Category: Blogs

  • The Dawning of Continuous Support

    The Dawning of Continuous Support

    Development teams have a tendency to think that once they push the deploy button, the release is done. But with Devops, it’s quite the opposite now. More software changes, and more deploys, make every production release a new piece of code with unique idiosyncrasies. This has turned what has historically been a more static production environment now highly dynamic.

    Teams have responded by layering in a lot of monitoring and performance technologies, which has caused even more information overload. Continuous Deployment makes it easier than ever to push code to production but it has also created an additional priority within the company – the need to provide Continuous Support.

    Continuous support addresses the human side of how to harness your team in more effective ways, using new methodologies to adapt to a much different world, and extends out to include other areas of the business besides IT. Sales, marketing and customer support are all going to be affected by this way of doing business.

    Imagine that it’s 5 a.m and there’s an intense firefight with all the right Dev and Ops guys working to get the system back up. It’s quickly approaching prime time for the users of your app. How will you get Support up to speed so they can intelligently talk to the issues? Where is Marketing to manage the Twitter-storm and blog post? Or Sales, who is about to demo to a big East Coast prospect? Continuous support aims to help answer those questions.

    If we’re going to break down the silos with DevOps, we have to extend that out to *all* silos in the company in order for our end-users to benefit. The ability to solve smaller problems faster means quicker turnaround and quicker fixes. There’s talk about getting customer features out faster but all conversations virtually ignore the support team…even though they’re the ones talking to customers on the front line, listening to feature requests and helping to resolve user issues.

    When you extend situational awareness across the company, it becomes easier to see patterns and solve for them. Here are five tenets of customer support:

    1. The team is always-on. This means that people are not just alerted when problems are happening but rather, get updated all the time. VictorOps has a Salesforce integration that provides the perfect example. If you’re a company promising 24/7 support, the old-school way to go about doing that is to hire eight people, which is the bare minimum to insure you are single threaded on most shifts. Now, we’re making it work with just a few people and the SF integration. There are tools available that enable your support team, reduce its size and make it more likely that you’ll get to the right person faster. You don’t need to overstaff, or have someone actually sitting there, in order to be situationally aware of your customer experience and efficiently solve their issues.

    2. Collaboration is king. Getting different members of the team involved in quickly solving a firefight is a necessary but difficult task in the world of Continuous Support. If you can reduce the spool-up time for looping new participants in, then you’re on your way to finding the right answers. Allowing for scalable “lean-in” means that you have more eyes on the problem and can resolve that critical alert faster.

    3. The feedback loop is crucial. All the different departments in the company need to be involved in completing the product feedback loop. This means that when scheduling postmortems, in addition to inviting the Support and Marketing teams to join in these discussions, Product, Development and Operations should all be involved. There’s always something to be learned by internal failures and those lessons should be shared with everyone in the company who might benefit from them. The feedback loop is essential for getting customer feedback all the way back up the chain for Product.

    4. Automate, automate, automate. The single biggest driver of high performance, automation increases the overall speed & quality of code. But don’t stop there when talking about automating. You can also automate systems to help detect potential user issues, which is important if you don’t want your customer to be the first one to find the problem. Automating components of the support chain is a vital part of making Continuous Support work because it isn’t about removing the humans but instead making them more efficient through automation.

    5. Company culture is inherent to success. If all employees in the business know what the company goals are and how continuous support can help to achieve them, then it becomes an easier sell to get everyone on board. Leadership is essential in making the culture of the company a priority and keeping it there. When Continuous Support is done right, it provides the entire product chain with the proper information and empowers your employees to make better decisions.

  • Zen and The Art Of Infrastructure Maintenance

    Zen and The Art Of Infrastructure Maintenance

    There’s a famous passage I’ve quoted from time to time when I see someone “stuck” with a problem, flailing potential fixes and solutions wildly in hope that one of them does the trick.

    “Assembly of Japanese bicycle require great peace of mind.”

    Just like that. Improper grammar and all, quoted verbatim from Robert Pirsig’s philosophical classic Zen and the Art of Motorcycle Maintenance. The quote is in reference to the first printed words on a set of technical instructions, which the narrator discusses with friends and colleagues on a long-distance motorcycle trip.

    And the response I get is the same every time, likely the same response you’re having right now…

    What in the world are you talking about?

    Well good, now I have your attention. And I’d be willing to bet that attention is on 1) the ludicrous loss of translation from Japanese to English and 2) debating whether or not something as seemingly superficial as “peace of mind” is really required to assemble a bicycle.

    Language barrier aside, let’s abstract away from modes of bipedal transport into a more generic “machine”. Do we really require “peace of mind” to assemble or create a machine?

    cory2

    Reliable? Maintainable? Usable?

    We certainly all want to receive peace of mind from our machines. We want them to do the job they were created to do without fail so we can move our attention onto other things.

    What words do we use to describe such machines that give us this peace of mind? Reliable? Maintainable? Usable? When we think of the reliability, maintainability or usability of a machine, we’re really just describing a machine that can produce peace of mind. I’d argue if we want that machine to produce peace of mind, then it must be created under peace of mind.

    Why is that? If we, the creators of machines, are in a state of peace of mind when we start our endeavor, we’re highly motivated to do that which will continue our state of peace of mind. We don’t want to lose this state. Since if the machine does break, we the creators will be forced to lose our peace of mind and fix it, we’re motivated to create a machine that’s resilient against failure and resilient against our loss of peace of mind.

    Without this key precondition to creation, we’re likely to build our existing personal problems right into the machine itself! Under time pressure? We’ll cut corners to make deadlines. Dealing with a different machine breaking? Likely to gloss over a key failure condition in the machine we’re actively building so we can fight a fire elsewhere. Worried about the problems of today? Then I can guarantee there’s no thought going into a machine that will be resilient to the problems of tomorrow.

    Quality creations produce serene creators as much as serene creators produce quality creations.

    Those in a state of serenity will continue to create that which maintains the state of serenity or peace of mind; those that are not in a state of serenity are unable to escape a vicious cycle of build-fix-build-fix, never achieving peace of mind. Ultimately, the serenity of the creator is the key test for the quality of creation.

    And ultimately, this passion for peace of mind from our machines is what you’ll find when you meet the folks in the DevOps community. We’re guided by a desire to maintain our peace of mind — for ourselves, for our families and for the folks that count on us the most: our customers.

    If the machine produces tranquility, it’s right. If it disturbs you, it’s wrong until either the machine or your mind is changed.

    The material object of observation, the bicycle or [in this case, the global infrastructure], can’t be right or wrong. Molecules are molecules. They don’t have any ethical codes to follow except those people give them. The test of the machine is the satisfaction it gives you. There isn’t any other test. If the machine produces tranquility it’s right. If it disturbs you it’s wrong until either the machine or your mind is changed. The test of the machine is always your own mind. There isn’t any other test.
    – Robert Pirsig

    So the next time you find yourself struggling with a problem, take a lesson from Robert Pirsig: step back, achieve peace of mind, combat that which threatens peace of mind and strive to maintain peace of mind.

    You’ll be a better (and happier) creator for it.

  • Docker as a framework for your DevOps culture

    Docker as a framework for your DevOps culture

    If you’re like me and spend a lot of time evaluating new technologies with the goal of “doing more faster” with your engineering organization, then you’re certainly aware of the many choices of DevOps tools like Puppet, Chef, Ansible, Salt, etc. In my opinion each of these tools is amazing at one piece of the DevOps puzzle – configuration management, and some are OK at other DevOps tasks. Each of the tools has a slightly different approach to configuration management but after comparing them I find that you’re usually picking a tool based on stylistic reasons like the DSL, existing recipes/playbooks, or existing familiarity. While I have my opinion on which of the above tools is “the best”, each tool only solves the configuration management piece of the puzzle.

    If DevOps is truly a culture change and not just the codification of operational tasks then we need tools that help foster that culture and I think Docker goes a long way towards doing that.

    Coming from the perspective of a developer looking at development tools, I see the above tools as APIs for DevOps, where Docker is more of a framework for DevOps. This is because Docker is both a runtime environment and a configuration management tool in one. Best of all Docker eliminates many common tasks in your development cycle and creates a tighter feedback loop between your development and operational tasks. I believe creating fast effective feedback loops between development and operations is critical weather development and operations are entire departments or simply tasks in within your organization.

    In my experience developing software as a service platforms, one of the most problematic parts of the process is the management of the environments, how many times have you heard “works for me” or “works on our test servers”? Generally issues like this arise from subtle dependency changes between the environments introduced by both developers, QA and operations throughout the deployment lifecycle. To fix this problem I’ve seen, and attempted, several approaches. For example I’ve tried having a base VM and using Vagrant with Puppet or Chef to create local environments that were the same as test and production environments. This seems to work at first but it proved to be cumbersome to manage the differences between development and test environments as time went on. I found that this mostly because the DevOps (configuration management) tools are geared towards maintaining a perfect operational state based on strict server roles defined in the tool. While this approach was better than manual management of development and test environments it was still quite easy to have the configurations between environments drift apart over time and end up with the same issues mentioned above.

    So how does Docker help and what makes it better?

    • Uses a layered approach to dependency management, making the configuration of environments easier to maintain.
    • Provides various runtime options allowing the same image to be run in multiple ways without extra configuration.
    • Can use any or no DevOps tools to build up your Docker images reducing the learning curve across engineering.
    • Lightweight runtime makes running multiple Docker images on a single machine more feasible than with VMs.
    • Decoupled network and storage layers allows a single Docker image to be run on a single system or multiple systems easily.

    These features allow developers to run complex multi-service architectures on their laptops and with the same runtime images operations can support any number of load or availability scenarios with as many or as few systems as necessary. This combination of predictable dependency management and runtime flexibility is like having all the ease of a Heroku environment with the flexibility of AWS or Softlayer.

    Docker has many other impressive features, and few shortcomings, but in my opinion it’s a great framework to build your DevOps culture around as it makes maintaining a predictable production environment and a flexible development environment easy with one tool. Over my next few posts I’ll cover more specific examples of using Docker in development, test, and production environments. In the mean time visit the links below to read more about Docker and it’s growing ecosystem.

    Docker, Deis, Shipyard

     

  • What is Security Policy Orchestration and Why Should DevOps Teams Care?

    What is Security Policy Orchestration and Why Should DevOps Teams Care?

    After attending the DevOps day I wrote about in my last post, I wanted to take a minute to explain exactly what Security Policy Orchestration actually is so we can begin to understand how the two concepts overlap.

    Simply put, Security Policy Orchestration is intelligent network change automation. It goes beyond simple task automation by truly understanding the network through simulation and analytics. It also gives security people an extra level of governance and control, which is so critical to assure security and business continuity.

    Security Policy Orchestration reflects the growing relevance that managed security policies are having on IT systems.   In network security lingo, security policies are firewall policies, but can also apply to Access Control Lists (ACLs), router and load balancer configurations.  Managing security policies is an arduous task that requires automation, and Security Policy Orchestration has emerged in response to numerous factors happening in tandem – mainly, that:

    • Business agility is gaining importance as a key competitive factor. This is creating an increased demand for automation across IT and, specifically at the network layer.
    • IT organizations are pressured to match the speed, convenience and self-service provisioning the cloud environment offers for internal application deployment.
    • Enterprise networks are growing larger and more complex with numerous traffic routing and shaping technologies to service multiple data centers.
    • The widespread use of stateful and next-gen firewalls for external and internal network segmentation has significantly increased the size of the enterprise firewall estate, forcing security policies to morph into complex rule sets that map how business is conducted over the network.

    The collective impact of these developments on network and security operations tasks is having a profound impact on people, processes and technology, including DevOps groups, who like their Security Operations (SecOps) brethren, are under pressure to roll out services faster.

    Security Policy Orchestration helps to alleviate that pressure, enabling SecOps teams to keep up with the demands of the business while ensuring security and preventing an outage or a breach.  Being able to automatically generate, provision and synchronize Security Policy changes across a growing set of systems – with security, compliance and governance concerns accounted for – means that security will not become a bottleneck that slows down DevOps teams.

    While Security Policy Orchestration evolved out of network security operations, its benefits transcend security.  Even though it will remain a SecOps function, its impact on DevOps is only going to increase, especially as Network and Security Operations continue to converge.  However, the fundamental enabler of Security Policy Orchestration is automation.

    As a result, there is significant common ground between DevOps and SecOps when it comes to automating application connectivity. This may not have been an issue for you yet, but my introduction to DevOps came from my experiences helping Tufin customers automate application connectivity.  It’s a subject that is extremely germane to DevOps teams, and a topic that I plan to explore in depth in this blog because those of us leading the Orchestration charge within SecOps are kindred spirits with DevOps evangelists.  

    Contrary to popular belief, Security Policy Orchestration wasn’t created to restrict a company but to free it and help DevOps teams to accomplish its vision at the lowest IT risk level possible.  After all, there is no such thing as bulletproof security where the Internet is concerned.

    Instead, security folks focus on reducing risk, which puts us in a much better position to add value to the business.  Plus,  since so many of today’s biggest threats (i.e. APTs, for example) are network-based, introducing the tenets of Security Policy Orchestration  – which literally automates best security practices into change processes – is in the mutual best interest of both SecOps and DevOps teams. 

    In my next post, I plan to dig into more detail on the stakes Security, Dev and Ops all share to make IT work faster, better and safer, and propose a few ways in which SecOps and DevOps teams can collaborate to gain some quick wins.

  • DEVOPS AND CONTINUIOUS DELIVERY; THE NEED FOR SPEED

    DEVOPS AND CONTINUIOUS DELIVERY; THE NEED FOR SPEED

    Continuous-Delivery-Infographic-ImageSome good stuff around the DevOps scene this week on DevOps and Continuous Delivery, which the pundits are saying will be a major spend area in 2014.

    First up is the Devopsguys who with a little commentary reposted this infographic from Zend Technologies. It demonstrates the real value in DevOps and continuous delivery. One thing that jumped out at me was that according to the data, ninety- nine percent of the Companies surveyed are now recognizing a greater need for DevOps strategies than before. Zend built the graphic utilizing data from various credible industry sources.

    Of course you can’t talk about Continuous Delivery without at least mentioning Jez Humble, after all he literally wrote the book on it. He recently posted on his blog four visualizations by Nhan Ngo, a QA Engineer at Spotify. The four visualizations were created while reading Jez’ book, Continuous Delivery. Some pretty intense stuff. Nhan Ngo made it look almost simple, almost like like a comic strip, but there is nothing funny about it.

    If you really want to get into the trenches, here is an interesting video that I found called Continuous Delivery and Zero Downtime from the site Night Hacking. The scenario is your “Continuous Integration system is well oiled and kicks in after every commit. Your code is compiled. Your tests are green. You feel ready to take your project to the next level and move to Continuous Delivery.”

    We aren’t done with our look at DevOps and Continuous Delivery just yet, DevOps Reactions probably illustrates best how Continuous Delivery works.  It works in the model, but in the real world it requires real skill.

    If you would like something mentioned here or have something you think I should Shout Out; email parker@devops.com and don’t forget to comment here.

     

  • DevOps and Security Are Compatible

    DevOps and Security Are Compatible

    When I speak with information security organizations faced with the prospect of moving to DevOps, one of the most common fears I hear is that this transition will degrade security of infrastructure and applications.  If you’re one of these folks, I understand this fear but you can rest assured:  when you do things correctly security will actually improve.

    One big reason security benefits in this model is due to improved alignment and tighter feedback loops.  You see, DevOps is about creating a unified, engaged team and doesn’t make it easy to fall into the “silo thinking” that traditionally leads to security as an afterthought.

    DevOps embraces automation and consistency, which benefits security by allowing you to add automated checks during coding to look for obvious security issues and flag things for human review (such as the linking of new libraries or the introduction of new third-party components that could add risk).  This means you will be able to identify “areas of concern” earlier in the development process where they will be much cheaper and more timely to address.  Twitter is a well-known advocate of this kind of automation, in which security checks are executed each time code is checked in and obvious security issues are presented to the developer immediately, giving them a chance to correct the problem right away and reducing the likelihood they will repeat the errors.  That is a much more effective process than the delayed feedback typically associated with manual code reviews.

    Security isn’t just better in the “Dev” portion of DevOps – you can also add automated configuration validation and scope checking into the environment build process to minimize the chance that a fat-fingered error or an out-of-policy change will introduce problems into production.

    This sort of automated approach also improves as you learn from retrospectives and post-incident reviews.  As you encounter preventable issues, you can often improve your automated checks to increase the odds of catching these issues before they impact production.

    Remember that security is an important stakeholder in the DevOps process, and the onus is on you to become a part of the conversation and find ways to add value to the goal of the organization.  Also, don’t forget to tap into the community of DevOps practitioners – others have walked this path before you and can help you in your journey.

    Finally, if there are specific security challenges related to DevOps that are vexing you (myths you would like to see busted) I’d love to hear from you.  Leave a comment below and become part of the conversation.

  • Survey Says: Positives and Negatives of DevOps are Two Sides of the Same Coin

    Survey Says: Positives and Negatives of DevOps are Two Sides of the Same Coin

    Isn’t that the way it always works? A person’s strength can also be their weakness. A company’s killer product becomes their Achilles heel as the market shifts. As more and more companies make the shift to DevOps, it’s interesting to learn what’s working, what the opportunities are, and what the impediments are. As many of you know, my company, JumpCloud, along with SoftLayer hosted the 2013 DevOps Conference in Boulder, CO. We had over 200 amazing people in the room – developers, ops folks, managers, execs, CEOs, and founders. Really, the whole gamut was represented in some way. It was an intense day full of presentations and panels, but with lots of time for discussion – with the audience even participating numerous times during talks!

    As part of the conference, we surveyed the audience on a number of topics related to DevOps. The results of the survey are here and the press release announcing the results with some analysis is here as well. As I sat back to take in the data, the most significant learning for me was that the movement to DevOps is constrained by time, first and foremost, and one of the opportunities of DevOps is automation. Let me say that again a different way: the very thing that companies are trying to solve – moving faster, is the thing that is preventing them from getting there.

    Lack of time is nothing new for IT people. We have been hearing that for decades. For some reason, the IT organization has always been crushed with the amount of work that they have and the resources available. Perhaps it is that they are involved in just about everything going on in an organization, or as is the case today in many businesses, the IT organization is the business. As a result, it is even harder for organizations to find the time to do the very things that will make them more efficient. Unfortunately, the cycle becomes a self-fulfilling prophecy and as organizations get more busy, they find less and less time to ‘fix’ their business.

    The survey data from the DevOps conference showed that there are any number of opportunities to automate tasks. The group gravitated to a few – deployment, patching, user management, and log analysis – but there were many more. Each organization has their list of tasks that need to be automated that they never get to. The lost productivity from those missed opportunities is likely staggering. Automation is hard and painful. Especially when you are trying to run the day-to-day business. As one of my marketing friends liked to say, we are rebuilding the car while it’s going 60 MPH.

    It’s easy to say that the solution to this is just to spend some time automating. Allocate more hours to it and put it into each sprint. Yes, that is easy to say. Unfortunately, that rarely works. The pressures of the business take over and move automation back down the list very quickly. After all, features need to be built, bugs need to be fixed, and performance issues need to be resolved. All higher priority items than automation when you are in the crucible.

    The focus on automation has to come culturally to work long-term. There needs to be recognition from all levels of the organization that automation will take precedence over other tasks. Without that perspective, automation will almost always be pushed down the priority stack. Automation is a long-term play, not a short-term gain. Band aid fixes are quick and get you back to your task list. Automation takes deliberate time, effort, and focus to happen, and then the benefits are only seen afterward. Of course, the benefits are subsumed by other tasks until they too are automated, so it’s hard to see them for long, but they are there. And, in fact, as more and more becomes automated, a company starts to see their velocity increase dramatically. They’re not focused on manual tasks, they’re focused on driving new innovative features.

    The DevOps survey really said it all – organizations that can figure out how to get off the hamster wheel of manual tasks, will automate and build high-velocity organizations. Unfortunately, that is easier said than done.

  • The DevOps Journey

    The DevOps Journey

    Maintaining a constant thirst for learning is essential for anyone dedicating their career to the IT, computer and networking industries. It’s more than just learning about the latest technologies, rather, it’s imperative we embrace new methodologies and paradigms for doing work, thinking about problems and creating solutions. Enter DevOps, which is a healthy mix of all the above.

    You might find things a bit confusing if you’re new to DevOps. There are many perspectives on what it means. For myself, there were two significant milestones on my journey to understand and embrace DevOps;  1) rethinking how we design large, dynamic applications and manage the underlying infrastructure in cloud environments such as Amazon AWS, and 2) reading the book The Phoenix Project by Gene Kim, Kevin Behr, and George Spafford.

    At first blush, I thought DevOps suffered the “definition bloat” of so many other industry buzzwords (for example, “cloud” comes to mind.) Depending on who you talked to or what you read, DevOps definitions frequently encompassed one or more of the following:

    1. embedding development resources within business units for better alignment and reduced cycle time,
    2. high frequency software releases into production (multiple per day, hour, etc.)
    3. automating infrastructure and system administration tasks vs manual provisioning and sysadmin
    4. embedding operations functions within development organizations
    5. operations performed by developer, even doing away with traditional operations in some cases

    If these seem like a somewhat confusing, loosely assembled list is ideas, don’t fret — they struck me the same way at first too. These ideas actually fit very well together around a few core ideas essential to DevOps.

    Quicker Time To Value – Being Fast and Agile

    DevOps is about changing traditional paradigms, enabling us to more rapidly deliver production updates, new capabilities and improved operations. Outcomes include reducing software releases from months to multiple, micro releases per day, and even hours. To do this requires much more than can be achieved through traditional operational efficiencies. It requires tight alignment, coordination and execution by product, development and operations functions. Embedding multiple disciplines together helps gain this alignment, shorten communication paths, setting priorities quicker, enabling lightning fast coordination. DevOps promotes new practices like embedding development and operations functions within other parts of the business, breaking down long standing barriers between IT / Ops and development / business groups.

    Automated Provisioning, Operations and SysAdmin

    From app development to infrastructure operations, DevOps is about automation. DevOps is about faster software testing and integration, quality improvement, and working in much more dynamic and rapidly changing operating environments. For example, rather than building system images by hand (stick built), automation is used to rapidly generate and spin up new virtual environments on a small or large scale. Systems wake up, check in to learn their personality, install, configure or update code (OS, database, web server, application code revs, etc) and join the network dynamically. This can occur with a single instance or with hundreds simultaneously. Initial upgrades and feature updates can occur on smaller or isolated sections of the network, then are rapidly rolled out across the network, and rolled back quickly if necessary. Sysadmins, be they developers or ops people, use scripts, code and automation tools to manage much larger environments than would ever be possible using manual methods. Automation is an essential differentiator in any DevOps environment.

    Culture of Open Collaboration, Communication and Failing Fast

    DevOps breaks down silos and places a premium on collaboration and communications amongst all players involved. It’s no longer us vs. them or this department vs. that other department. The blame game is gone and the focus is on making work happen, and fast. Communication lines are drastically shortened and conflicts in chains of command are collapsed. It’s about how “we” get things done, no longer about what “they” didn’t do. Failures are viewed much differently. Failures happen and from them we learn and develop newer, better, more innovative solutions to solving problems and prevention problems in the future. Because of the speed DevOps can bring, recovery from failure is much quicker. If a new release into production is causing issues, we quickly flip back to a previous known-good version running on other virtual instances. Updates can also be rolled out much more quickly.

    I hope these and coming views on DevOps are valuable to you as a reader. I know our conversation will help me and the teams I work with, as we learn and grow our expertise in DevOps. Please share your ideas, disagreements and learnings as we move along this journey together into the fast moving and quickly changing world of DevOps.

  • Don’t Be Afraid of the “R” Word

    It seems that many people are afraid of the word refactor.  I think in many cases, if someone admits they need to refactor, it means they either didn’t do their job right.  They either missed requirements, wrote inefficient or buggy code, etc.  Alternatively, there is something fundamentally wrong with the product or system.  The fact of the matter is that sometimes there are big problems and a major refactor/rewrite is required.  I think that is rarely the case, but if embraced by all and done judicially, the outcome can be significantly better and the major refactor avoided.

    It doesn’t matter if it is a feature, deployment script or architectural decision, at some point, everyone must admit they are not clairvoyant and cannot predict every way end-users or systems will behave.  Therefore, there will be missed/new requirements and unforeseen problems.  As such, I very much embrace the philosophy of build for what you know now and adapt as you go.  Typically, that means the output is simpler, it got done faster and enhancements and bugs are easier to address.  That philosophy also means you are constantly in a state of refactoring, or said differently, incorporating new learnings, making individual methods more efficient, improving the readability of the code, filling in missing tests, etc.

    Now, just because we have embraced refactoring and we have noble intentions of, in general, leaving the code better than we find it, that doesn’t give us the license to go crazy and start rewriting everything we see. I think there are right and wrong times to refactor.

    First and foremost, don’t let those yucky bits of code distract you from your real purpose which is to deliver business value by building those new systems, features and fixing bugs.  So instead of just jumping right into refactoring, quickly note the yuck as a TODO in the code, story or in your notepad so you don’t forget about it, but also stay on task.  That said, bad code that is directly in your way is fair game and I even think that bad code near the edges of your task are also fair game.

    Secondly, follow good engineering practices.  Make changes in small, bite size chunks, test and deploy your changes often and communicate them with the team.  In the end, you will end up with a better product, happier end-users and engineers which should all translate into a more successful business.

    If you are one of those clairvoyants, then email me and let’s talk over a beer because I have lots of questions.  Otherwise, if you are a mere mortal like myself, then embrace the “R” word and seek out companies and teams that also embrace it.  At the end of the day or after a few releases, it is pretty impressive to reflect back on how adaptable the team and code can be while solving real problems very quickly.

  • MongoDB Needs and Loves DevOps

    MongoDB Needs and Loves DevOps

    DevOps is about more than just running infrastructure smarter, with more automation. It’s a means to engineering agile, robust, and modern software by blending the traditionally siloed areas of administration and development. This means infrastructure as code, and developer concern for operations. It means more than calling sysadmins “DevOps Engineers”; it means operators and developers working together seamlessly. NoSQL in general is a solution that by it’s nature loves DevOps, and it thrives under teams that take a DevOps approach, but it can really hurt you if you do not. MongoDB is no exception to this rule. It has gained enormous traction in the developer community by blending flexibility, features, and performance. Some teams have been seduced by the ease with which they set up MongoDB for development, and neglect to think about capacity planning, tuning, monitoring, and maintenance. Do not let this happen to you! Or you will pay the price at 3am when you are scrambling to figure out why your swell app has ground to a halt. Instead, take the time to learn MongoDB’s needs and capabilities, because it doesn’t just make development easy, it can truly sweeten operations with things like hassle-free replication and full access to administrative tasks via the same API used to perform data access. Let’s have a look at MongoDB from a DevOps perspective.

    DevOps Wants:

    Clueful administrators.

    There isn’t much room in the DevOps movement for system administrators who don’t speak at least one high-level language. I personally find Ruby most appealing to to me for systems programming, but Python is also a fine choice. MongoDB admins should be practiced at performing administrative tasks in both the javascript shell and the programming language of their choice, setting the stage for a rich infrastructure monitoring and automating codebase. Administration best practices are extensively, if not exhaustively, documented in the administration docs, so start there. Pay particular attention to the Operational Strategies section of the manual, which provides a checklist of concerns you should address as you plan your system’s design and deployment.

    Developers who know the ramifications of their infrastructure.

    The age of throwing applications over the wall to operations is mercifully drawing to a close. Developers must understand the nature of their infrastructure, how to best utilize it, and how it handles failures. MongoDB affords developers the ability to code to infrastructure details without coupling to particular instances, or even hostnames. In this, tags, write concerns, and read preferences are your friends. Code that runs reports (which should be kept away from your production instances) can specify that it will read only from instances tagged as “reporting”. Admins can add instances tagged as ‘reporting’, or swap which instances have that tag, with a few lines of code. Refer to the end of this article for example code.

    Infrastructure state to alert cleanly, and for trends to be visualized.

    The MongoDB Monitoring manual section provides an overview of the ways to monitor your instances, including 3rd party solutions, both self-hosted and SaaS. MongoDB Management Service is MongoDB, Inc.’s free monitoring, trending, and alerting service, which you should set up from day one to monitor every single instance you rely on.

    Infrastructure to be programmable.

    Ok, you are monitoring your instances, why not work on automating your infrastructure to respond to faults and load requirements? While MMS is a no-brainer, it’s not going to plug into your infrastructure code. You can roll your own integration using MongoDB’s handy exposure of its internals via database commands, and for replication, the local database. For example, you can check on replica set lag in Python like so:

    import pymongo
    # three mongods running on my laptop
    c = pymongo.MongoReplicaSetClient(
        'Kusanagi.local:29017,Kusanagi.local:29018,Kusanagi.local:29019',
        replicaSet='test'
    )
    
    rs_status = c.admin.command('replSetGetStatus')
    
    lag_threshold = 120 # up to two minutes of replica lag is ok for this example
    primary_optime = [ member['optime'].as_datetime()
        for member in rs_status['members'] if member['state'] == 1 ][0]
    secondary_optimes = [ member['optime'].as_datetime()
        for member in rs_status['members'] if member['state'] == 2 ]
    for secondary_optime in secondary_optimes:
        if ( (primary_optime - secondary_optime).total_seconds > lag_threshold):
            # do stuff

    Provisioning MongoDB instances programmatically on Amazon EC2 is easy with the official AMIs, but automating MongoDB infrastructure goes beyond that. Learn to use the database commands to configure replica sets, because you can script joining new instances to a set. If you use sharding, you can update tag ranges for sharded clusters to migrate chunks to shards specifically provisioned to warehouse data.

    Disaster recovery to be robust and automated.

    There are numerous ways to back up MongoDB, and the one you pick should be appropriate for your deploy. So read through your options in the backups section of the MongoDB Manual. You should probably read that section twice.

    To aid in release management.

    By being schema-free, MongoDB frees enterprises from the hassles of schema alterations and their attendant maintenance windows. Instead of altering a user table to include a new column for “birthplace”, a new release of your application will just begin to write the user document with that attribute included. Naturally, your user profile rendering will not assume this value is set and throw an exception, it will just not display “birthplace”. This does not excuse you from change management! In a DevOps shop, everything about monitoring that applies to production applies to your integration environment, which I sincerely hope is continuous. Configure all the monitors you’d have in production, and alert developers when metrics go out of range.

    Closing Thoughts

    In a DevOps culture, admins read code, developers plan infrastructure, and they both attend the same planning meetings. Engineers who work with MongoDB, both in operations and development, should read the WHOLE manual. If your developers read the development section and your admins read the administration section, you’re really only doing Dev and Ops.

    Example Code – Tags

    Tagging an instance of a replica set looks like this in the MongoDB shell:

    test:PRIMARY> config = rs.config()
    {
        "_id" : "test",
        "version" : 2,
        "members" : [
            {
                "_id" : 0,
                "host" : "Kusanagi.local:29017"
            },
            {
                "_id" : 1,
                "host" : "Kusanagi.local:29018"
            },
            {
                "_id" : 2,
                "host" : "Kusanagi.local:29019"
            }
        ]
    }
    test:PRIMARY> config.members[0].tags = { "use": "production" }
    { "use" : "production" }
    test:PRIMARY> config.members[1].tags = { "use": "reporting" }
    { "use" : "reporting" }
    test:PRIMARY> config.members[2].tags = { "use": "production" }
    { "use" : "production" }
    test:PRIMARY> rs.reconfig(config)
    Fri Mar  7 18:35:25.040 DBClientCursor::init call() failed
    Fri Mar  7 18:35:25.042 trying reconnect to 127.0.0.1:29017
    Fri Mar  7 18:35:25.042 reconnect 127.0.0.1:29017 ok
    reconnected to server after rs command (which is normal)

    Here’s Ruby code, assuming the same config:

    require 'mongo'
    
    # I'm running 3 mongods on my laptop
    rset = Mongo::MongoReplicaSetClient.new(["Kusanagi.local:29017",
                                            "Kusanagi.local:29018",
                                            "Kusanagi.local:29019"])
    
    # using the local db to get current config
    config = rset['local']['system.replset'].find_one() 
    admin_db = rset['admin']
    config['members'][0]['tags'] = { "use" => "production" }
    config['version'] += 1  # mongod avoids reconfig conflicts by insisting on an increasing version value
    verify_version = config['version']
    begin
        admin_db.command({ 'replSetReconfig' => config })
    rescue Mongo::ConnectionFailure # expect your connection to close during this operation
        actual_version = rset['local']['system.replset'].find_one()['version']
        raise unless actual_version == verify_version
    end

    Specifying tag sets only applies to reads from secondaries (since there is only one primary to choose from). In Ruby, it looks like this:

    rset = Mongo::MongoReplicaSetClient.new(["Kusanagi.local:29017",
                    "Kusanagi.local:29018", "Kusanagi.local:29019"])
    analytics = rset['analytics']  # say we have an 'analytics' DB
    cursor = analytics['page_views'].find({'page' => 'home'},
                                            :read => :secondary,
                                            :tag_sets => {:use => 'reporting'})

    This query specifies, with the :read option, that only secondaries should answer, and with the :tag_sets option, that only secondaries tagged with 'use': 'production' can be used. If I were to shut down members[0] (Kusanagi.local:29017) while it was primary, and members[1] (Kusanagi.local:29018) became primary, the above query would fail, because as primary it’s no longer eligible to answer queries directed at secondaries, even though member 1 is tagged as use: 'production'. This is exactly what you want, to keep your reporting queries from hosing your production instance. After taking stock of the situation, you might decide to assign 'use': 'reporting' to member 3, and the above query would then again work. Note that the MongoReplicaSetClients created by the Ruby driver do not by default refresh replica set state (as of v1.9.2), they use the config that was present when the connection was established (this is not the case for all drivers, make sure you determine your driver’s behavior). This means that if you reassign tag values, existing connections will not notice the change. If I were to change the tags for member 1 to 'use': 'not reporting', the above query would not fail, it would route the query right to member 1. So if you are using tagging, and Ruby, instantiate your client with the refresh_mode option:

    rset = Mongo::MongoReplicaSetClient.new(["Kusanagi.local:29017",
                "Kusanagi.local:29018", "Kusanagi.local:29019"],
                :refresh_mode => :sync)

    See the MongoReplicaSetClient documentation for details. The Python driver handles this by launching a background process to monitor Replica Set health and config changes, but the API does not document any means to configure its polling interval.