and access management for BYOD and BYOA
    • BitSight Technologies – analyzes data on security behaviors and rates companies on security effectiveness
    • Centrify – centers on identity management across devices and applications
    • CipherCloud – handles encrypting or tokenizing data directly at a business gateway
    • Dome9 – examines firewall rules, IP address tables and ports to look for unusual web traffic
    • Evident.io – provides cloud security in partnership with AWS
    • ForgeRock – protects enterprise, cloud, social and mobile applications by identity access management
    • HyTrust – delivers access control, policy enforcement, hypervisor hardening and logging
    • IntraLinks – protects critical content and enables client control over data
    • Kismet – passively traces cloud machines while leaving no logs or traceable packets
    • Logz.io – users can create proactive alerts on selected events and relevant dashboards to aggregate and view data trends and monitor security threats including password brute force detection, access control and network access
    • Metasploit – takes a cloud IP address and tests penetration to assure that security is in place
    • MyPermissions – sends out alerts whenever apps or services try to access personal data
    • Nessus – operates as an open source vulnerability assessment tool
    • Nmap: the Network Mapper – tests penetration by scanning networks for congestion and latency
    • Netskope – discovers any cloud apps and shadow IT used on your network
    • Okta – manages logins across all cloud applications including Google Apps, Salesforce, Workday, Box, SAP, Oracle and Office 365
    • Proofpoint – focuses specifically on email to protect inbound and outbound data
    • Qualys – scans any and all used web apps for vulnerabilities in SaaS, IaaS and PaaS tools
    • SilverSky – offers email monitoring and network protection for HIPAA and PCI compliance
    • Skyhigh Networks – discovers, analyzes and secures cloud apps with logs from existing firewalls, proxies and gateways
    • SnoopWall – flags and stops access to high-risk data ports such as webcams, microphones, GPS and USB
    • WhiteHat Security – mimics threats to avoid coding vulnerabilities on websites
    • Vaultive – encrypts any data going from a network to an application
    • Zscaler – monitors all the traffic that comes in and out of your network along with protecting iOS and Android devices

    Public cloud security is only going to become more important with each passing year. Just look at these data points from Forbes reporter Louis Columbus:

    • Worldwide spending on infrastructure as a service (IaaS) is expected to reach $16.5 billion in 2015, an increase of almost 33 percent from the prior year
    • Cloud applications will account for 90 percent of global mobile data traffic by 2019, compared to 81 percent at the end of 2014

    So, with these trends in mind, how do you plan to secure your public cloud? I invite your thoughts in the comments below.

  • DevOps Chat: 7 habits of successful DevOps

    DevOps Chat: 7 habits of successful DevOps

    I recently had a chance to speak again with Sam Guckenheimer of Microsoft about his experience in leading the transition for Microsoft Visual Studio to Visual Studio online. In doing so, Sam and his team developed the 7 habits of successful DevOps.  You can listen to my interview below or read along below that. Also if you want to download the Microsoft paper on the 7 habits of successful DevOps you can do so here.
    [soundcloud url=”https://api.soundcloud.com/tracks/234949072″ params=”color=ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false” width=”100%” height=”166″ iframe=”true” /]

    Hi, everyone—Alan Shimel, devopsy.kinsta.cloud, here for another DevOps Leadership Chat, and I’m joined today by Sam Guckenheimer of Microsoft. Sam, welcome.

    Interviewee:                 Hey, Alan. How are you doing?

    Interviewer:                 I’m doing well. It’s good to speak to you again. The last time we spoke was at the DevOps Enterprise Summit out in San Francisco.

    Interviewee:                 Yep, that was a lot of fun. That was a great conference.

    Interviewer:                 Yes, and you know what? I think—well, you contributed to making it great, Sam. It was a great presentation you made, talking about, kind of documenting the journey of Visual Studio from a COTS, you know, traditional kind of software model to a SaaS based program, Visual Studio Online. And, you know, I think that’s something that a lot of our listeners may be interested in, and how do they turn their current software offerings into SaaS based. And along the way, of course, you’ve come up with a, I guess you call it the Seven Successful Habits of DevOps?

    Interviewee:                 Yeah, so we think about the seven habits that we’ve applied as we’ve done our transformation. We started around 2010, we were in the, if you will, the pinnacle or the leader’s quadrants on all the analyst assessments as a provider of software for on-prem use in what was then called ALM—application life cycle management. And we said, “Hey, we need to become a great SaaS provider as well.”

    So we think of things in terms of these seven habits that we need to provide. Three of them you can think of as sort of Agile on steroids or second decade Agile. That’s team autonomy and enterprise alignment, is number one. We work in scrum teams or feature crews, think about 8 to 10 engineers and a product owner. They autonomously pull items from a common product backlog, and at the same time, they align to enterprise goals on a six month planning cycle, we call this a semester or a season, where we know, in that time frame, what are the needles we’re trying to move for the business? What are the things we’re trying to do at the epic level that count, and Sprintly we measure, how are we doing against that, and the things that each feature crew is doing are counting against that. They may move forward, they may move backward, they may decide, based on the data they’re collecting to do more or do something else. But you know, that’s in their control based on the things we’ve agreed for the six months.

    The second habit we have is a rigorous management of technical debt. We’ve known about technical debt for a long time, but when you’re running a service, you really can’t afford to let any debt creep in, and you have to stay clean all the time. So we make sure that we’re constantly monitoring both what’s happening in the production service and what’s happening in the development process. So if, for example, there is anything on the live site going wrong, we attend to it immediately. If there’s anything happening in the development process, like a feature crew is letting its bug count start to ride up, they have to stop immediately, fix the bugs, and can’t do any new work until they get them down to zero, so we stay clean on tech debt as we’re going.

    The third habit is a focus on the flow of customer value. We’ve talked about this since early days of Agile. Now, with SaaS, we can measure it. So we have great telemetry in the service, and we look at how people use our software, both quantitatively as we’re going forward; that is, we actually observe what gets used, what doesn’t get used, what the scenarios are, and we reach out to customers qualitatively, where we engage with the high usage accounts and we say, you know, “Let’s talk to them.” And we encourage our engineers to buddy up and reach out and say, you know, what’s gone well, what’s gone not so well, what would you like us to do that you don’t see? Are there things you wish for that we could be doing for you, and so on.

    So we reach out to customers, we listen to them through things like UserVoice and we observe their behavior through telemetry on a continual basis. That’s all kind of Agile on steroids.

    Interviewer:                 Mm-hmm.

    Interviewee:                 You know, those are the first three. Then you get to the stuff that’s really new with devops. The first is, of those, number four is what I’d call hypothesis driven development or a backlog that gets groomed with learning. This is what Eric Ries, in Lean Startup, calls “build, measure, learn.” So, in other words, the idea is that the backlog, instead of being the just, you know, what an omniscient product owner things is right, it’s—we recognize that it’s a set of hypotheses or beliefs. We think that these things will improve our service, but we’re gonna treat them as hypotheses and we’re gonna turn those hypotheses into experiments, and we’re gonna collect data against those experiments so that we can substantiate or diminish the hypothesis, and that data will be evidence gathered in production. That’s the fifth practice—everything is evidence that we need in order to build up or draw down against those hypotheses. We look, we use instrumentation on everything, we use telemetry on everything, and we measure it against what’s important.

    So, for example, if we think something’s gonna be a better sign of experience, we will run the new against the old in parallel, and we may, if we have multiple front doors, like in our case we have a web experience and an experience through the IDE, the integrated development environment, we’ll run those in parallel. So that would be a four cell test, you know? New and old, web and IDE, and we’ll see what the evidence shows us about how much better the new is than the old, and hopefully the new is better; it might not be. Hopefully we’re right, but sometimes we’re wrong. In any event, it’s the data that will tell us, and it’s a “bring your data” world.

    So, evidence gathered in production is our fifth habit, and that is made possible by our sixth, which is what we call a production first mindset, or what Satya, our CEO, calls a live site culture. The idea of a live site culture is that the site status is always first priority, and with site status, you have two goals. If there is a live site incident, you want to, as quickly as possible, remediate so that customers aren’t affected, and you want to drive to a root cause analysis. Practice the 5 Whys like Toyota, get to the root cause, and identify the actions that you need to take in order to prevent a recurrence of such an incident or something similar, and those root cause actions that you take, you need to complete in one or two sprints so that you’re hardening the service as you go learning from the live site incidents so that you’re always getting better.

    That’s number six, and finally, number seven is that we manage infrastructure as a flexible resource. We can do this because we use the public cloud—of course, in our case, that’s Azure. We work as a customer of Azure just like our external customers would. We take things a little earlier, but otherwise, we’re a customer when we need more resources for development or for load testing or to spin up more labs, we just do it.

    And we continue to expand the number of data centers we run, and we now run our Visual Studio Team Services in eight data centers around the world; that’s out of 24 regions that are currently active in Azure, and we fully automate the deployment, but we start each Sprintly deployment with a canary instance, which is where we work. It’s our own one of those stamps, and the one where our closest early adopter customers are so that we know from the canary if there’s anything wrong with the deployment, and if there is, we then restart at the canary before we roll out to the subsequent deployment rings. And that practice of canary-ing, going big with load testing is part of the deployment pipeline, and then using the automation to roll out in subsequent rings is something that we’ve used to harden the service and let us get to a global scale on a regular basis.

    Interviewer:                 Got it. So, Sam, these are obviously lessons learned the hard way, right, [Laughter] by doing and paying the idiot tax and doing that.

    Interviewee:                 Yes.

    Interviewer:                 For our leaders who are listening to you now, where to begin? Where to start? Obviously you can’t do all seven at once. Some of them are dependent on others. Where do they begin?

    Interviewee:                 Well, I think that the first thing is to make sure you have Agility down. I think you cannot do this if you are a command and control organization that doesn’t really let teams learn, and to recognize that you do need to measure your time to learning along with your other measurements, you also need to totally automate your release pipeline.

    So, the notion that you can have manual steps somehow between a development pushing code or checking in and the release of that is a thing of the past. You know, start with continuous integration and then quickly go to continuous deployment and put the telemetry in place so that you can see the evidence from production that gives you the feedback on everything that’s getting deployed.

                                        If you don’t have those things in place, the rest will crumble.

    Interviewer:                 Yeah, agreed.

    Interviewee:                 Sam, we unfortunately are coming up near the end of our time. I want to ask one more question of you, though, and it’s along the same vein. So, you’ve laid out the steps here for us. How did you get your team’s buy-in on this—or did you?

    Interviewer:                 Well, we certainly did. I don’t think it was very hard. I think that we all wanted to move to this world. I think that there was a broad recognition that we needed to become a first class SaaS provider. I think that there were some additional quirks in our case of being a great SaaS provider while we continue to be a great provider on-prem software, and maintaining that engineering discipline.

    The teams were all for it. I think the leadership needed to recognize that we were investing in new practices and that we needed to maintain the investment in engineering systems and engineering practices so we have a rule of thumb that about 20 percent of our investment goes toward non-customer visible engineering, things like live site work, and we don’t quarrel about that. If we need to do live site improvements, we do them.

    So I would say there was a little bit more work on management to accept the change in practices than there was on the ground with the engineering teams who were sort of chomping at the bit to get going.

    Interviewer:                 Well, there often is in devops, right? You have that “from the bottom up” and getting true top down sponsorship and cover is a problem, right? Not a problem that cannot be overcome, but an issue that we’ve explored previously in our leadership suite here.

    Interviewee:                 Yeah. Yeah, it helps that our, right now, our CEO comes from this world, Satya Nadella, so he is pushing everyone in the company to make the change and to learn the new practices. There were some folks in the middle who were not comfortable, necessary, but you know, they’ve come around.

    Interviewer:                 As they often do.

     

    Interviewer:                 Sam, anyway, we are probably over our time and I apologize, but thank you very much for sharing your Seven Habits for Successful DevOps. Continued success with your Microsoft Visual Online and the rest of your endeavors at Microsoft, and we hope to have you on again some time in the future and we can talk more about leading the transformation at companies around the globe with these new ways of doing things.

    Interviewee:                 Thanks, Alan. I’ll do one commercial, which, which is that there’s a URL, microsoft.com/devops, where you can download an e-book about our journey and a devops self-assessment if you want to read more.

    Interviewer:                 You know what, we’ll include that link in the article, too, in the transcript so people can get that. Sam Guckenheimer, Microsoft—thank you so much for being our guest today.

    Interviewee:                 Thank you very much, Alan.

    Interviewer:                 Okay, this is Alan Shimel for devopsy.kinsta.cloud. Thanks, and have a great day.

  • The Growth in Data Center Uses for Shadow IT

    The Growth in Data Center Uses for Shadow IT

    Shadow IT is casting a long shadow over IT departments as more organizations react to changing demands from their customers, partners and regulators. Groups and individuals outside of IT are taking matters into their own hands by tapping new cloud-based applications and hosted data centers.

    Shadow IT involves any purchase of equipment, software or data center resources for uses outside of production IT. These purchases usually fall outside the IT budget as well. In many ways, this trend effectively cedes the influence and control of CIOs and IT managers to others within their organizations. According to at least one bold estimate, shadow IT is set to make up 90% of all IT purchases by 2020.

    becoming faster and easier to acquire cloud resources that take longer to get with traditional IT processes. It’s therefore hard to hold back the growth of shadow IT. For example, a test engineer who needs some servers for performance testing. Or a product manager who needs some machines for internal training. Setting up a few AWS instances could take a matter of minutes – you just need a credit card. That seriously lowers the motivation to start requesting those resources from IT, explain why you need them, get approval, and then wait for manual allocation or completion of the purchasing process. As everything gets faster, online, and more automated, the line of business cannot afford to wait.

    Let’s examine the main uses of shadow IT to get a better understanding of what is happening.

    Uses Cases for Development and Testing

    Developers and test engineers are under huge pressure to be more agile. Even in organizations that we would never think of as “fast,” the pace changes rapidly. In heavier organizations that spent years establishing well-groomed IT processes, the dev/test consumer’s patience is running low. We are officially at a point where swiping a credit card and expensing an AWS instance has become easier than opening a ticket to request a virtual machine. As DevOps and automation cross borders and become mainstream, the need for speed makes Shadow IT thrive.

    Uses Cases for Sales Enablement

    Another line-of-business activity that’s implementing shadow IT involves the sales enablement process. This includes demos and proofs of concept, along with internal and external trainings, or customer support services.

    Until lately, most demos and proofs of concept were the responsibility of sales organizations, and such work was generally performed beyond the purview of IT. Now fewer companies are staging demos and proofs of concept at customer sites. They are adopting hosted data centers and web-based cloud services that customers and sales teams can access remotely through self-service.

    In recent years, many of these sales demos have been conducted at resellers and integrators, or by building a lab at a hosted data center where the infrastructure and software is housed.

    Uses Cases for Partner Enablement

    Shadow IT is also catching on for partner enablement to facilitate software development sandboxes, certifications, and testing of software-defined networks. Many industries depend on such product ecosystems for their long-term success. With software-defined infrastructure, the software can be easily integrated and controlled using outside tools.

    Most major hardware and software vendors are developing new partner labs. Members of the partner ecosystem can certify performance against the vendor’s equipment and interfaces without making big capital investments in the infrastructure themselves. Some examples include Cisco DevNet and Salesforce’s Force.com.

    Shadow IT Continues to Grow

    The organizations that adopt agility and DevOps are no longer the leanest and most cutting-edge. They can’t get away with a single Amazon instance. They need support for more complexity, more configurations and more context. They need to better mimic production, because more is at stake.

    As more lines-of-business in these organizations need to be faster, it’s becoming more challenging for IT to meet their needs with the Production IT toolbox – whether it is for development, testing, security certifications, demos or support.

    These kinds of use cases for shadow IT are on the rise, meaning shadow IT will continue to be a growth market for years to come. Whether or not shadow IT will consume 90% of all IT budgets remains to be seen, but it will definitely make up a significant portion of IT spending until production IT changes its approach.

    About the Author/Maya Ber Lerner

    image002Ber Lerner began her career with QualiSystems in 2007 and has steadily risen through the ranks in various roles starting as product manager, director of channel development, director of sales for APAC and Israel, senior director of international sales and, most recently, VP of sales, international. Ber Lerner holds a Bachelor’s degree with honors from Tel Aviv University in Biomedical Engineering.

  • DevOps, ITOps and PaaS: What do you think?

    DevOps, ITOps and PaaS: What do you think?

    We are very happy to announce that we have launched a new survey that will explore how the community feels about DevOps, ITOps and PaaS. The survey is another in the continuing surveys we are conducting to help all of us understand more about how DevOps is really influencing how development, Ops and IT are being changed.

    This survey is sponsored by Apcera, makers of the Apcera Hybrid Cloud OS. The survey is only about 19 questions and shouldn’t take more than 5 minutes. It is aimed at understanding if there is a difference in opinion of who is leading innovation and where are the roadblocks to that innovation in organizations. It also seeks to understand what are organizations are thinking about containers and specifically are different parts of the IT team looking at containers differently.  Finally, the survey tries to help us understand what are the attitudes towards PaaS.

    As we always do we will release the survey findings when complete. You are helping not only your own organization but the entire DevOps community if you would take a few minutes to take the survey right now we would be very grateful. If there is something you think we got wrong on the survey or left out, please let us know by commenting here.

    If you are interested in hearing more about Apcera and how it looks at containers and PaaS you should check out our Q & A with their CEO over on Container Journal.

    BTW stay tuned as next week we will release the results of our last survey, The Real Value of DevOps.

  • How to align your DevOps and Cloud Initiatives

    How to align your DevOps and Cloud Initiatives

    Infrastructure-as-Code (IaC) practices, which in turn are made possible through infrastructure or platform clouds (IaaS or PaaS), solve many important issues related to continuous delivery and DevOps. Therefore, the implementation of IaaS and PaaS in a private, hybrid or public cloud model should always be aligned with your DevOps initiative. In a previous article, I argued that OpenStack is the ideal habitat for DevOps. After all, OpenStack is backed by some of the biggest companies in software development and hosting, as well as thousands of individual community members. Indeed, many argue that OpenStack is the real future of cloud computing. However, that cloud environment might also be based on proprietary VMware technology, hybrid Amazon Web Services (AWS) or similar. Whichever you end up choosing, the cloud is an important enabler for companies looking for continuous delivery in agile environments.

    Why? Why is IaaS an ingredientfor a successful DevOps strategy? Through IaaS and ultimately PaaS, the bottleneck of infrastructure provisioning gets resolved; No more dependency on busy ops teams with long task backlogs and not enough of people, who are able to script and automate. Infrastructure provisioning is required to create all sorts of environments on-demand, including development, test and integration environments, all of which are required in different phases or steps within the continuous delivery chain or release pipeline. These environments can be created in isolation and dependencies from other projects, which are responsible for so many delays in a release, disappear.

    Test automation is critical for continuous delivery, but benefits are diminished if the provisioning of the necessary test environment takes days or weeks.

    Tips for DevOps-cloud alignment

    So we’ve made the case for the cloud as part of a DevOps strategy. How do you now go about aligning your DevOps and cloud initiatives together? What factors do you need to take into consideration as your developers instantly spin up environments at any time?

    First, start with IaaS. IaaS is easier to implement and more commonly applicable than PaaS. For quick wins, use public IaaS such as through AWS or Microsoft Azure. Get the necessary compliance and security aspects for dev or test environments settled and create a couple of deployment scripts on top of these services. Either prepare ready-backed images with middleware, application servers and databases or leave it to developers to install these components on their own. Alternatively ops can also prepare necessary install scripts and provide them to development.

    Second, build your own IaaS, based on OpenStack or other technologies. The toolsets and interfaces used by the agile development teams and the team responsible for the IaaS infrastructure need to be synchronized. For example, if you’re using OpenStack for the cloud environment, align your provisioning tools around that, possibly using Chef or Puppet. The good news is that many of these technologies really work together well.

    Third, once your IaaS implementation is mature and has been adopted, move towards PaaS. PaaS is the champion’s league in private cloud and usually requires an organization to commit to certain standards for databases, middleware, application servers, deployment architecture and more. It makes it super-easy and fast to provision not only a server, but really the complete runtime environment of an application and deploy the application on top of it.

    In all phases there needs to be tight collaboration between the departments. Your agile development, IT operations and infrastructure teams responsible for delivering the private cloud all need to be aligned around the common goal: delivering quality apps and updates to market more quickly. That means working as one to build a reliable, fast and adaptive cloud infrastructure in support of agile services delivery. It is imperative to understand and track individual development milestones. There’s no point in relying on the ‘big bang’ approach: the cloud infrastructure needs to be synchronized with all the development timelines.

    It has been proven particularly useful to use agile methods in structuring the infrastructure teams: Each platform gets a product owner, who works with development teams and manages all the requests developers have for the platform, i.e. the required APIs and their signatures or supported versions of specific technologies in a common backlog. This is done in the same way as product owners in development are managing their backlogs for the business.,

    Finally, make sure you have the right skills in place. DevOps and private cloud infrastructures command new skills sets—operations engineers, for instance—to prepare, manage and develop your private cloud and the application platform. There’s no point in buying in skills half way through the agile development process: they need to be built into the business plan from the start.

    DevOps,IaaS and PaaS go together like the PC and the keyboard; apps and the iPhone; Windows and Word. Together, DevOps within an IaaS infrastructure enables you to harness faster development and move to continuous delivery.

  • ARA tools can help you move apps easily to the cloud

    ARA tools can help you move apps easily to the cloud

    Chances are your organization has already moved some of its applications to the cloud. There, storage and computing capacity are provided as services, and everybody in your enterprise can access the apps and related data via the internet.

    As we all know, the cloud enables organizations to scale up or down quickly according to their needs, while giving them tremendous flexibility in maintaining their computing environment. One advantage for using the cloud is that it helps reduce time-to-market and removes the need for upfront investments in infrastructure.

    To help you simplify the process of moving apps, you should consider using an Application Release Automation (ARA) tool from a reputable vendor with experience in the cloud space.

    Moving to the Cloud Involves Research and Difficult Decisions

    The first decision is perhaps the hardest: determining which variant of the cloud is best for your apps and your organization. Private or public cloud? Factors you should consider are: data security, privacy, legal compliance, network latency, whether the organization has the in-house resources to create and maintain a private cloud, and which cloud flavor provides the best combination of flexibility, compliance and cost-effectiveness.

    Then, you have to weigh up the pros and cons of using the different cloud flavors, principally these:

    •       Software-as-a-Service (SaaS)

    •       Platform-as-a-Service (PaaS)

    •       Infrastructure-as-a-Service (IaaS)

    After the big decisions come the technical issues of how you are going to move your applications. Moving apps can be very difficult as many apps are complex and tied closely to the infrastructure landscape where they are deployed. Moving to a new landscape, such as the cloud, can be fraught with risks and challenges.

    What are ARA Tools?

    ARA tools focus on the modeling and deployment of custom application software releases and their associated configurations, often for Java Platform, Enterprise Edition (Java EE) and .NET applications. These tools, according to Gartner, offer versioning to enable best practices in moving related artifacts, applications, configurations and data together across the application life cycle. ARA tools support continuous release deployment. They often include workflow engines to assist in automating and tracking human activities.

    Core activities include:

    •            Packaging — creating a collection of multiple configuration items that must be deployed at the same time

    •            Dependency Mapping — modeling full application dependencies between components of the application

    •            Software Deployment — using package contents to install applications and configure their operating environments

    •            Promotion — delivery of tested packages to an environment of higher criticality

    •            Compliance — documenting adherence to processes and validating deployed application configurations

    At its simplest, an ARA tool helps developers to map application components and configurations to targets, such as binary code, connection configuration, database updates, queue definitions, and web service end-points. This helps to remove the coupling between the application and its host infrastructure.

    First Step in Using an ARA Tool to Move Apps to the Cloud

    Using a sophisticated ARA tool, you can install applications in a cloud environment automatically. Nearly all ARA tools will enable you to define the application in the tool, ideally specifying a package for each version of each application. Each package will contain all of the components to make an application run, as well as links to the environments where you want to deploy.

    If you use a model-based ARA tool, you will be able to eliminate much of your ‘how’ issues as the tool will automate most of the steps involved.

    Second Step

    Next, you must decide whether you want to move an app all at once or piecemeal. To err on the side of caution, you would be better off taking baby steps so you can learn and document as you go. Ideally, you might start by just moving some specific aspects such as static web content and front-end web servers. A model-based ARA tool will help you move forward quite effortlessly, whether your targets are in an on-premise or cloud environment.

    Interacting with your targets is easy, via SSH, WinRM, REST — in fact, you can choose pretty much any connection protocol. You won’t even need to define new workflows or steps for this, as the tool will take care of the changes and determine the new deployment plan. Of course, if you want to move the entire app to the cloud, ARA tools give you that option, too.

    In general, ARA tools will enable you and your team to move apps to the cloud quickly and safely, with full audit trails.

    Software deployment is often one of the sorest headache-inducing problems of moving operations to the cloud. However, if you use ARA tools, your problems should diminish if not disappear. Best of all: if you use a model-based ARA tool, you will be able to eliminate much of your ‘how’ issues as the tool will automate most of the steps involved.

    About the Author/Tom Batchelor

    Tom Batchelor_XebiaLabs engineerTom Batchelor is a sales engineer for XebiaLabs, a leading provider of automation software for DevOps and Continuous Delivery, helping companies to accelerate the delivery of new software.