Category: DevOps and Open Technologies

Editorial Calendar for February 2016

  • Using Open Source Languages Effectively in the Enterprise

    Using Open Source Languages Effectively in the Enterprise

    Open source languages are part of almost every business these days. In fact, according to Opensource.com, open source will be the driving force behind a great number of technology innovations due to its pervasive use. From development to quality assurance (QA) to DevOps, all kinds of coders have embraced open source languages. In doing so, though, enterprises have given up easier-to-adopt, general-purpose languages in favor of more niche-oriented languages.

    Those who are enthusiastic about open source languages have been contributing to open source language projects and building versions of languages including Perl, JavaScript, Go, Tcl, Ruby and Python. There has been a massive shift in the adoption of open source languages and genesis of new ones in the last 20 years. Even large corporations such as Microsoft, Google and IBM contribute to open source projects that are hosted on GitHub, and Spotify, Dropbox and Reddit are among the big names that use Python.

    This mainstream adoption speaks to the enormous popularity of open source languages. This has brought about the proliferation of new languages co-existing with older languages, which creates more and more challenges for various stakeholders in the software development life cycle (SDLC)—and more tension.

    The tension between these two groups exists because of the gap between their needs. Addressing this tension requires a convergence of the needs of two specific stakeholder groups: coders and the enterprises for which they work. There are ways to fulfill what both coders and enterprises need, create better experiences for coders and make things easier for all stakeholders in the SDLC.

    Enterprises require security, control and compliance. Coders need speed, want to create and crave a frictionless environment. Roadblocks and restrictions need to be removed for coders while ensuring the needs of the enterprise are being met.

    Strength in Uniformity

    What would it look like if you could gain all of the potential benefits of open source languages while still fulfilling coder needs and resolving your enterprise requirements? What if uniform tooling could be provided across open source languages? And what if enterprises could use a single uniform tooling set regardless of open source language? It would solve needs for the coder and the requirements of the enterprise.

    Using uniform tooling, an enterprise’s open source languages can be compiled and installed; dependencies found and installed; and code written, tested and updated complete with security and license compliance needs being addressed. However, tooling currently isn’t uniform across open source languages. And the maturity and best practices of tooling wildly vary. Enterprises create a workaround by creating policies to mitigate for deficiencies in tooling. This workaround is sub-par because it happens too late in the SDLC after threats and issues are introduced into your code.

    Establishing a Single Ecosystem

    The quality that makes open source so useful—its openness—and its lack of controls makes it something of a digital wild west. Fewer restrictions enable faster innovation, but they come at the cost of quality and cohesion for the enterprise. Many of your installed libraries have holes and security threats. Enterprises are faced with time-consuming license reviews to ensure adherence to third-party license rules as well as internal policies restricting certain types of licenses. In addition, license reviews happen at one point in your code’s life cycle versus in an ongoing, automated way. Enterprises are burdened with high administrative overhead and stale information.

    However, there is a different scenario possible. What would it look like for a company to have a uniform and high-standard ecosystem for their package management, with no vendor lock-in, all based on open source? What if a company could be guaranteed the same quality and types of packages for every language they use? What if a company could easily have visibility for what is being used across all of their environments, from concept to development to testing to production? It would be easier for the coder and fulfill the requirements of the enterprise.

    The wild west quality of open source language ecosystems makes them somewhat unreliable; updates and deletions can occur. And there are different package management solutions with differing degrees of sophistication, complexities and required expertise to use. Today an enterprise can easily end up with multiple package management solutions and have different packages of the same open source programming language. There is no single or consistent source of truth. 

    Working with a technology provider is an effective way to mitigate your open source language risks and solve your coder need for speed. A provider can offer more than just support, inlcuding:

    • The appropriate licenses based on usage and policy requirements
    • The right packages for each specific application
    • The best notification and remediation based on Common Vulnerabilities and Exposures (CVE) security threats
    • The indemnification that fits, based on usage
    • The expertise to build you the language distros you need based on usage, environment, security and compliance requirements and applications.
    • The right builds, standardized for all of your teams and ready to go out of the box

    Thriving in the Wild

    Sometimes, using the “right tools” for the job involves coders building many programming languages in an environment. The resulting “polyglot” situation creates benefits as well as challenges. Better products are made, and products are shipped faster, but it’s difficult to build a core competency in a particular programming language. And it’s impossible to centralize support and difficult maintenance requirements.

    What’s needed is a single, uniform tooling set that can work across multiple languages. This makes open source languages easier to use and implement in the enterprise, addressing the needs of developers as well as those of the enterprise. Working with an expert advisor will help you not just survive but thrive in the wild and woolly world of open source.

    — Bart Copeland

  • CloudBees Extends CI/CD Scope, Reach

    CloudBees Extends CI/CD Scope, Reach

    CloudBees, at its DevOps World | Jenkins World 2018 conference this week, unveiled a broad strategy to extend the reach and scope of continuous integration/continuous deployment (CI/CD) platforms based on the open source Jenkins software.

    Company CEO Sascha Labourey said CloudBees Suite will provide the equivalent of a customer relationship management (CRM) application for software delivery. That approach will not only accelerate application development processes, but also provide application stakeholders across the enterprise with more visibility into DevOps processes. For example, business executives are demanding more visibility into DevOps processes as the organization begins to appreciate how dependent it is on the timely delivery of software, Labourey said.

    Rather than buying isolated components of a CI/CD platform, the CloudBees suite provides a single pane of glass through which all the elements of the platform can be managed. That capability is critical because it enables an organization to start with one element of a CI/CD platform that, over time, can be expanded frictionlessly as the organization becomes more comfortable with DevOps processes.

    Labourey said it’s clear the CI/CD platform is the hub around which those DevOps process revolve. The CloudBees Suite includes CloudBees Core to unify the management and governance of pipelines, which includes limited availability of the Kube CD for extending the CloudBees platform to Kubernetes clusters. In fact, Labourey noted that Kubernetes is rapidly emerging as the foundational element of a federated approach to CI/CD in the age of microservices.

    CloudBees also announced an alliance through which Lenovo will provide IT organizations a turnkey set of servers running instances of CloudBees Core on the Red Hat OpenShift application development platform. As DevOps continues to evolve, Labourey said, organizations want to reduce the amount of time it takes their IT teams to deploy the infrastructure required for a modern application development platform.

    Another core element of CloudBees Suite is CloudBees DevOptics, a software-as-a-service (SaaS) application that provides visibility and insights into value streams and operations as well as continuous reports on the four key DevOps metrics. CloudBees DevOptics will provide the raw data the company will rely on to apply artificial intelligence (AI) in the form of machine and deep learning algorithms to the CloudBees CI/CD platform, Labourey said.

    The two remaining core modules of CloudBees Suite are CloudBees CodeShip, which enables organizations to jump start projects using a CI/CD as a Service offering, and CloudBees Jenkins Support, which provides users of the open source Jenkins platform full support. CloudBees is also making support for instances of Jenkins available as a standalone subscription service.

    It’s clear that CloudBees is trying to extend the reach of its widely employed CI/CD environment not only to new platforms, but also to new users. As digital business processes continue to proliferate across the enterprise, there is now a lot more at stake whenever an application development project is delayed. While such delays may be inevitable, the degree to which organizations might be surprised by those delays can be reduced sharply when everyone in the organization is operating on the same DevOps page.

    — Mike Vizard

  • Mirantis Modeling Tool Extends SDI Scope and Reach

    Mirantis Modeling Tool Extends SDI Scope and Reach

    Mirantis has added a modeling tool to its portfolio that enables users to allocate IT infrastructure that has been distributed across multiple data centers to a common set of workloads.

    Company CEO Adrian Ionel said the latest edition of the Mirantis Cloud Platform (MCP) for building provide clouds on OpenStack or Kubernetes platforms now includes a Mirantis Infrastructure Model Designer tool that makes it possible to manage IT infrastructure residing in multiple data centers as though they were one logical resource. In effect, slices of distributed data centers can be allocated to run specific classes of application workloads, he said.

    The Mirantis tool is based on open source software spanning Cookiecutter, Reclass and Salt projects that Mirantis is employing to enable users to apply management templates across multiple distributed data centers. The goal is to make it possible for IT organizations to employ a software-defined framework that makes it easier to not only manage distributed IT environments, but also change the configuration of those environments as the nature of application workloads change over time, Ionel said.

    The Mirantis modeling tool provides a declarative approach to managing software-defined infrastructure that doesn’t require IT operations teams to learn how to program, he added.

    Ionel said that as IT organizations invest in IT infrastructure, they need to deploy multiple classes of application workloads on the same systems. Each of those application workloads has distinctly different attributes and requirements. For example, a big data application running on Hadoop today has different infrastructure requirements than an analytics application infused with machine learning data that might be deployed tomorrow. That said, most IT organizations won’t be able to replace IT infrastructure as application workloads evolve, he said, noting the Mirantis tool provides a means to easily reconfigure IT infrastructure from a central location without requiring IT personnel to be present in each local data center.

    Virtualization of servers and now storage and networks is a concept that has now permeated data centers for decades. Mirantis is effectively taking that concept to its next logical conclusion by making it possible to maximize utilization of data centers. In fact, Ionel noted, templates can be configured to prioritize the running of different workloads on the same infrastructure.

    As software-defined infrastructure (SDI) continues to mature, it’s becoming apparent that data centers soon will be managed at much higher levels of abstractions than they typically are today. Instead of trying to navigate individual compute, storage and networking silos, IT organizations will be able to manage data center resources on demand. The implications of the level of automation go well beyond simply enabling IT organizations to be more agile—the entire organizational structure of IT organizations will need to evolve.

    Obviously, organizations that have embraced DevOps are further down than the SDI path than most. But as SDI continues to be able to automate IT infrastructure at levels of unprecedented scale, it’s clear there’s still a long road ahead in terms of how just how extended those DevOps processes can become.

    — Mike Vizard

  • Red Hat Takes Virtualization Aim at VMware

    Red Hat Takes Virtualization Aim at VMware

    Red Hat, as part of on going drive to wean enterprise IT organizations off proprietary virtualization technologies, today launched a set of Red Hat infrastructure migration tools and services.

    Joe Fernandes, vice president of cloud platforms products at Red Hat, said that as organizations move to modernize their application environments by lifting and shifting them to the cloud, they are simultaneously looking to take greater advantage of open source virtual machines and containers specifically as an alternative to VMware.

    The Red Hat initiative includes a consulting engagement as well as a pilot project that enables legacy application workloads to be deployed on kernel-based virtual machines (KVMs), an instance of OpenStack or the Red Hat OpenShift platform based on the open source Kubernetes container orchestration software. The core tool used to migrate those workloads is the Red Hat Ansible Automation, Fernandes said.

    As management software stack the company now provides on top of those foundations has matured, Red Hat is finding more customers willing to consider transitioning away from commercial virtualization software, he noted. At the same time, he added, wider adoption of KVM by cloud service providers (CSPs) is making open source technologies a much more attractive option to foster deployment of application workloads across a hybrid cloud computing environment without having to refactor them.

    Those two trends in combination, Fernandes said, are making it easier for Red Hat to make a case for organizations to move way from VMware.

    Red Hat may have lost the virtual machine wars to VMware early on, but it’s clear the company is gearing up for a new phase. Many organizations have adopted an open source-first philosophy that Red Hat clearly is trying to exploit at VMware’s expense. At the same time, rising interest in alternative approaches to virtualization in the form of Docker containers and Kubernetes is creating another wedge that Red Hat is looking to exploit. For example, the company is testing Kube-Virt, an open source project that makes it possible to run KMVs within a container. Red Hat has already signaled its intention to apply that technology to other hypervisors as well.

    It’s unclear to what degree containers and Kubernetes will be deployed on virtual machines and used in place of virtual machines altogether. Red Hat is prepared for either eventually, but Fernandes said virtual machines will continue to remain relevant in enterprise IT environments for many years to come. Reliance on container and virtual machines will come down to both the nature of the application workload and the relative cloud-native maturity of the organization deploying them, he said.

    It also remains to be seen the degree to which VMware can stave off a new virtualization challenge from Red Hat. VMware has allied with Amazon Web Services and IBM in the public cloud, while partnering with sister company Pivotal to embrace Kubernetes running on top of VMware. The issue, of course, will be how much enterprise IT organizations are willing to pay for commercial virtual machine licenses in support of the initiatives.

    — Mike Vizard

  • OpenStack and Open Source MANO: Technologies for NFV Deployment

    OpenStack and Open Source MANO: Technologies for NFV Deployment

    We have experienced how open source software technologies revolutionized the application development process, which ultimately resulted in digital transformation across various industry verticals. Open source technologies now are disrupting the telecom sector for building 5G internet, which will be powered by network functions virtualization (NFV) and software defined networking (SDN). With NFV and SDN, multiple network functions and control and management operations in telecom networks will be software-driven; enabling the cloud-native and DevOps approach.

    There are various communities emerged to innovate the software stack behind NFV and SDN technologies such as OpenStack, ONAP, ETSI Open Source MANO (OSM), OPNFV, OpenDaylight, Open Networking Foundation (ONF), Open Contrail, Open Baron, On.Lab, CORD, Kubernetes, ONOS and Open-O. In this article, we will take a look at how a combination of data center management platform management platform, OpenStack and ETSI Open Source MANO (OSM) will be useful for NFV deployment.

    OpenStack for NFV

    As we know, OpenStack is mainly known to be the largest pool of open source projects that collectively form the software platform for cloud computing infrastructure. This infrastructure is used widely in private cloud use cases by many enterprises. After an introduction of NFV by ETSI, OpenStack has emerged as a key infrastructure platform for NFV. In most of the NFV deployments, OpenStack is used at the VIM (virtual infrastructure manager) layer to give a standardized interface for managing, monitoring and assessing all resources within the NFV infrastructure.

    Various OpenStack projects (including Tacker, Neutron, Nova, Astara, Congress, Mistral and Senlin) are capable of managing virtualized infrastructure components of NFV environments. As an example, Tacker is utilized to build a generic VNF manager (VNFM) and NFV Orchestrator (NFVO), which help in the deployment and operation of VNFs within NFV infrastructure. Additionally, integrating OpenStack projects introduces various features to NFV infrastructure, including performance features such as huge pages, CPU Pinning, NUMA topology and SR-IOV; service function chaining, networking slicing, scalability, high availability, resiliency and multisite enablement.

    Telecom service providers and enterprises that have implemented their NFV environment with OpenStack include AT&T, China Mobile, SK Telecom, Ericsson, Deutsche Telekom, Comcast and Bloomberg.

    Open Source Mano (OSM) for NFV

    The management and orchestration (MANO) layer is responsible for orchestration and complete lifecycle management of hardware resources and virtual network functions (VNFs). In other words, the MANO layer coordinates NFV infrastructure (NFVI) resources and maps them efficiently to various VNFs. There are various options available as three-dimensional software stacks for MANO. But ETSI-hosted OSM is largely preferred due to large activity at the community level as well as its highly mature framework, production readiness, ease of initiation and constant feeding of use cases by members.

    Virtual network functions (VNFs) forms network services and may need updates for feature addition or patch for functionalities. OSM provides a method to invoke the VNF upgrade operation with minimal impact in the running network service.

    With the continuous community support and involvement for feature innovation, OSM has now evolved to bring a continuous integration and continuous delivery (CI/CD) framework at MANO layer.

    The latest release 4 of OSM has brought a large set of features and enhancements to the OSM framework, impacting functionality, user experience and maturity, which enables various enhancements for NFV MANO from usability and interoperability perspective.

    OSM has steadily adopted the cloud-native principles and can be easily deployed in the cloud, as installation is container-based and runs with the help of container orchestration engine. A new northbound interface aligns with ETSI NFV specification SOL005 and provides dedicated control of the OSM system. Monitoring and closed‐loop capabilities have also been enhanced.

    The next version of OSM release 5 is expected to be launched in November and will be bundled with more 5G-related features such as network slicing and container-based VNFs.

    Why OpenStack and Open Source MANO for MANO layer in NFV?

    Both OpenStack and OSM have a large community known for its rapid pace for innovating NFV and higher contribution by all scale companies to enhance current features and develop new capabilities for core projects under it.

    For NFV, OpenStack standardizes interfaces between NFV elements and infrastructure. OpenStack is used for commercial solutions offerings by companies including Canonical/Ubuntu, Cisco Systems, Ericsson, Huawei, IBM, Juniper, Mirantis, Red Hat, SUSE, VMware and Wind River. A large percentage of VIM deployments are based on OpenStack due to the simplicity in handling and operating various projects targeted toward providing full potential storage, compute and networking for NFV.

    With last two releases (3 & 4), OSM has evolved to support integration for cloud-native approach by enabling CI/CD frameworks into orchestration layers. Cloud readiness involvement of OSM is the key benefit along with OpenStack, which has proven architecture for private as well as public clouds. OSM deployment into NFV infrastructure has become very lean, where one can start with importing docker containers into production. On the other hand, OpenStack is known for enabling simplicity to manage virtualized and containerized infrastructure. Organizations can realize the full benefits out of integration as NFV MANO using OSM and OpenStack due to lean and simple management and deployment.

    Conclusion

    Since the introduction of NFV and SDN, telecom service providers and vendors were evaluating the use case offered for telecom networks, and due to this application of both, were in under maturity stage. Service providers and vendors were concerned about dynamic orchestration and automation of infrastructure deployment and constantly upgrading virtual network functions (VNFs). But due to contribution by open source communities such as OpenStack and Open Source MANO (OSM), they are now at the stage to apply cloud-native principles to 5G network implementation and operations. Furthermore, with contributions by communities to OpenStack and OSM projects, we will see more enhancement to 5G network enhancement technologies including network slicing, mobile edge computing (MEC) and cloud radio access network (cRAN), which will benefit emerging technologies including IoT, AI/machine learning, real-time analytics, augmented reality (AR) and virtual reality (VR) with low latency and high-bandwidth features.

    — Sagar Nangare

  • A Right DevOps Approach: Assess Organizational Readiness

    A Right DevOps Approach: Assess Organizational Readiness

    Driving business in this fast-paced world is maddening as owners have to remember customer preferences, beat market competition and similarly cater to different things within the organization’s radius.

    How a business owner manages all this defines the business success, which is gauged through outcomes in the form of smart products, point-on services and almost-immediate feedback. Bank applications, the best smartphones and interactive technology are all proof of this.

    But what is it that stands at the heart of it all?

    The Right DevOps Approach

    When enough is done and businesses still find that there’s a missing piece that will complete “the successful business picture,” they go back to figuring out what and how they can fix the problem. They never come to realize that they will have to consider revamping their organizational structure to meet the growing demands of their influential business.

    How, then, do you assess your approach to DevOps?

    While most believe that it’s a technological approach that they should incorporate in their business, it’s more of a cultural approach. To implement DevOps into your existing organizational structure, you first must look at its current state of readiness.

    Doing this is important, as it helps decision-makers understand how they can embed the smart collaboration after a thorough consideration of the challenges that stand in the way of DevOps implementation. Once the initial assessment is done, business owners need to ask themselves three questions before assessing DevOps readiness:

    1. Is there a Management-Employee Agreement? A successful DevOps process not only relies on collaboration between Development and Operations, but also needs a top-down (management-employee) agreement. Once that’s in place, the company is already halfway through the success road.
    2. Is there a Plan in Place? Many firms just barge into technology like it’s all they need to reach their finish line. Stop! Wait! Think! Owners need to have a detailed strategy, equipped with process tools and goals clearly outlined and best practices chalked out. Once this is done, the culturally different teams need to collaborate and work ways to learn and equip themselves with the technologies and practices of each other’s processes. With all this in place, organizations will be ready to take the DevOps jump.
    3. Is the Organization Ready to Tread the Ocean? Now that the plan is in place, what’s next? Organizations, as mentioned earlier, are in hot pursuit to experiment with what they’ve learnt new. Anything new is fancy, but humbleness is the key! Starting small will set the new cultural shift to completely settle in its new mold. To run the boat in big waters, you first need to test it in small water. Similarly, to test the success of DevOps for a big business project, you first want to test its adaptability to a smaller one. Once you’ve cut off from the harbor, you are all set to wade the ocean.

    Conclusion

    Most business players underestimate the ability of DevOps with whatever industry rumors they hear and some of their own pre-conceived notions. Some other think that they know it all, but what matters is having a strategic approach to first considering DevOps and its tools, and then adapting it accordingly.

    Once the DevOps automation is in place, organizations will be busy reaping the benefits of its successful implementation.

    — Veritis

  • How to Use the Jenkins Pipelines

    How to Use the Jenkins Pipelines

    With the introduction of the Pipeline, Jenkins added an embedded Groovy engine, making Groovy the scripting language in the Pipeline’s DSL.

    Here are the steps you need to take to set up a Jenkins Pipeline.

    1. First, log on to your Jenkins server and select “New Item” from the left panel:

    1. Next, enter a name for your pipeline and select “Pipeline” from the options. Click “Ok” to proceed to the next step:

    1. You can now start working your Pipeline script:

    The red box in the middle is where you can start writing your script.

    Creating the Jenkins Pipeline Script

    Pipelines has specific sentences or elements to define script sections, which follow the Groovy syntax.

    Node Blocks

    The first block to be defined is the “node”:

    A “node” is part of the Jenkins distributed mode architecture, where the workload can be delegated to multiple “agent” nodes.

    A “master” node handles all the tasks in your environment. Jenkins agent nodes offloads builds from the master node, thus performing all the pipeline work specified in the node block.  For more details, read about Jenkins Distributed builds.

    • This block is optional, and one could be considered as good practice, since with the code included in this block.
    • Jenkins will schedule and run all the steps once any node is available and creates a specific workspace directory.

    Stage Section in Jenkins Pipeline Build

    The “stage” section is required to segregate the work category as listed inline:

    A specified pipeline will consist of several steps that can be grouped in several stages. For example:

    Stage 1 Pull code from repository Pull Code CheckIn
    Stage 2 Build your project and artifacts Build Project/Artifacts of Project
    Stage 3 Deploy your application Deploy from centralized repo to specified environment
    Stage 4 Perform functional tests QA performance will happen
    Stage 5 Perform performance tests ·       (UI and performance can test.

    Note: Each of the these can include more than one action.

    For example, a stage to deploy your application can consist of copying the files to a defined environment for functional tests and to a dedicated server for performance tests/QA and once files are copied successfully, delivery process will start to deploy on any specified environment.

    Each stage block specifies the tasks to be performed:

    Stage blocks are also optional, but they are recommended because they provide an organized way of specifying tasks to be executed in the script.

    Pipeline Syntax

    This section builds on the information introduced in Getting started with Pipeline and should be treated solely as a reference. For more information on how to use Pipeline syntax in practical examples, refer to the Using a Jenkinsfile section of Jenkins chapter.

    • As of version 2.5 of the Pipeline plugin, Pipeline supports two discrete syntaxes, which are detailed below. For the pros and cons of each, see the Syntax Comparison.

    “Pipeline Syntax” to access the following page:


    “Generate Pipeline Script” will create the desired sentence that can be added to your script immediately.

    The Jenkinsfile

    Pipeline supports two syntaxes, Declarative (introduced in Pipeline 2.5) and Scripted Pipeline. Both of which support building continuous delivery pipelines. Both may be used to define a Pipeline in either the web UI or with a Jenkinsfile, though it’s generally considered a best practice to create a Jenkinsfile and check the file into the source control repository

    Jenkins Scripted Pipeline:

    • For more advanced usage with Scripted Pipeline, the example above node is a crucial first step, as it allocates an executor and workspace for the Pipeline. Since the Jenkinsfile is being pulled directly from source control, Pipeline provides a quick and easy way to access the right revision of the source code:

    The checkoutstep will checkout code from source control; scm is a special variable which instructs the checkout step to clone the specific revision which triggered this Pipeline run.

    Sandbox Security in Jenkins

    Jenkins limits the execution of any Groovy script by providing a sandbox. The option “Use Groovy Sandbox,” shown below, is available in the Pipeline tab, and it allows the scripts to be run by any user without requiring administrator privileges. In this case, the script is run only by using the internal accessible APIs (which allow you to develop your script by using Groovy).

    When unchecked, if the script has operations that require approval, an administrator will have to provide them. This method is known as “Script approval.” By default, all Jenkins pipelines run in a Groovy sandbox.

    If the option is checked and unauthorized operations are used, the script will fail when run. Both the whitelist and the blacklist of functions can be checked at Script Security’s built-in list.

    — Pramod Vishwakarma

  • Selecting the Right Service Virtualization Tool

    Selecting the Right Service Virtualization Tool

    Once you have established that implementing service virtualization (SV) as a means to remove the bottlenecks formed by critical yet hard-to-access dependencies in your test environments is the way to go forward, one important decision to make is which SV tools to use for the process. Most major testing solution vendors (including CA, Micro Focus, Parasoft, Tricentis and more) offer an SV tool as part of their product range. Next to that, smaller companies have emerged for which an SV tool is their primary offering (TrafficParrot, for example). Finally, similar to the test automation ecosystem, many open source offerings have seen the light of day, most notably including WireMock and Hoverfly.

    Similar to what has been going on in the test automation world for a while now, open source SV tools seem to have become the default choice for many development teams when looking for a solution that satisfies their SV needs. In this blog post, I’d like to take a closer look at the pros and cons of this bias toward open source products, as well as provide some tips on how to decide what type of tool works best for your organization and situation.

    Benefits of Open Source and Commercial Solutions

    There are several benefits associated with the use of open source service virtualization tools in general, and these benefits apply equally to SV tools:

    • There’s no risk of vendor lock-in when you’re using an open source tool.
    • There are no license costs associated with open source tools, whereas commercial off-the shelf (COTS) tools obviously do.
    • Open source tools can be extended with specific features in case you need them (and you’ve got the development skills to do so). With COTS tools, you can file a feature request with a vendor, but that’s no guarantee when your request will be addressed (and if it will be addressed at all).

    COTS solutions, on the other hand, have benefits of their own:

    • They come with a richer set of features out of the box, such as support for a wide variety of transport protocols and message formats, etc., whereas open source tools often focus on a specific protocol and/or message format.
    • They generally have a lower level of entry, for example because they offer graphical user interfaces that make them accessible for a larger audience, whereas open source tools may require you to write code or other forms of technical specifications to get them running.
    • Professional support, both online and in house, may be included in the license purchase price, whereas open source tools offer support on a best-effort basis only, most of the time.

    This is by no means a complete list of the pros of both types of tools. Also, some of the benefits mentioned here come with a caveat of their own. For example, the lower initial cost of open source tools (no need to buy a license) is often being made undone by the additional effort it might require to build simulations that are as powerful as those that can be created by commercially licensed tools out of the box. Always consider the total cost of ownership when you’re looking to implement an SV tool, and don’t forget that this TCO extends beyond licensing fees.

    One other important aspect to understand when comparing open source and commercial tools is that they’re typically sold to different audiences and therefore, their creators must appeal to these different audiences accordingly. Open source tools are generally adopted in a bottom-up manner: they’re downloaded and experimented with by a developer or development team and, when successful, might slowly be adopted by a larger audience within the organization. Commercial tools, on the other hand, are often sold to development managers or C-level executives instead, since they hold the budget that is needed to make the purchase of licenses possible. Note that this is a generalization, and it might not work this way in your organization, but in general, I feel the above holds true. (Footnote: I have to say thanks to Tom Akehurst, the creator of the open source SV tool WireMock, for pointing out this important distinction to me.)

    So, now that we’ve seen some of the benefits of both open source and COTS SV tools, I’d like to give you some advice on how to choose the right tool for your organization and situation.

    First of all, understand that no tool is inherently better than another one (even though some tool creators and vendors seem to think otherwise, judging by their promotional and social media outings). Tool A, however, might under certain circumstances be a better fit for a given situation compared to tools B, C and D. What tool works best for a given situation depends on many factors including, but definitely not limited to:

    • The extent to which the required transport protocols and message formats are supported out of the box (better support makes for easier implementation).
    • The level of experience with SV of the people that are going to wield the SV tool.
    • The complexity of the behavior that is to be simulated.

    When you’re looking for the best fit for your SV needs, it is wise to take into account a range of tools, both open source and commercially licensed. Don’t discard the latter category because of the seemingly high initial investment due to licensing costs. As I’ve pointed out before, it might just be that the ease of implementation and the richer set of features provided by a commercially licensed tool give you a return on investment that warrants the initial expense many times over. I’ve seen this happen in practice multiple times, and that’s the reason I now prefer to include a range of tools in my test automation and service virtualization training courses, rather than focusing on a specific tool. I sincerely believe there is no one-stop solution for every situation and I’d rather show people what’s available on the market and help them see what would be the best fit for their own organization than train them in a single solution (with the risk of giving them a hammer and making them see everything as a nail).

    Also, don’t simply go with the first tool promoted by a Google search or a friendly sales representative, as there’s a good chance that it might not be the most efficient choice for your specific situation. Take the time to select a tool carefully. Conduct a proof of concept (or more than one, ideally) that demonstrates the actual value that a tool can bring you, and that proves that a tool fits your development and testing requirements and is a good match for the skill set of your development team (or anybody that is to be made responsible for creating and maintaining the simulations). Consider hiring an independent expert that can help you make the right choice.

    The field of service virtualization has rapidly become mature in recent years, going through the same maturing process we’ve seen happen to test automation in the past. That means that it’s time to take the implementation of SV seriously as well. With software development becoming more distributed, more complex and delivery cycles becoming ever shorter, you can’t afford not to at least consider SV seriously if you want to be able to keep up.

    Hopefully, this blog post has given you valuable information that can help you choose the best SV tool for your situation, no matter if that’s an open source or a commercially licensed tool.

    — Bas Dijkstra

  • How Important Is Open Source for DevOps, Really?

    How Important Is Open Source for DevOps, Really?

    Depending on your perspective, you might believe that DevOps and open source go hand in hand. Or you may think that, quite to the contrary, the two have little to do with each other. There are good arguments to be made for both interpretations.

    Let’s explore these two ways of thinking about the relationship between DevOps and open source.

    Match Made in Heaven?

    In certain respects, the two share a great deal of core philosophical overlap. Both movements emphasize collaboration and rapid innovation.

    That is part of the reason why many major DevOps tools are open source. Examples include Kubernetes, Docker, Git and Jenkins, to name just a few.

    Indeed, it’s hard to imagine any modern DevOps team or CI/CD pipeline that doesn’t rely to a significant extent on open source tools.

    The Tension between DevOps and Open Source

    On the other hand, it’s an undeniable fact that many other tools and resources that are commonly used by DevOps professionals are decidedly not open source. There are plenty of closed-source CI servers and release automation platforms, for example. (There are also many tools in this category that are built on an open source codebase but require commercial licenses and proprietary extensions for real-world use.)

    There is also the public cloud, without which it’s hard to imagine anyone doing DevOps today. Most public cloud services are very proprietary in nature. Not only can you not inspect the source code behind services such as Azure Functions or EC2, but users also have no control over how those services operate. And porting a workload from one cloud to another can be a big challenge.

    In these respects, DevOps is far removed from open source.

    How They Really Intersect

    What to make, then, of the relationship between DevOps and open source? What does it mean that they share important cultural affinities on the one hand, yet DevOps teams hardly shy away from closed-source tools and resources?

    The most obvious conclusion, I think, is that DevOps teams are committed to openness, but they balance that priority with an equal commitment to getting results. In cases where production-quality open source tools exist, such as Kubernetes, most DevOps engineers will eagerly adopt them in place of closed-source alternatives.

    In some cases, however, closed-source solutions are superior. And sometimes proprietary solutions are the only type of solution available, as in the case of the cloud. There is no open source alternative to AWS, unless you build your own cloud, but that requires having infrastructure.

    Some DevOps teams may wish that they could achieve the results they need using only open source tools. But they can’t, and that’s why the relationship between the two can seem contradictory and inconsistent at times.

    — Chris Tozzi

  • Serverless: What You Need to Know

    Serverless: What You Need to Know

    There are clear benefits to serverless architecture, with many enterprises already making or planning to make this change. Like any paradigm shift however, the move to serverless carries both benefits and risks. Here’s what you need to know.

    AWS pioneered the serverless space with its release of AWS Lambda back in 2014, with the other major cloud providers following: Azure Functions as a service, Google Functions and IBM Cloud Functions (Apache Openwhisk). Later entrants in this space took the form of container-based, fully-managed serverless frameworks such as Kubeless.

    The Good, the Bad and the Use Cases

    Some of the most common serverless use cases today include building batch processing like image compression, cloud job automation, serving IoT devices from edge to the cloud and building single page applications (SPA).

    On one hand, cloud-hosted serverless functions eliminate the overhead associated with managing actual infrastructure and introduce significant operational cost savings through efficient utilization of the underlying infrastructure. This allows developers to develop in their own comfort zone, using their language of choice: Python, JavaScript and, depending on the platform, even Go, Java, C#, PHP or others.

    On the other hand, delegating the infrastructure control to the provider means that serverless introduces new set of operational blind spots and observability challenges. It also complicates the placement and management of deep security controls, when compared to container, virtual machine (VM) or even bare-metal workloads.

    Serverless is Not the Answer for Everything

    Whether building new applications or migrating existing ones, serverless runtimes have significant restrictions. Cloud-hosted functions-as-a-service restrict the runtime duration of a function, require a “warm-up” time for function invocation and don’t guarantee local state preservation across function invocations. This means that application logic that is purely time-bounded, involves short functional transformation of input into output and can handle a slow starting time would fit the serverless paradigm perfectly.

    Migrating state-oriented applications or stateful microservices into serverless functions is a different story. This will typically make use of a database—either managed or as a service—or make use of an application cache such as Redis or object store such as S3 to store state across requests.

    While cloud-hosted serverless removes the burden of patching and maintaining infrastructure, the ephemeral nature of functions makes it extremely challenging when it comes to establishing perimeters and controls around sensitive data in flight and at rest.

    Build, Ship and Run Serverless

    Serverless, as young as it may be, is extremely promising. Adoption choices should be balanced around platform maturity for developers, testing, operations and what security and regulations require.

    If we take as an example what Docker did for container packaging, with its Container Image format, this is exactly what functions and serverless need: a common language for packaging. A common tool for building, shipping, running, operating and securing function-based workloads would serve as common ground for the variety of platforms already out there.

    From a security perspective, unification around secret consumption, service-to-service authentication and authorization between first and third parties, function workflows and access whitelisting, observability, security network monitoring, access policies to the network and access policies to data—all these would lower the friction of adoption.

    The Cloud Native Computing Foundation recently released version 0.1 of Cloud Events, the communication message format for function and event triggering. This emphasizes how far serverless is yet from maturity and cohesive standards.

    From a security perspective, Type A serverless workload protection systems must be able to inspect the serverless workload runtime. Type B workload protection systems are limited to what the serverless platform provider APIs make available for out-of-band data-oriented security analysis.

    Cloud-hosted functions makes Type A protection challenging to achieve, whereas fully managed serverless frameworks (for example, Kubeless), enables enterprises to adopt serverless and open the door for new developer experience. These also accelerate innovation velocity and, with security tools designed for microservices and modern virtualization technologies, can maintain full visibility and runtime control over network and data.

    Securing Functions as a Service: A New Arsenal of Security Tools

    Functions, just like any other web-based microservice implemented using containers, VMs or bare-metal server, are not free from the well-known top 10 OWASP web application vulnerability list.

    Functions, however, strongly rely on non-web, event-based communications and event-based networking channels. These, on public cloud providers, prevent inserting security controls to detect exploitation attempts or data exfiltration and enforce well-defined workload policies. This requires new arsenal of security tools that understand microservices, scale horizontally and coexist with the existing security operations and security stack.

    The ephemeral nature of functions-based workloads makes them more difficult to exploit, and it is definitely harder to persist a threat. Yet third-party code vulnerability or open source components gone bad can result in sensitive data flowing into the wrong hands, landing in a misconfigured object store.

    As serverless requires persistent data storage in external services, a scenario in which circumventing a running function to leak secrets makes that sensitive data one hop away from an attacker is not unrealistic.

    Controlling it all together: What private information can be processed, what sensitive data is in flight and through which event grid channels it’s being received and sent, along with how functions are invoked by API gateways and which API calls which functions make to internal and external services. This is where risk, regulation and modernization collide.

    Bottom Line

    Despite significant adoption and constantly growing interest, serverless is still in its infancy. When it comes to standards, operations, testing and orchestration tooling, workflows and  security, a flood of water must yet pass under the innovation bridge of cloud providers, with AWS Lambda leading the adoption curve, Azure FaaS making giant innovative leaps forward and community-driven frameworks built on top of Kubernetes.

    Innovation aside, serverless creates huge operational and security blind spots. Understanding those risks and having proper introspection and inspection capabilities is what should dictate the adoption and the choice of the platform.

    — Gadi Naor