Category: Features

  • A Certifiable Reason to Attend Training at DevOps World | Jenkins World 2018

    A Certifiable Reason to Attend Training at DevOps World | Jenkins World 2018

    There are many factors that make DevOps World | Jenkins World the essential DevOps event to attend each year. Whether it is the keynotes and speaker sessions from industry-leading DevOps experts, the expo where you can check out the latest and greatest from our friends in the software industry or the themed after-party, there are many reasons why year over year the conference grows. An added benefit that contributes to DevOps World | Jenkins World being the DevOps event of the year is the wealth of informative preconference training and certification. Think of them as the workout before the big game, providing you the tools and knowledge to make the most of the conference and beyond.

    The growth of attendance and variety of attendees of  the DevOps World | Jenkins World conference is one of the indicators that the industry is constantly innovating and evolving. Last year, Forrester declared 2018 as the “Year of DevOps,” with 50 percent of survey respondents reporting they had already implemented DevOps with plans to expand. For DevOps practitioners to keep up with the continuous pace of modern software development, there also has to be continuous learning. Training and certification at DevOps World | Jenkins World will cover relevant topics in software development, such as authorization and security, build management, instance administration and interfacing with cloud services, in addition to Jenkins and CloudBees Core fundamentals.

    Not only are all training sessions available to add on to your full conference sessions pass, but you also can receive a free Jenkins certification exam voucher—a $150 value—for the Certified Jenkins Engineer (CJE) and Certified CloudBees Jenkins Platform Engineer (CCJPE) exams. You can choose to sign up for an onsite exam at DevOps World | Jenkins World (first-come, first-serve) or use it at a later date. There are also several half-, one- and two-day courses that can be added during the event registration process.

    In addition to our recommendations below, check out the Training and Certification page to see what courses can help strengthen your software delivery pipeline skills.

    DevOps Leader Certification Training

    Successful implementation of DevOps requires leadership. Whether you are in a  tactical or strategic role, if you help design, influence, implement or motivate the cultural transformation in DevOps adoption, this course will take your DevOps leadership to the next level.

    Value Stream Mapping for DevOps

    If you’re looking to better understand DevOps, you are in the right place! Join Mike Orzen, a recognized and prominent Lean thought leader and author, to learn the ins and outs of DevOps value stream mapping, helping you identify inefficiencies in your current process, and optimize it to deliver more value to your customers.

    Jenkins Fundamentals

    It wouldn’t be Jenkins World without Jenkins! To prepare yourself for both the Certified Jenkins Engineer (CJE) or Certified CloudBees Jenkins Platform Engineer (CCJPE) certifications, Jenkins Fundamentals introduces you to the best practices for leveraging Jenkins to drive your continuous development life cycle with Jenkins.

    CloudBees Core Fundamentals

    As the foundation of CloudBees, once you’ve mastered Jenkins Fundamentals, CloudBees Core Fundamentals is the obvious next step. In this training, attendees will gain the skills needed to leverage the CloudBees Core product suite to successfully scale CD and DevOps in their organizations. The training includes an overview of the key proprietary features provided with CloudBees Core to enhance the capabilities of Jenkins.

    CloudBees Core on Kubernetes

    Kubernetes is seeing widespread adoption as the operating system for cloud native applications and the industry’s go-to container orchestration system. This course will provide attendees with the tools needs to run CloudBees Core on Kubernetes, and leverage public and private clouds to establish an elastic, scalable CD and DevOps platform. The course includes hands-on installation of CloudBees Core on Kubernetes. 

    Go to https://www.cloudbees.com/devops-world to learn more and to register. Additionally, use this special code just for DevOps.com readers—JWDEVOPSCUST—at registration, and you’ll get a 20 percent discount.

    — Brian Dawson

  • DevOps World | Jenkins World 2018: Q&A with CloudBees CEO Sacha Labourey

    DevOps World | Jenkins World 2018: Q&A with CloudBees CEO Sacha Labourey

    Jenkins World has come to hold a regular spot on the calendars of the software development community. As the conference, and the industry, have grown over the years, the event has transformed—which is aptly the theme for this year’s event—into DevOps World | Jenkins World. CloudBees, the premier sponsor, also extended it for DevOps practitioners in Europe—specifically to Nice, France.

    In this Q&A, CloudBees CEO Sacha Labourey talks about the changes to this year’s conference and offers attendees a sneak preview.

    Gilmore: Why is Jenkins World changing its name to DevOps World?

    Sacha Labourey: Our goal with the change to DevOps World, was to scale the topics covered to create an event where people can meet and learn from each other and enhance their knowledge of not only Jenkins but the entire DevOps landscape. Although Jenkins remains a very important focus of the event, with the tremendous growth in DevOps adoption we wanted to expand Jenkins World to include a breadth of industry topics, such as cloud native, DevSecOps, software value streams and the more practical DevOps adoption use cases.

    Not only is the DevOps World | Jenkins World conference bringing together the best of both DevOps and Jenkins, but we’ve extended all of the learning opportunities for IT practitioners across the globe by introducing our first conference in Europe—in Nice, France, in October. Similar to what we’ve created in San Francisco, we’re hoping the event provides many opportunities for attendees to learn, network and explore in order to optimize their DevOps initiatives.

    Gilmore: What can attendees expect from this year’s event?

    Labourey: With the new name and additional location, attendees will get even more out of DevOps World | Jenkins World 2018. We’ll be hosting more than 70 sessions at the San Francisco conference and more than 50 in Nice, covering a variety of DevOps and Jenkins topics from security, pipeline automation, containers, DevOps adoption and continuous delivery best practices. Additionally, the workshops and training that precede the conference offer attendees the opportunity to get certified as a DevOps practitioner or Jenkins Certified Engineer, deploy applications to a Kubernetes cluster, learn how to get the most out of Jenkins Pipeline and also do a deep dive into what’s coming with Jenkins X.

    We have some amazing keynotes lined up for both conferences. Kohsuke Kawaguchi, CTO at CloudBees and Jenkins founder, will provide an update on the latest and greatest of Jenkins which is always cool to hear. Dr. Nicole Forsgren, CEO and chief scientist at DORA, will take the stage in San Francisco, sharing her insights into the key leadership, technical, architectural and product capabilities that drive positive outcomes based on the “2018 State of DevOps Report.” In Nice, you can catch James Governor, analyst and co-founder of RedMonk, who will be discussing why he’s devoted to putting developers first. Christina Noren, chief product officer at CloudBees, and I will also be keynoting in both locations.

    Here’s a glimpse of some of the conference sessions on the agenda:

    • Measuring and Quantifying DevOps Outcomes
      Panel discussion led by Chris Condo, Forrester
    • Mission Possible: Eliminating DevOps Security Roadblocks
      Jason Vanderhoof, CyberArk
    • Managing Hundreds of Jenkins Instances at the Eclipse Foundation
      Mikaël Barbero, Eclipse Foundation
    • Delivering Enterprise Architectures: Perspectives from Duke Energy and Wolters Kluwer
      Dwayne Culbertson, Duke Energy
      Harris Kirk, Wolters Kluwer
    • The Build That Cried Broken: Building Trust in Your Continuous Integration Tests
      Angie Jones, Twitter

    Gilmore: What are you looking forward to the most about DevOps World?

    Sacha Labourey: Jenkins World, and now DevOps World, is always the highlight of the year for me. I am excited to meet and learn from so many innovators in the DevOps industry and amongst the CloudBees’ partner ecosystem. The process of software delivery is in an era of rapid growth and tremendous innovation. In the last year, we’ve seen the rise of Kubernetes, more and more a desire for actionable metrics to measure the DevOps initiatives that have been adopted, and DevSecOps is coming on stronger than ever. This has inspired us to create expanded learning opportunities at DevOps World | Jenkins World 2018 that reflect the interests of people within the industry so that we can continue to foster learning and the advancement of software delivery. I’m thrilled to see this come to life every year—and proud that CloudBees and our sponsors make it all happen.

    I’m especially looking forward to hearing some of the cloud native sessions, since that’s a newer topic this year. We also have put together several DevOps experience panels from real-world practitioners who will be sharing their successes in the field—and maybe even more importantly, their failures. We learn the most from failure and sharing those experiences can help others avoid doing the same things.

    With two events this year, it means the DevOps World | Jenkins World fun will extend further into the fall! I hope DevOps.com readers will join us in San Francisco or Nice. If they do, they can get 20 percent off their registration using the DevOps.com special code: JWDEVOPSCUST

    — Heidi Gilmore

  • DevOps Abandonment: Reasons Not to Give Up

    DevOps Abandonment: Reasons Not to Give Up

    The Never-Ending Story

    When a new process or methodology comes along—particularly when one gets a lot of attention like DevOps has—there always will be failures. I’m not talking about those always-present group of people who say they’ve seen this cycle before and, thus, it is just a fad; I’m talking about actual implementers who, in the end, come up empty-handed.

    DevOps is no exception. In fact, because it radically changes much about IT, it probably has a higher rate of this problem than most new methodologies.

    The end result is easy enough to identify: Either an organization abandons DevOps altogether or shunts it off into that area where other processes and technologies have been implemented by only one team and eventually die.

    Problem Children

    In almost every case of DevOps failure, people are the problem. That is not to say people purposely undermine the system, but IT is built, managed and run by people. And the breadth of people in an organization has immense influence on the success or failure of DevOps (or any other IT initiative).

    With that said, let’s look at some problems that contribute to DevOps abandonment organizations should avoid in their attempts to evaluate/implement DevOps.

    Team Isolation

    It is a standard enterprise reaction to split off a team to look at a new technology/process and isolate them from the rest of IT. I was the first hire in a “New IT” at an organization—it was weird to have rooms of cubicles filled with people I was not allowed to talk to. One of several keys to success in DevOps is communication, and no application or application portfolio works in a vacuum. The need to discuss server space, security, routing and a host of other topics with core IT means isolation will not work. It is one thing to clear the pilot team’s workload to allow them to focus on assessing DevOps for the organization, but it is quite another to isolate them (functionally, geographically, whatever). If they find some quick-hit streamlining opportunities in standard operations, don’t you want those shared with the wider IT department?

    Getting the Tools Side Right, but Missing the Culture Side

    I make no secret about the fact that I’m a bigger fan of the automation side of DevOps than the culture side. But sooner or later, all the whiz-bang tools are deployed, and culture becomes the main focus. That includes not only communications between different parts of the DevOps team, but also the “can jump in and do” mentality that is more prevalent in DevOps than in a more divided IT environment. Getting the culture and communications down early is important for success. And success is important for wider gains in IT’s ability to meet the demands of the business.

    Adding to the Workload of Overloaded Team Members

    This is perhaps the most common pitfall that causes organizations to leave DevOps or minimize their exposure to DevOps practices. DevOps holds the promise of increased productivity and decreased backlog. But it is a promise. Implementing tools and forging new relationships and new paths of communication … these things take time. And that time is added to existing workloads, unless steps are taken to lighten existing workloads.

    The team working 10 to 12 hours a day just keeping the lights on will not side-track into anything that requires a definite investment of more man-hours unless it is mandated to them by the business. Asking them to start working on it is a recipe for failure; the best you can hope for is some automation that makes their life easier in some other way.

    Not Managing/Meeting the Expectations of Various Leaders

    What line of business (LoB) leaders and the CIO expect out of DevOps are different things. While vaguely similar—increased responsiveness to business needs is normally 100 percent shared—the details show different concerns.

    It is up to the CIO to manage what those under him in IT expect/demand from DevOps, and what those peers in the line of business expect from it. There is no reduction in commitment from LoB teams—indeed, one could argue there is an increase, as IT is no longer the bottleneck. And, perhaps most importantly for some organizations, DevOps doesn’t make IT mind readers any more than previous new methodologies did. The LoB still must define what is needed and get requirements into IT.

    Trying or Retrying DevOps? A Few Tips

    Pilot

    Run a pilot project. Lighten the load of the project team so members can focus on DevOps and bring its value into the team. Do not isolate them in any way. Including other teams by asking for help/ideas should be encouraged. In fact, if the pilot team is motivated and enjoying the pilot, this type of interaction can help smooth the way for extension of DevOps to the wider organization.

    Use Existing Resources/Management

    Don’t bring in specialists to do DevOps. DevOps can be learned, and there are a ton of resources available, so use people who know your environment and can apply standardized tools and practices to it. That includes management. The last thing an organization should have in a pilot is a manager that knows DevOps but not the relationships within and special quirks of your organization—both technical and social.

    Pick Your Pilot Carefully

    Pilot a project that is relatively small but is visible to the organization. Actively manage expectations, and see where DevOps takes you.

    Rethink Everything

    Empower the team to look critically at every single process/workflow and see where the most gain can be had. DevOps is not a switch; prioritizing high-value/important items for change in this iteration and lower-value items for future iterations is part of the process. But if you don’t look at everything, you can’t guarantee you’re getting the most bang for your buck on this—or any—iteration.

    Clearly Communicate Goals/Changes

    Make sure everyone in IT and out understands what the pilot is testing. Is it increased time to market? Is it ability to apply tools and processes to intractable sub-projects? Is it a test of the benefits touted by talking heads? Communicate what you are measuring and how you’re measuring it. If possible, share a dashboard showing those measurements with everyone who cares to follow along.

    This Time is Different

    DevOps is different from any other new methodology that has gained traction for the operations side. Ever. I’d say it was different than any other new methodology at all, but Agile is the precursor to DevOps on the Dev side, and they share a lot. It challenges decades-old thoughts on the best way to do things. It will fail sometimes, for a variety of reasons. Give it the best chance for success that you can, don’t tie the pilot team’s hands and use it where it succeeds, even if it doesn’t include every project in the portfolio.

    In the end, if it really does help the business succeed, then—like it or not—it is the right tool for the job.

    — Don Macvittie

  • DevOps TV: DOES18 London Video Panel Roundup

    DevOps TV: DOES18 London Video Panel Roundup

    The DevOps Enterprise Summit is one of my favorite places to connect with the world’s best technologists and DevOps practitioners. It’s the perfect forum for insightful conversations, valuable networking and immersive learning—and the comraderie is unmatched. For me, it’s always a pleasure to catch up with my great friends in DevOps and get an insider’s perspective from the leaders who are driving the industry and practices forward.

    This past June, DevOps Enterprise Summit London (DOES18) did not disappoint. We experienced firsthand some of the most iconic business transformation stories in DevOps. We also heard from the best technologists in the business. The programming committee introduced new themes and brought in fresh perspectives that reach beyond Dev and Ops. We got to see how the technology value stream influences the entire business from the standpoint of those impacted the most.

    Once again, DevOps.com partnered with IT Revolution and DOES18 organizers for in-depth video panel conversations with the speakers and thought leaders. Next-generation ops and infrastructure, spanning the divide between tech and business, DevSecOps and experience reports were all topics of conversation at this year’s show. We talked about challenges, opportunities and what the future is going to look like for DevOps. Here are the highlights from the videos we shared on DevOps TV.

    Where are They Now?

    One of the things I look forward to most at DevOps Enterprise Summit (DOES) is reconnecting with leaders who have shared their DevOps journeys and experiences from the early days. These companies can act as the compass for those that are just starting IT transformation journeys. At DOES, we learn where these industry pioneers are headed, the ups, the downs and what they are working on/need help with next. For example, we continued the conversation with Jonathan Fletcher at Hiscox, whose DevOps journey has been incredible to follow. The Verizon team, who presented on Day, 2 sat down with me and talked about the long lasting effects their DevOps transformation has had on such an extremely large and already successful company. Last, but not least, representatives Capital One chronicled their DevOps transformation journey and their march toward high performing teams across the organization.

    DevOps Right Now

    If you want the scoop on where DevOps stands today, DOES is the place to be. I enjoyed the conversation I had with DevOps thought leader and author, Mirco Hering, who shared invaluable knowledge on the current state of DevOps. We also sat down with Ilkka Turunen, Zane Lackey and Margo Cronin to take a deep dive into one of today’s hottest topics: DevSecOps. Examining value streams of high performing companies was also top of mind and it was interesting to hear how adjusting that value depended on the changing needs of the customer. Nicole Bryan, Carmen DeArdo, Dominica DeGrandis, Mik Kersten and I had an insightful discussion about this topic.

    ITSM and DevOps Can Be Friends

    Whether you were a skeptic of ITSM or DevOps in the early years, it’s likely you didn’t predict that they would be compatible. We had a great conversation with the fantastic Jayne Groll, Rob England and Dr. Cherry Vu around ITSM, ITIL and DevOps—and how DevOps and ITSM can actually complement each other.

    Next Gen Operations and Infrastructure

    Gene Kim and the programming committee worked hard to make next-generation ops and infrastructure a big theme at this year’s conference by seeking some of the sharpest talents in this arena. We had the amazing opportunity to interview John Willis, Damon Edwards and Cornelia Davis to talk about where ops is headed.

    Spanning the Tech and Business Divide

    As I mentioned earlier, DOES18 examines how the technology value stream goes far beyond just Dev and Ops. We looked at its impact on HR, project management and more—and how DevOps applies to leadership these other areas of the organization. I had the pleasure of sitting down with Fin Goulding, Jelena Laketic and Mark Schwartz to discuss the role that IT leaders should play in a successful DevOps transformation and what things are of value when injecting high performance into a company. I also reflected on the different business organization strategies used to turn normal companies into high performers and common problems that can be overcome on that journey with Jon Smart, Morag McCall and Tom Clark.

    Competitiveness and DevOps

    If your organization isn’t constantly adapting to out compete the competition, regardless of whether you are practicing DevOps, you may have already lost. Jennifer Wood and Chris Hill stopped by to discuss the need for companies struggling to compete in their industries to adopt DevOps practices. We also got to get a glimpse into their own company’s transformation efforts as well. One industry in particular that is facing disruption is financial services. I was lucky enough to sit down with two high-profile finance based IT leaders, Shaun Norris and Nick Funnel, to engage in a discussion on the evolution of DevOps in their industry and the direction of DevOps in the future as technology continues to evolve for finance.

    Las Vegas is Around the Corner

    There are plenty more videos to check out on DevOps TV from DOES18 London and recordings of the onstage presentations at the conference as well. You can also view the PowerPoint slides here.

    I look forward to connecting with all my DevOps friends again at DOES18 USA in Las Vegas this October!

    — Alan Shimel

  • Hardware in the Age of Automation

    Hardware in the Age of Automation

    There’s a joke making its way around the internet that goes like this:

    Q: How do DevOps engineers change a lightbulb?
    A: They don’t. It’s a hardware problem.

    The trend to abstract hardware away from the day-to-day work of most IT personnel continues. We in DevOps have given it a name: infrastructure as code. Hardware has been pushed so far back into the recesses of IT that I’ll wager good money to say that today most folks working in information technology have never seen the inside of a data center, and fewer have done something as labor-intensive as run cable wire over a rack of servers. For many, hardware is but a concept that’s made real every month by a bill from Amazon, Azure or Google Cloud.

    But hardware is real and it does matter, a lot. If you don’t think so, look at your cellphone. That little piece of hardware had changed just about everything about how the world works today. The cellphone has made possible not only Tinder, Twitter, Instagram, Uber, Lyft and a multitude of startups that will never see an IPO or private equity buyout, but it also has brought earth-shaking events such as the Arab Spring, Brexit and SpaceX landings into the palms of viewers worldwide.

    Hardware counts and it’s going to count more in the coming years. Those working on the forefront of innovation understand that special hardware is, and will continue to be, a critical factor in the development of increasingly complex software. We’re already seeing the ability to choose specific hardware configurations available on cloud providers such as AWS. For example, the g3.16xlarge EC2 instance type is backed by both CPU and GPU chips. This is only the tip of the iceberg.

    According to Jacob Smith, senior vice president at Packet:

    “People ask what’s next. Well, this stuff [GPUs] is an example of what’s next. It’s not just really expensive stuff, but really specialized stuff. Whenever you start to do something that’s really big and really important, which are a lot of the things we’re doing on the internet and in the world, whether it’s bioinformatics or cars driving themselves, those require really big workloads. There’s a lot of data, a lot of processing and you just can’t do it with generic hardware. The reason that hardware is the next innovation layer is because of all the software you guys have been writing to make software portable and deployable around the world in minutes, now the software wants to touch on the new kinds of hardware. And I think that embracing this is the next wave.”

    Packet, and companies like it, are looking forward to a time when computing platforms will move beyond the generic to the specialized. We’re already seeing the trend play out: The value of the stock of Nvidia, a major GPU manufacturer, has gone up 10x in the last three years. (See Figure 1.)

    Nvidia stock has grown 10x in value in over the last three years. (The Wall Street Journal)

    Also, the projected demand for specialized chips is attracting a lot of venture capital (VC) money that’s funding startups such as Cerebras, Wave Computing and Graphcore. Even Google is getting into the specialized hardware business with Tensor Processing Units (TPU). Hardware is indeed becoming very cool again.

    So, what does all of this have to do with automation?

    Automation is a processor-intensive undertaking. And, as AI weaves itself more into the fabric of day-to-day data processing and machine learning, we’re going to see more demand for specialized hardware to handle the activity. In a way, that’s not new; we’ve had specialized hardware for a while now. TV remote controls have been around well before Bluetooth came on the scene. What is new is the degree of intelligence at play in these new devices. All my old-style TV remote control had to do was change the channel when I clicked the button. Today, my remote control recognizes my voice and helps me find a show of interest. It’s a big leap from an operation that responds to a button-click to one that uses voice recognition and inferential lookups.

    As Packet’s Smith pointed out above, as the complexity of software grows, so, too, will the need for special hardware to drive it. The new trend will be to wrap hardware around software. Thus, I have no trouble imagining a new type of hardware that is designed to handle a very particular process—gene editing, for example. Imagine ingesting a pill that is really a nanodevice that contains the intelligence to travel your body and physically alter your genetic makeup. It’s not that far-fetched an idea. Making the idea a reality isn’t so much about the software, it’s the hardware. We don’t have the nanotechnology—yet. Hence, the opportunity.

    Right now, most automation activity is run on generic chips housed in remote data centers around the world. A lot of the work we’re doing is still commodity: Spinning up Kubernetes clusters, facial recognition under Tensorflow, discovering security vulnerabilities using Macie, for example. Yet, as artificial intelligence (AI) becomes more commonplace, the use cases for which AI is appropriate will grow. This growth will require new types of specialized hardware. Engineers will imagine the software and then design the hardware to make it run. We’ll come to a point, which is not that far away, where innovation will be as Smith describes. It will indeed be about wrapping hardware around software. As a result, we’ll go from the “Internet of Things” to the “Internet of Really, Really Smart Things, from the Microscopic to the Gargantuan.” The implications will be profound.

    — Bob Reselman

  • The Software Testing Metrics That Make Or Break DevOps Success

    The Software Testing Metrics That Make Or Break DevOps Success

    Organizations today are racing to develop software at a breakneck pace through efficient DevOps processes. But it’s important for them to avoid losing sight of the forest for the trees. If too much of that speed comes with quality sacrifices that degrade the user experience, the rapid software iterations hurt the business more than they help it.

    “Organizations adopt DevOps to accelerate the delivery of innovative software that creates positive user experiences,” said Clark Golestani, former CIO at pharmaceuticals giant Merck and current managing director of C Sensei Group. “If you start accelerating delivery without also rethinking your approach to quality, you will end up rapidly delivering updates that drive your customers to competitors.”

    This is why continuous and automated testing is so essential to DevOps success. But instituting effective and streamlined testing is easier said than done. Organizations must continually tweak what, how and when they test their software to achieve the optimal test coverage while introducing as little friction as possible into the software delivery pipeline. It’s a delicate balance, and the only way to achieve it is to keep meticulous track of metrics that evaluate how well the testing process is improving quality throughout the development life cycle.

    “As the saying goes, ‘You can’t manage what you don’t measure,’” said Andrew Magarie, senior market impact consultant at Forrester Consulting. “So firms need to be able to define and track the right metrics that can help enable quality at speed while minimizing risk.”

    Magarie and his team at Forrester recently conducted research into 94 different quality metrics frequently measured by DevOps organizations across four development stages: build, functional validation, integration and end-to-end regression testing. The study showed that the most effective test metrics that bubbled up across all of stages tended to clump into at least one of three categories.

    Risk-Focused Metrics

    According to Magarie’s report, the most mature and effective organizations fundamentally chose testing metrics that best helped them understand business risk posed by the software throughout the development process.

    “For this study, we use the following definition of business risk: Any application shortcoming that impairs the end user’s (or customer’s) expected experience and ultimately erodes confidence in the business,” he explained.

    For example, during the build stage mature organizations consider measuring the number of automated tests prioritized by risk as one of the most important assessments.

    “Tracking ‘unit’ tests prioritized by risk is the key. As the code base evolves, developers and testers need immediate feedback about change impact. This feedback is significantly more actionable if prioritized by level of risk,” wrote Magarie.

    As he explained, business risk will be different for every application, and the complexity of an organization’s architecture and transaction dependencies adds more variables to the equation. However, organizations need to seek ways to measure ‘relative risk’ across the software development life cycle (SDLC) if they truly want to take a disciplined approach to incrementally improving quality in their software.

    Contextual Metrics

    Forrester found that simple “counting” metrics don’t offer QA nearly as much value as contextual metrics. So simply tracking the number of tests will not provide teams with as much actionable data as the measurement of the ratio of requirements covered by tests. Approximately 69 percent of mature organizations say running functional tests and checking against covered requirements is a top measurement and 75 percent say the same about API tests run against functional requirements.

    Holistic UX Metrics

    The most mature organizations recognize that while application-specific or team-specific QA metrics are important, the ultimate goal is ensure the quality of the user experience (UX) across their entire interaction with an application. This means measuring the thoroughness of end-to-end regression testing is crucial. Approximately 70 percent of leading DevOps organizations say they believe the percent of automated end-to-end test cases as a top metric.

    — Ericka Chickowski

  • DevOps Experience: Learn a Lot without Leaving Your Spot

    DevOps Experience: Learn a Lot without Leaving Your Spot

    The great thing about conferences is they can be hotbeds of learning: keynote presentations, seminars, one-on-one sessions, networking … the list goes on. The drawback, however, is the travel: delayed flights, the dreaded middle seat on the airplane, lost luggage, jet lag … the list goes on. That’s why virtual conferences are now my first choice: All the of the learning, none of the hassle.

    MediaOps—the company behind DevOps.com, Container Journal, Security Boulevard, DevOpsTV and more—and CA Technologies have teamed to present a free virtual summit chock full of information and education for the DevOps professional presented in a virtual reality environment. DevOps Experience is a true virtual conference, replete with theaters to view the keynotes and presentations, a conference lobby to chat and socialize and a virtual trade show floor with virtual exhibitor stands equipped with video, downloads and even schwag for attendees. And did I mention it’s free?

    DevOps Experience will feature keynotes from a lineup of DevOps luminaries including:

    • Gene Kim, CTO, researcher and co-author of “The Phoenix Project” and “The DevOps Handbook,” and founder of IT Revolution
    • Nicole Forsgren, founder and CEO at DevOps Research and Assessment (DORA)
    • Alan Shimel, editor in chief and founder of DevOps.com and Security Boulevard, and
    • Aruna Ravichandran, vice president of Global Marketing DevOps at CA Technologies and author of “DevOps for Digital Leaders” and “The Kitty Hawk Venture”

    In addition, DevOps Experience will include a number of Spotlight Sessions with topics designed to provide even greater value to attendees. Sessions include:

    • The Accelerate State of DevOps Report
    • Delivering DevOps Practices for Mainframe
    • Women in DevOps Panel
    • DevSecOps, Why the Time is Now

    DevOps Experience is scheduled to be held Sept. 20 at a computer or mobile device near you. Visit the website for more information or to register for this daylong event. Registration—which is free, by the way—also includes access to the event on-demand.

    — Charlene O’Hanlon

  • Why Database Development is in a League of Its Own

    Why Database Development is in a League of Its Own

    Despite how the database is the lifeblood of many organizations, its management remains siloed and is more often than not left to a separate team of resident experts outside of the sphere of DevOps. Database developers also may work separately from the database administrators, thus further slowing down deployments.

    The end result, of course, is that database management generally fails to benefit from the same level of agility DevOps offers application development. Bottlenecks thus occur when slower and less-agile database development holds up DevOps-managed application releases and deployments.

    Determining the role DevOps needs to play for successful database development hinges on a number of things, including making sure everyone is on the same page when it comes to database changes.

    Database changes can mean different things to different people. For example, a database change can mean applying a patch or fix, or it can mean deploying database changes. It’s thus important to add context to avoid confusion. “When you talk about deploying database changes, it involves changing the structure and the logic of a database to keep it in sync with the applications it supports,” said Ben Geller, vice president of marketing for Datical.

    “Database release automation” also calls attention to how DevOps needs to address both the application-code pipeline and the database-code pipeline, Geller said. “When you’re doing application release automation, you’re automating the build, deployment and release of application code. When you’re doing database release automation, you’re automating the build, deploy and release of database code.” Geller said. “You need both of those things to happen in sync to in order to ship software.”

    An example of a database change that can be processed with Datical’s rule engine. Source: Datical

    The ability to rely on a DevOps teams to successfully deploy and manage database schema and logic changes is also contingent on adopting the right tools.

    This is not to say that making the shift to using DevOps to give database development the attention it requires is easy. Getting there often can require major changes to an organization’s DevOps’ processes, including making cultural and job-definition adjustments. Realizing what exactly is involved conceptually as well as adopting the necessary tools, for example, represent the starting points.

    Meanwhile, the resulting advantages and improvements to an organization’s ability to deploy database schema and logic changes in ways described above should pay off in both the near and long term. This likely will lead to improvements in agility measured by deployment speeds and other key performance metrics.

    — B. Cameron Gain

  • From Thought to Leadership

    From Thought to Leadership

    Thought leadership is a term that those of us in the industry hear a lot. A thought leader is a person who has ideas/thoughts that push the edge and brings great ideas to the rest of us. Most vendors want to be seen as thought leaders—and some do, through the agency of rocking individual employees.

    We all benefit from true thought leaders. They dream up new ways to do things (such as DevOps and agile), or find new uses for things (such as adapting agile practices to operations) that, in the long run, we can all benefit from. Good thought leaders (in any space) either look outward and see how what we’re doing today can be used to greater benefit tomorrow, or look inward and make us think about ideas and where we are in accepting them.

    This Isn’t About Talking Heads and Vendors

    The thing is, if you are establishing or attempting to expand DevOps operations in your organization, you are a thought leader. And that’s what I’d like to discuss.

    Those of you who say, “No, not a thought leader; I’m showing how long-established DevOps practices can improve the organization,” are wrong. The key to thought leadership is that you are there, and your audience isn’t. If those long-established DevOps practices were acknowledged in the organization then there wouldn’t be a need for DevOps leaders to establish or expand. Everyone would agree and it would just happen. After sufficient meetings, of course. (The definition of “sufficient” varies by organization and falls somewhere between zero and infinity.)

    In short, a thought leader must simply see what others do not (yet) see. If the audience is internal and resistant, then a DevOps leader is indeed a thought leader for that audience.

    So, What is Required?

    It is true that a big chunk of DevOps is communications. I’m an “automate first, streamline communications after” kind of DevOps person, but acknowledge that the opposite route is also valid. But increased communications are going to be required for long-term DevOps success. Part of that communications is with other managers both in and outside of IT. There is no better time to start than the present, by acting like a thought leader.

    Target the next application/portfolio you think would greatly benefit from DevOps. Sit and refine where you think improvements and/or savings would occur, get the buy-in of line-of-business leaders responsible for the application or portfolio, and go on a PR blitz.

    Thoughts are Great …

    But leadership is better. Be the leader, advocate for what you believe to be right. There are those who will tell you DevOps is inevitable, and it’s not a big deal once there is at least one project in the building doing DevOps. I could not disagree more. Change—any change—doesn’t happen without a champion. If you are in charge of DevOps, yes, take the DevOps Institute Leadership Certification (Disclosure: I have written paid promotional material for this certification. But it’s good material, so I’m mentioning it here anyway), but also look outward. Bring the organization to the table; be visible; be driving.

    But don’t be annoying. Know when to back off, or maybe target a different application first. And know how the existing system reporting and deploying will be mirrored in a full-on DevOps environment, so you can answer important questions such as, “How will we get through test and deploy if we re-target the application?”

    Do I think DevOps is inevitable? No. But I do think it will have a lasting impact on the way we develop and deliver software, even if a particular shop doesn’t claim to be a DevOps shop, deployment automation, test automation, enhanced defect and runtime monitoring, increased communications. These are coming because they’re good ideas. It’s best to have a plan, be a thought leader and get it rolled out so the organization can reap the benefits.

    — Don Macvittie

  • DevOps Security: 3 Privileged Access Management Best Practices

    DevOps Security: 3 Privileged Access Management Best Practices

    The tremendous upside of DevOps practices and tools are enough to keep organizations pressing forward at all costs. But when sloppy use of DevOps toolchains cause breaches, more than half the time it comes down to poor protection of privileged accounts. According to a recent study by security vendor Beyond Trust, 52 percent of IT practitioners say that overprivileged users are at the root of DevOps and other next-generation technology-caused breaches.

    If organizations are going to reap the biggest benefits from DevOps without putting their IT infrastructure and data at risk, they’re going to need to think more strategically about how they handle privileged access management (PAM), said Morey Haber, CTO at Beyond Trust. DevOps.com recently caught up with Haber to break down three of the most important PAM best practices for DevOps teams to build into the continuous delivery pipeline.

    Discover and Inventory All Privileged Accounts and Assets

    You can’t manage accounts and assets you don’t know about, so this step is foundational to the whole process of PAM. Unfortunately, with so many scripts and so much automation layered all over the DevOps toolchain, it can be tremendously difficult.

    “If it’s embedded in other runtimes or it’s hard-coded into compiled executables, that discovery is the hardest,” Haber said. But it must be done. Organizations need to get clear visibility into exactly what tools are executing the automation and what the privileges are assigned to them. “Is it a power-shelf script? Is it embedded in Jenkins or somewhere else? What is actually running? Who’s running it and when?”

    Additionally, organizations need to understand where the automation is stored and, consequently where that embedded credential information is being stored, so it can be examined for tamperability and safety of the credentials.

    “Now, this isn’t something that’s easy to discover in any of the three contexts, but it has to be,” Haber said. “So, one you have to understand the entire process and where you’re actually embedding privileged credentials for the edit, storage, operation and scripting itself.”

    Manage Shared Secrets and Hard-Coded Passwords

    Hard-coded passwords are one of the biggest no-nos in credential management. Unfortunately, even when application security teams are meticulous about rooting hard-coded passwords out of their finished applications, they often leave them within the IT infrastructure that helps support the development of that software for the sake of expedience. Same goes for account sharing, which is a frequent mistake organizations make to just get the automation working and keep it working with stability.

    The problem is, this trashes any semblance of traceability or auditability of activity within the affected environment.

    “Whether that is using some type of proxy technology, a VDI environment—anything, you don’t want people logging in directly with shared accounts because you can’t trace that,” Haber said, noting there needs to be a control plane in the mix that can keep track of both individual users and script or automation accounts that are impacting the environments to track each process or activity against unique credentials. This is essential not just for compliance, but for forensics and the overall integrity of a DevOps team’s software “factory.”

    Enforce the Rule of Least Privilege

    Ultimately, strong PAM depends upon only giving individual users or specific automation accounts the exact amount of privileges they need to get their job done.

    “We see credentials being given to DevOps teams all the time that are way, way overprivileged,” Haber explains “It should come down to the least privileged model—that you’re giving enough privileges for the DevOps process to work, but not overprovisioning so that if any process or account is compromised, it doesn’t jeopardize the rest of the environment.”

    — Ericka Chickowski