Category: Blogs

  • AsyncAPI: Transparency as a Value

    AsyncAPI: Transparency as a Value

    History has been marked by opaque and totalitarian power systems. Aided by prisons and walls that keep out the light. The concentration of power in the hands of a few individuals has marked human evolution. From feudalism to fascism, the annulment of the rights of individuals has been based on obscurantism and ignorance. Information has always been guarded by a few, in a few places, and under lock and key. Darkness was always understood as the opposite of knowledge, of science. Plato referred to the cavern, the place where shadows are barely glimpsed, distorted, manipulable from the outside. Subjected to the opacity of the camera obscura, we live in the hope of a shutter that will open a first light bulb.

    Fighting the One-Dimensional

    Faced with the danger of control and censorship, of single direction, of what Marcuse would end up calling “one-dimensional man”, the new tools born at the end of the 20th century cracked the traditional foundations on which power was based. The expansion of the internet offered an opening of windows to the world, the multiplication of paths. The entry of light into every home in the form of a seemingly infinite torrent of information, impossible to censor, unfathomable.

    The arrival of Society 2.0 marked the definitive turning point in government systems toward a necessary democratization. Under its premises, nothing can or should be hidden; everything is potentially visible. Moreover, there are no longer spectators who attend the show, but users appear ready to add their grain of sand in a collective bet, to open their shutter to let in some more light.

    The Spotlight

    The involvement and activation of users is the strength of a collective intelligence. The multiplication of images uploaded by users makes manipulation more difficult, broadens the options for contrasting perspectives and opinions. They add lines of writing to an amplified story.

    The user thus becomes a spotlight that avoids blind spots. One more flashlight at the service of the common good. For the image of a transparency, a slide, for example, to be projected on the wall, we need a light source directed toward the acetate, thus allowing us to see the intricacies of an image that remained in the dark until that moment.

    Disclosure

    Transparency has probably become the fundamental concept of the democratization processes undertaken by governments, institutions and companies in recent years. Ultimately, in its ideal state, democracy is nothing more than a method that allows the members of a community to analyze reality from different points of view to finally make decisions.

    From all this arises open source policy, a system that makes information free and at the same time allows users to see its management and decision-making processes and in which everyone is invited to collaborate. The community thus becomes an essential engine of work and communication.

    The Light

    AsyncAPI arises from this foundation. As an open government project, it defends transparency and democratization in its system of governance and organization. This organizational system aims to empower the people who make up the project, based on a horizontal structure for decision making.

    All relevant project data are public. The tasks under development are within the reach of and open to participation by the community. This is intended to cultivate an environment of trust and respect for the user that stimulates their participation in the pursuit of a common goal. This allows projects to be increasingly collaborative and participatory. Data and metadata. Code and image. As digital photography does, it is no longer possible to attend only to the final state, to the superficiality of the image that is shown, edited, composed, manipulated. The image becomes an open, transparent process, where we can compare its properties, its internal structure.

    Finally, the light.

  • Managing Technical Debt is a Balancing Act

    Managing Technical Debt is a Balancing Act

    Technical debt is a nightmare for product managers. It can slow down teams and inhibit response time for delivering quality products to market. Yet, there are times when technical debt can be beneficial; but turning it from a headache to a positive is a balancing act. 

    Nimble project managers and developers should strive to develop an equilibrium that balances creating, reducing and accepting technical debt. The good news is: That’s attainable.

    The Shape of Technical Debt

    It’s essential for PMs to understand how technical debt can arise so they can identify its characteristics and manage the amount to carry or avoid to the team’s advantage.

    Laying too much brick and mortar will take software features too long to develop. It risks their rollout arriving well past due dates. But fixating on speed threatens to underdeliver on functionality. Circumstances like these will diminish the ability to deliver powerful results over time.

    Similarly, ignoring the power of third-party solutions to slot in and satisfy customer needs and speed-to-market is outdated thinking. For example, software like embedded analytics can arrive off-the-shelf to complete an architecture task quickly and affordably while freeing up the team to address other challenges. Remaining agile with all options available to the team is critical.

    Overall, the project manager’s goal should be to identify the indicators of technical debt and hone their skills to address each type.

    Building Architecture

    When a team is tasked with delivering new features or functionality, building upon the existing structure to support the new capability is not unusual. Lack of foresight or diligent planning about what’s necessary to enable this function can be a critical oversight that leads to a void in need resolution, i.e., incurring debt requiring payment.

    Speed versus Quality

    Delivering at the speed of modern business often means facing time constraints that can impact the quality of work. Faced with such limitations, teams may take shortcuts. Ultimately, those shortcuts can lead to an increase in technical debt.

    Quantity versus Speed

    On the opposite end of the spectrum, eagerly attacking a project that requires significant lead time can result in overbuilding. This leads to a different form of technical debt. Longer projects can be affected by technological change—an evolution that makes some previously completed structures outdated. Debt takes the form of teams forced to return upstream to make necessary changes when they should instead remain downstream.

    Near-Sightedness

    Unlike the oversight or overbuilding described above, if the team fails to consider future needs and focuses only on current tasks alone, it risks creating debt that arises by starting from scratch. If teams don’t anticipate the next feature or prepare for future functionality while in development, they will likely pay for this near-sightedness down the road.  

    To Build or Buy

    Developers want to build. It’s what they do. But it’s not always in the organization’s best interests. When a team faces complicated requirements, is extended beyond its capabilities or is simply well outside its repertoire, debt can be avoided by looking toward existing platforms that fulfill its needs. In such instances, a third-party solution saves significant time and money. For example, an embedded analytics tool built with the latest technologies and deployed turnkey frees the development team to remain focused on its expertise and apply its talents there. Think: Does the team need to invent a new wheel, or does one already exist? While choosing the former risks taking on debt, selecting the latter holds the promise of reducing it.

    Manageable Debt

    Still, technical debt can be a benefit. 

    Consider this example: You want to roll out a platform that delivers to the customer and market, but it’s a ground-breaking product. You don’t yet know everything you want or need to know about how end users will engage with it and what they’ll ask it to do. In situations like these, it’s reasonable to get the functional framework of the software into the hands of the market so that you can absorb reams of feedback, return to the platform and then build out or fine-tune its features and functionality. Actions like these are wise. PMs haven’t mortgaged the farm for a bag of magic beans—they’ve taken on a reasonable amount of debt to fertilize team knowledge into a product that will ultimately deliver the most value.

    Recognizing technical debt and its approach, avoiding or accepting it accordingly and then managing it with deliberate efforts to pay it down within acceptable limits is where PMs want to be. If you invest in paying it down or seek and accept third-party solutions to avoid it altogether, you’ll maintain team focus and velocity on the projects they excel in. 

  • Mona Allies with New Relic to Converge MLOps and DevOps

    Mona Allies with New Relic to Converge MLOps and DevOps

    New Relic and Mona, a provider of a platform for monitoring the models used to provide artificial intelligence (AI), announced today they have formed an alliance to help bridge the divide between DevOps teams and data scientists.

    Most data science teams today build models based on machine learning algorithms using operations platforms that enable them to manage the life cycle of those models, otherwise known as MLOps. Mona provides a set of monitoring tools that are employed to detect drift that can occur as some of the underlying assumptions that were made when building the model are discovered to be less accurate or when new data sources become available.

    New Relic, meanwhile, provides an observability platform that is widely employed by DevOps teams to monitor and observe an IT environment. IT teams that have access to New Relic One can now also view dashboards provided by Mona that detect anomalies involving data integrity issues and model performance issues.

    The integration also enables users to create custom Mona alerts that are shared via the New Relic Alerts and Applied Intelligence service. That capability reduced the volume of alerts generated by correlating anomaly detection to specific IT events.

    Yotam Oren, CEO of Mona, said that level of integration provides a bridge between DevOps and data science teams that typically have widely divergent cultures.

    Incorporating AI models within applications is the next major DevOps challenge. There is almost no application being built today that won’t incorporate some level of AI. The challenge is AI models are built by data scientists that employ a wide range of machine learning operations (MLOps) platforms to construct those models. The pace at which those AI models are developed, deployed and updated varies widely. However, all organizations will eventually need to confront the problem of how to insert AI models within applications both before and after they are deployed in a production environment.

    There are two schools of thought about how best to achieve that goal. The first is to assume an AI model is just another type of software artifact that can be managed as part of an existing DevOps process. In that context, there may be no need for a separate MLOps platform. Conversely, proponents of MLOps contend AI models are built using pipelines created by data engineering teams working in collaboration with data scientists. Developers only become part of the process when an AI model needs to be inserted into an application environment. AI models may ultimately need to be incorporated within an application, but the proponents of MLOps platforms maintain building models requires a unique platform to manage a software artifact that is built by training algorithms.

    It’s only a matter of time before compliance issues force some form of convergence between DevOps and MLOps teams, noted Oren. The longer it takes to address both the cultural and technical issues that are required to meld DevOps and data science teams, the more challenging it will become as both teams are set in their respective ways.

  • Defining Availability, Maintainability and Reliability in SRE

    Defining Availability, Maintainability and Reliability in SRE

    In the world of reliability engineering, you’ll frequently encounter the three “-ability” words: Availability, maintainability and reliability. They sound similar and have similar meanings. In fact, these words may seem so similar that it can be tempting to use them interchangeably.

    That would be a mistake. Availability, maintainability and reliability all have distinct—if related—meanings, and they each play different roles in reliability operations.

    Definitions of Availability, Maintainability and Reliability

    Let’s start by succinctly defining each of the terms.

    Availability, Defined

    Availability is the extent to which an IT resource is ready to perform a task when requested.

    Thus, an application or server that is responding to requests is available (even if it takes longer to respond than desired or otherwise operates suboptimally, in which case it may have a reliability issue but not an availability issue).

    Availability is usually measured as a percentage. A resource that has 99% availability, for example, is one that is up and responding 99% of the time.

    Maintainability, Defined

    Maintainability is a measure of how quickly and easily a resource can be fixed when something goes wrong.

    If a buggy application release can be quickly fixed by rolling back to a stable version, the application would have a high degree of maintainability. On the other hand, if you have a server that needs to be rebuilt manually after it fails, it’s not very maintainable.

    Reliability, Defined

    Reliability is the extent to which a resource functions as required upon request (as opposed to simply being available).

    For example, if your users require an application to process each transaction within one second, and it does this 99%of the time while also maintaining a 99% availability level, that would be a relatively reliable application. In contrast, an application that responds to almost all requests but that suffers from high latency or error rates would not be very reliable, although it might be highly available.

    Differences Between Availability, Maintainability and Reliability

    The simplest way to spell out the differences between availability, maintainability and reliability is to highlight what’s unique about each concept.

    Availability

    Unlike maintainability and reliability, availability is an essentially binary metric, in the sense that a system is either available or it’s not. Although availability status can change over time, there is no such thing as varying degrees of availability.

    Availability also stands out because it is often the most important metric in defining SLAs and SLOs. Contracts typically specify that resources will achieve a certain level of availability, defined in percentage terms. They may sometimes also specify metrics like response times, which are a reflection of reliability, but availability is more likely to be the most important metric within service agreements.

    Maintainability

    Maintainability is unique in that it’s a pretty subjective concept. A system that one SRE considers easy to maintain could seem difficult to maintain to another SRE. The methodologies that engineers leverage to optimize maintainability could vary, too; for instance, someone from a DevOps background may be more likely to focus on optimizing maintainability within the software delivery chain than someone trained in classic site reliability engineering, which focuses on automating IT operations through code more than on the software delivery process.

    That said, automation tools help virtually every team maximize maintainability, no matter their preferences or background.

    Reliability

    Reliability stands out because it reflects how well a system performs. Here again, this is a somewhat subjective metric, because performance requirements may vary from one user to another. Nonetheless, reliability is the most effective means of measuring whether a system meets the performance levels it needs to, even if those requirements change over time.

    Why do availability, maintainability and reliability matter?

    Because availability, maintainability and reliability each measure different aspects of a system’s status, putting them together is a useful means of gaining insight into the overall reliability of a system.

    In order to be reliable, a system requires both availability and maintainability. A system can’t be reliable if it’s not available. It’s also unlikely to be highly reliable if it takes a long time to fix issues due to low maintainability.

    At the same time, by focusing on availability, maintainability and reliability individually, you can drill down into specific issues within the IT resources you manage. For instance, you might have systems that are high-performing when they’re available, but that have low reliability rates because of availability issues. In that case, you’ll know that an investment in increased availability is likely to yield the greatest reward for increasing overall reliability.

    The Bottom Line

    The bottom line: While availability, maintainability and reliability are all reflections of the quality of an IT resource, they measure quality in different ways. Tracking each category separately is important for ensuring that you know where your weakest links exist within overall system performance and health.

    At the same time, however, it’s important to compare and correlate availability, maintainability and reliability data so that you can achieve continuous insight into a resource’s status. When you can track each item separately but also combine them together to gain a complete picture of your system, you are in the best position to optimize reliability operations.

  • Authentication in Serverless Apps—What Are the Options?

    Authentication in Serverless Apps—What Are the Options?

    Serverless applications are growing in popularity among DevOps engineers. They provide a convenient, predictable way to run simple processes like CI/CD builds or automation scripts with no need to stand up infrastructure. They are also commonly used to deploy microservices. However, serverless applications present unique security challenges, one of them being authentication. 

    How can you ensure services communicate with other services or with the outside world only if authorized to do so? How can you ensure users can conveniently and securely access multiple instances of a serverless function?

    In serverless applications, there are many components interacting—not only end users and applications but also cloud vendors and applications. This is why common authentication methods, such as single factor, two-factor and multifactor authentication offer only a bare minimum foundation. Serverless authentication requires a zero-trust mentality—no connection should be trusted, even communication between internal components of an application should be authenticated and validated.

    To properly secure serverless authentication, you also need to use authentication and authorization protocols, configure secure intraservice permissions and monitor and control incoming and outgoing access. In this article, I’ll cover all these briefly and demonstrate a practical example—setting up authentication in the AWS serverless ecosystem.

    What Are the Most Common Authentication Methods?

    Here is an outline of the standard authentication methods used by most applications.

    Single-Factor Authentication

    Also called primary authentication, this is the most prevalent and straightforward type of authentication. Single-factor authentication asks for only one authentication method; for example, a security PIN, password or PIV card, to gain access to a service or system.

    These methods are solid in relation to familiarity and usability; however, they are generally linked to poor security and credentials can readily be stolen or guessed through phishing, data breaches or by using keyloggers.

    Two-Factor Authentication

    Two-factor authentication (2FA) adds another layer of intricacy, as it needs an additional factor to authenticate a user’s identity. Common verification methods include one-time passwords, tokens created by a registered device or PIN numbers. The presence of two verification methods significantly improves your level of security. 

    Multifactor Authentication

    This is the most complex process of authentication. It makes use of two or more independent factors to verify a user’s identity and authorize access to the system. In common scenarios, multifactor authentication (MFA) makes use of at least two of the following factors:

    • A PIN or password (something known)
    • Security token or mobile phone (something owned)
    • FaceID or fingerprint (something you are)
    • Location information, typing speed or the like (something you can do) 

    Authentication and Authorization Protocols

    An authentication protocol is a communication protocol that protects authentication data as it transfers between two entities. It enables a receiving entity to authenticate a connecting entity as well as authenticate itself to a connecting entity. This is achieved by declaring the type of information required for authentication and syntax.

    There are several types of authentication and authorization protocols, including:

    • Lightweight Directory Access Protocol (LDAP)—a software protocol that enables anyone to find data about individuals, organizations, and resources like files and devices within a network. LDAP allows this whether a user uses the public internet or a corporate intranet.
    • The Security Assertion Markup Language (SAML)—an open standard that allows sharing security information about authentication, authorization and identity across several different systems. 
    • Open Authorization (OAuth)—an open standard authorization framework designed for token-based authorization established over the internet. OAuth enables third-party services to use end-user account information without exposing user account credentials to the third party. This blog post can help you understand the differences between SAML and OAuth.
    • OpenID—enables authentication services and websites to exchange security information in a standardized manner. OpenID Connect—the newest version of the protocol—provides improved identity management, support for mobile application development, and interoperability. Learn more in the official OIDC FAQ.

    Secure Authentication on Serverless

    In serverless systems, there are four forms of access—four forms of communication that should be secured. An individual service won’t have to include all four, but the categories that it does feature should be well-protected. 

    Intraservice Access

    Creating a system by uniting serverless services has many advantages. However, you should consider the security of every additional service. 

    A service with excess permissions is a liability. Unnecessary permissions provide excessive access to data, actions or services, and a bug might let malicious users exploit that service and use its permissions to endanger your system. Hence, you should give careful consideration to the permissions required by each service.

    Effectively overseeing intraservice access permissions is often an overwhelming job. Luckily, all of the top-tier cloud providers have native access management services to make this task simpler. AWS has AWS IAM, Azure has Azure Active Directory and Google Cloud Platform (GCP) provides Cloud IAM. 

    Incoming Access

    A network is made accessible through a SaaS offering to external users. Access will be restricted, and every user will require the official credentials to achieve that access. 

    However, this brings up the same problems raised above—the secrets must be stored somewhere. You cannot manage how your users access and store the credentials that you provide them with; therefore, you should assume that their credentials are not being kept securely and that they may be compromised at any point.

    This would appear to be an unmanageable issue, but there is a solution—to provide temporary credentials. This means that even if the secrets were revealed, they would expire shortly afterwards. 

    The cloud providers have services for this. Google Cloud IAM offers short-lived credentials, AWS IAM lets you create temporary credentials and Azure Active Directory lets you configure expiration dates for its signatures that have shared access.

    Outgoing Access

    When your organization’s serverless function has access to an external third-party service, it typically needs some sort of access credentials. These credentials need to be kept somewhere, but this storage is sometimes not as secure as it should be. Today, certain web applications continue to store secrets in databases, text files or hardcoded within the function code. 

    Cloud providers have services for securely retaining credentials and secrets. AWS has AWS Secrets Manager, Azure offers Azure Key Vault and GCP offers Google Cloud Secret Manager.

    End User and Customer Access

    The issues with this access type are akin to those for incoming access, though the solution is different. Whether in B2B or (particularly) B2C environments, not many users would put up with a requirement to continuously regenerate or refresh their credentials. Thus, another approach is needed. 

    The top-tier cloud providers all have a user authentication service—Azure Active Directory B2C, AWS Cognito and Google Identity Platform. You should also consider using third-party end-user verification, as this will help you avoid vendor lock-in. Third-party offerings also tend to offer a better developer experience. The most common third-party authentication providers are Okta and Auth0.

    AWS Lambda Authentication Solution Example

    Amazon Cognito offers managed authentication and authorization that can help you build secure web services in a serverless architecture. It is typically used in combination with Amazon API Gateway when building complex serverless applications that require permission control.

    For example, a payroll system may have a manager and two additional employees. The three employees can use their unique usernames and passwords to log into the payroll system—this process is called authentication.

    To retrieve paystubs, the three employees undergo role-based authentication:

    REST API GET /api/employee/{employee_id}/paystubs

    However, the permissions they get through this process should be unique to their needs. This may involve setting up the following conditions:

    • The manager can access the paystubs of all employees.
    • Employees cannot access the paystubs of other employees, only their own. 

    You can use AWS managed services to fulfill the above requirements and also meet future scaling needs.

    Image Source: AWS

    Step One: Setting Up AWS Lambda Authorizer

    The Lambda authorizer is the brain that centrally determines whether the requester has the relevant permissions for the requested API resources.

    Here’s how you can set it up:

    • Navigate to the Amazon API Gateway and create an authorizer.
    • Select the API resources you want to secure and assign the AWS Lambda function to them.
    • Configure your new AWS Lambda authorizer.

    Step Two: Building User Access Control List (ACL)

    It is crucial to establish user permissions and keep them up-to-date. The approach might differ according to your identity provider. Here is an example of the process if you use Amazon Cognito as your IDP. 

    1. Initialize the ACL

    Every user has a unique ID, so you can describe each user’s permissions by inserting items in the permission table in Amazon DynamoDB when you register with Cognito. The DynamoDB permission table stores the access control list for all users, although the implementation may differ based on the use case. 

    For this example, let’s use a single integer ID for each employee (the UUID strings in real applications tend to be much longer). 

    Manager:

    uuid: xxxx-xxx-xxx-xxxx-xxxxxxxx

    employee: {“allow”: [“/5”,”/5/*”]}

    paystubs: {“allow”:[1,2]}

    Employee 1: 

    uuid: xxxx-xxx-xxx-xxxx-xxxxxxxx

    employee: {“allow”: [“/6”,”/6/*”]}

    paystubs: {“allow”:[3,4]}

    Employee 2: 

    uuid: xxxx-xxx-xxx-xxxx-xxxxxxxx

    employee: {“allow”: [“*”],”deny”:[“/7”,”/7/*”]} // employee_id=7 is the manager of employee 2

    paystubs: {“allow”:[1,2,3,4]}

    2. Manage the Access Control List (ACL)

    The user permissions in a complex project are constantly changing. Employees can be promoted, demoted or terminated, with different access requirements depending on their changing roles. A new manager, for example, needs access to all pay stubs, which means you have to create a new pay stub object for every employee. 

    You can manage user permissions using the Amazon DynamoDB stream:

    Lambda functions can easily be integrated when you insert or modify items in the permissions table. A Lambda function might include code that modifies permissions according to changes to the role of a user.

    3. Build an ACL policy

    Once you’ve established an ACL with user permissions for every object, you should create an authorization policy document. The Lambda function authorizer uses this policy to evaluate whether user API requests should be allowed or denied.

    Amazon API Gateway offers a mechanism for evaluating policies internally. internal policy evaluation mechanism. The Gateway will automatically evaluate any policy JSON returned by the authorizer. For details about Lambda authorizer’s output standard, see this document.

    In this article, I covered the basics of authentication in serverless applications:

    • Single-factor authentication
    • Two-factor authentication
    • Multifactor authentication
    • Intraservice access
    • Outgoing access
    • Incoming access
    • A real-life example with Amazon Cognito

    I hope this will be of help as you gain a better understanding of authentication and authorization techniques that help secure serverless applications.

  • Bridging Departmental Divides for Successful Automation Projects

    Bridging Departmental Divides for Successful Automation Projects

    For too long, IT has been largely isolated from an organization’s core business. Any division between IT and lines-of-business (LOB) is even more detrimental when speed is not just a competitive advantage but an existential necessity in today’s accelerating digital economy. 

    As business leaders streamline and turbocharge every facet of their operations, savvy organizations are rushing to eliminate inefficient and damaging gaps between departments by putting more software tools in the hands of more employees. Analysts predict 80% of technology products and services will be built by those who are not technology professionals by trade by 2024. 

    This hits home amidst the booming trend toward robotic process automation (RPA), low-code/no-code and other automated solutions, which have only continued to grow as more businesses realize the vast benefits of automation: Accelerating operations while also reducing costs; elevating customer experiences and shifting employees to higher-value positions and laying the foundation for new data-driven revenue streams.

    Squandering Automation’s Advantages

    But these advantages are quickly squandered if there’s a turf battle between the business unit looking to optimize processes and the IT department responsible for deploying the tools to make that happen.

    When there isn’t collaboration and plenty of trust on both sides, automation initiatives are more prone to disappointments and delays. 

    This may happen if the IT department comes across as too smart for their own good, putting less value on feedback from their LOB colleagues and rushing to implement software with a focus on speed rather than outcomes. On the LOB side, leaders may assume their IT counterparts are too technical and don’t understand business objectives and choose to override important IT input about which vendors are best qualified when it comes to support, integration and security.

    The problem here is not the technology; hundreds of thousands of businesses across the world have successfully deployed process automation solutions. It’s the execution.

    When an automation initiative fails, there’s almost always blame to be shared on both sides of any divide. Likewise, success typically boils down to people across IT and every business department working better together to achieve a common goal. 

    To embrace a collaborative mindset and set up your automation projects for success from day one, I encourage you to follow these clear steps:

    1. Reinforce a shared mission: Whether it’s automating the customer onboarding process or deploying RPA bots to automate a repetitive, time-consuming process, communicating a shared mission is the crucial first step to pulling off a successful project. On the IT side, that involves talking with the LOB about their goals, objectives and business strategy. LOB leaders, meanwhile, can emphasize that IT is an equal business partner that has valuable insights and expertise to contribute.
    1. Establish visibility and transparency: Armed with a full understanding of business objectives, IT leaders can now evaluate tools built to give all stakeholders a full view of the processes that will be affected. By documenting and mapping out each process within an organization, leaders can better understand current processes and gain insight into areas that are ripe for standardization and automation. 
    1. Tailor solutions that match the problem: With heightened visibility across the organization, LOB and IT teams can then determine the scope of each problem and tailor solutions accordingly. Some processes can be kept and optimized; some can be tweaked with automation. Other processes may need to be reconfigured significantly before automating or shut down entirely because they are outdated or unnecessary. 

    A great example of this collaborative approach comes from Coca-Cola Beverages Florida, LLC (Coke Florida): Encumbered with a legacy process repository — a collection of PDFs, videos, pictures and spreadsheets outlining more than 600 processes — Coke Florida standardized and leveraged visual process mapping software to establish an easily accessible document repository that provides visibility and control over key processes, encourages collaboration and increases accountability. 

    Coke Florida continued an organization-wide initiative to digitize and automate its business processes with digital workflows, forms and RPA software, driving further efficiencies across its entire organization. As the company discovered firsthand, shared goals result in shared success. 

    When speed and high-quality outcomes become the norm, companies master the essential arts of urgency, resilience, visibility and collaboration. By bridging the divide between departments, organizations not only drive internal efficiencies but also gain a competitive advantage that is indispensable in today’s burgeoning digital economy. 

  • FinOps Cloud Cost Optimization via Governance-as-Code 

    FinOps Cloud Cost Optimization via Governance-as-Code 

    Cloud implementations continue to grow in scope and complexity. Too often, this expansion also means costs keep spiraling out of control. In this article, we’ll examine why the emerging practice of cloud financial management (FinOps) is so essential to containing costs in the cloud. We’ll then discuss the challenges teams encounter as they start to apply FinOps approaches. Finally, we’ll reveal the opportunity presented by employing governance-as-code to establish continuous cloud cost optimization—and how this approach makes it practical for teams to put the theory of FinOps into practice so they can keep cloud costs in check.

    The Emergence of FinOps

    For many organizations, there’s been a race to leverage cloud services, with teams seeking to realize advantages in flexibility, agility and efficiency. Within an organization, it’s not only a matter of more workloads running in the cloud, it’s a matter of more distinct deployment models being used, more teams using cloud services and leveraging multiple service providers.

    In the process, teams have had to contend with rapid growth in the size and diversity of the implementations that have to be managed—and paid for. It is this latter aspect that has been a rude awakening to those responsible for managing budgets. Left unchecked, this growth in cloud use has led to spiraling costs and predicting, managing and controlling these costs only grows more difficult as deployments get more complex and more frequent.

    This need for improved cost management has given rise to a new discipline: Cloud financial management; or FinOps. In short, FinOps is a way of bringing financial discipline and accountability to the variable-cost paradigm found in the cloud. FinOps brings together a combination of technologies, processes and teams, including professionals from technology, finance and business. By gaining an improved ability to understand, track and manage cloud costs, teams can begin to maximize the value realized through their cloud expenditures. Given the strategic and urgent nature of cloud cost management, it’s not surprising that FinOps teams are growing. According to research conducted by the FinOps Foundation, FinOps teams expanded 47% over last year, and these professionals are expecting their teams to grow 75% in the next year.

    Challenges in Establishing FinOps

    While there’s a lot of promise behind the establishment of FinOps practices, there are also many obstacles standing in the way for teams. When the FinOps Foundation queried respondents about top challenges, these were the top five responses:

    • Getting engineers to take action (39%)
    • Dealing with shared costs (33%)
    • Accurate forecasting (26%)
    • Reducing waste or unused resources (25%)
    • Full allocation of costs (23%)

    Lacking comprehensive control and visibility over multi-cloud environments means these teams can’t proactively manage costs—and too often find out about wasted expenditures and high costs of underutilized resources after the fact. Because stretched teams are reliant upon manual follow-ups and tactics, it is difficult to get engineers to respond as quickly and effectively as needed.

    Compounding these challenges is the fact that across teams, different tools and processes are used. For example, different development teams might be using different provider services along with varying deployment tools, such as AWS Cloud Formation, HashiCorp Terraform, Kubernetes and so on. This inconsistency introduces inefficiencies and miscommunication and stifles team productivity.

    While the cloud offers a range of benefits compared to legacy, on-premises infrastructure, without proper governance, cloud costs can quickly spiral out of control. In fact, Gartner analysts report that in the next few years, 60% of organizations will encounter cost overruns in public clouds.

    Rethinking Cost Management

    For all the reasons articulated above, teams are being asked to take a new approach to cloud cost management, one that aligns with the principles of FinOps. For many, this means embracing the concept of governance-as-code to optimize cloud costs. Cloud governance-as-code represents a way to automatically and dynamically apply policies, including for cost optimization, in fast-changing cloud environments.

    With governance-as-code approaches, policies are defined using a standard language. Code associated with cost policies is created, deployed and maintained in much the same way developers manage application or infrastructure code. Developers don’t have to worry about tracking or managing costs. Cost policies are continuously evaluated against current state, utilization and configuration of cloud infrastructure. If any violations occur, automated notifications and workflows can be triggered. Here are the key requirements for using governance-as-code to establish continuous cloud cost optimization:

    Cost Policies are Defined via an Intuitive Language

    Traditionally, development, operations and financial groups worked in silos. Each team had its own tools, workflows and policies, and even fundamental terminology could vary substantially.

    To maximize the potential of continuous cloud cost optimization via governance-as-code, solutions need to enable teams to define, manage and revise policies using an easy-to-understand, consistent language. This makes it much easier for different teams to collaborate and gain alignment on key cost management policies and best practices.

    Finally, to be effective in establishing continuous cloud cost optimization, governance-as-code offerings need to employ a language that is independent of any specific programming languages that application developers may use. Further, these languages should be applicable to the broadest set of applications, cloud services, development tools and so on. This is vital to ensure that development teams retain maximum flexibility in the tools and services they can use.

    Cost Policies are Managed and Deployed via Git Within CI/CD Workflows

    Once policies are reviewed and finalized, teams must be able to apply these policies within the development organization’s existing continuous integration/continuous delivery (CI/CD) workflows.

    Through robust governance-as-code approaches, teams can create cost policies as code artifacts and deploy them via open source version control systems like Git. Through this approach, teams can apply policies in a manner consistent with their software development and delivery life cycles.

    By codifying cost governance in this way, cost controls can be deployed via Git within a CI/CD pipeline. This approach enables teams to avoid complex manual processes associated with tasks like managing tickets, requesting changes and so on. This also helps teams keep up with the accelerating pace of today’s dynamic cloud and development environments. Further, this approach means governance code can be traced through various state changes, rolled back if needed and so on, just like application code.

    Cost Policy Violations are Detected and Addressed in Real-Time

    Through continuous cloud cost optimization via governance-as-code, teams are  empowered to institute not only continuous detection but also immediate action. Policies can be employed at regularly scheduled intervals or they can be triggered based on certain events.  This approach enables enforcement of workflows and actions that may be required. If policy violations occur, notifications to relevant teams or team members can happen automatically and advanced workflows can be triggered. For example, a policy could identify RDS instances greater than 30 days old that have had no connections in the last 14 days. It would then notify the owners of these instances. If they don’t take action in seven days, the instances could automatically be stopped.

    Cost Policy is Continuously Enforced and Refined

    Continuous cloud cost governance-as-code has a never-ending life cycle, just like the team’s software development life cycle. Cost governance code is built, deployed, tested and released, and the process continues as new policies are developed and refined over time. As requirements change, teams need to be able to periodically analyze cost data and update policies as needed.

    As organizations continue to invest larger sums in their cloud implementations, the need to establish strong FinOps capabilities will only grow more critical. However, as these cloud deployments continue to grow more complex, it can get increasingly difficult to realize the promise of FinOps. For these reasons, employing governance-as-code to establish continuous cost management is emerging as a key approach. With this approach, teams can achieve sustained compliance and minimize waste.

  • New Relic Acquires CodeStream to Close Observability Gap

    New Relic Acquires CodeStream to Close Observability Gap

    New Relic today revealed it has acquired CodeStream as part of an effort to make observability data more accessible to developers.

    Buddy Brewer, group vice president (GVP) and GM at New Relic said New Relic CodeStream makes application telemetry data collected via the New Relic One platform directly available within an integrated development environment (IDE), now including Microsoft VS Code. In addition, there are also integrations with Microsoft Teams and the GitHub repository.

    The goal is to close an observability gap that exists today between developers and IT operations teams that stems from a lack of developer visibility into production environments, he noted.

    Finally, New Relic is also announcing a core user pricing option for New Relic One that is aimed at developers. Starting at $49 per month, developers gain access to a core set of capabilities such as CodeStream integrations, errors inbox, logs, GraphQL application programming interfaces (APIs) and the ability to build and run custom applications on New Relic One.

    Peter Pezaris, CodeStream co-founder and CEO, now GVP and GM, strategy and developer tools at New Relic, said becoming part of New Relic will make it easier to bridge the divide that exists between most developers and IT operations teams by making it much easier for developers to see how their code is actually executing in a production environment. That capability will eliminate scenarios where code that runs just fine on a laptop executes poorly in a production environment, he added.

    Developers can also add inline code comments, trigger pull requests, request feedback and track issues directly from their IDE via integrations with a wide range of developer and communication tools. Developers also can switch from New Relic One into an IDE in a single click to navigate, triage and remediate production errors in the context of the code they wrote.

    New Relic is initially making New Relic CodeStream available for free—no credit card required—during a preview period that extends to January 12, 2022. Afterward, some of the more advanced features will require a paid user license once free tier limits are reached. Similarly, IT teams can also sign up for a free New Relic One account without entering a credit card to instrument their applications.

    As the responsibility for managing applications in production environments continues to shift left, Pezaris said it’s critical to give developers the tools they need to optimize code in a production environment.

    It’s not quite clear exactly how much responsibility for applications is shifting left toward developers; it differs from one organization to the next. Many are simply trying to reduce as much friction as possible between developers and their IT operations teams by providing more ‘connective tissue’ from New Relic that IT teams would have to otherwise write themselves, noted Pezaris.

    It may take some time to bridge the observability gap between developers and IT operations teams. Most IT operations teams are still coming to terms with what observability provides that existing IT monitoring tools don’t. Monitoring, at its core, focuses on predefined metrics to identify when a specific platform or application is performing within expectations. The metrics tracked generally focus on, for example, resource utilization. In contrast, observability combines metrics, logs and traces—a specialized form of logging—to instrument applications in a way that makes it simpler to troubleshot issues without having to rely solely on a limited set of metrics that have been pre-defined.

    In theory, at least, that level of observability should ultimately reduce the total number of incidents an IT operations team needs to fix by identifying issues long before they become an actual disruption.

  • Software Design Patterns – Gary Gruver, Gruver Consulting & Dave Farley, Continuous Delivery Ltd.

    Software Design Patterns – Gary Gruver, Gruver Consulting & Dave Farley, Continuous Delivery Ltd.

    Gary Gruver has partnered with Dave Farley, co-author of “Continuous Delivery,” to supply trainees with key software design patterns and an understanding of how to avoid common mistakes along the way. This curated, wiki-style content library is based on Farley’s breadth of knowledge and decades of experience; Alan, Gary and Dave discuss. The video and a transcript of the conversation are below. 

    Intro: This is Digital anarchist.

    Alan Shimel: Hey, everyone, it’s Alan Shimel. Welcome to another TechStrong TV segment, here. I’m joined by an old friend a new friend, today, that I wanna introduce you to. Both of them are actually very well known in the dev ops world and to our dev ops audience, but let me introduce them to you. First, I wanna introduce you to Mr. Dave Farley. Hey, Dave, welcome to TechStrong TV.

    Dave Farley: Thanks. Nice to be here. 

    Alan Shimel: Pleasure to have you on. Dave, for those who may not be familiar with who you are and kind of, you know, where you are in the world, why don’t you share, if you can, a little bit of your background.

    Dave Farley: Sure. My background is as a professional software developer, for many, many years. Mostly, at probably the more difficult end of the spectrum in terms of the kinds of systems I was involved in building up. I led a team that built one of the highest performance financial exchanges in the world. But I’m probably best known for as being one of the authors of the continuous delivery book, which introduced dev ops and continuous delivery to many people. And I’ve got a new book coming out, soon, on software engineering, as well. So, I think and talk about continuous delivery, software engineering, those kinds of things. These days, I run a consultancy advising big companies on how to do this kind of stuff better.

    Alan Shimel: Fantastic, and welcome, and thank you. Next up is one of my older friends, not that he’s old, but I know him for as long as I’ve been doing DevOps.com, and that’s going on eight years now. He’s well-known dev ops author, dev ops practitioner, leader, Gary Gruver. Hey, Gary, how are you?

    Gary Gruver: I’m doing great, Alan. It’s good to see you again.

    Alan Shimel: Yup, I did my best to embarrass you, but why don’t you give people a little bit of your background.

    Gary Gruver: [Laughs] Well, you said I’m old, and I am kinda old, and I’ve been in this space for a while, and I’m not any smarter than anybody else, I just think I’ve been making mistakes in this space longer than anybody else. So, you know, probably where you hear the most about me is the transformation that led at HP, where we got a 2x to 3x improvement productivity leading a group of 800 developers around the world. And where Dave comes into this starting at the keyboard and working his way up, I start at the leadership level and working my way down towards the keyboard, but never quite on the keyboard type of thing. And, you know, really started doing things that later became dev ops, not to do dev ops or not to do CD. We were just trying to make the organization more productive and figure out what worked. So, years of trying to figure out how to help people realize the types of benefits that we got at HP with that type of transformation.

    Alan Shimel: Sure. And then, I mean, not to be your agent here, but from HP, you also went to macys.com and helped build that out from a dev ops perspective, and you’ve written several books around your experiences at HP and Macy’s and others, on leading the transformation and, you know, making the transformation. And I should note that that was before Covid, B.C., right, it was B.C., and before digital transformation became the buzzword that it has, you know, since Covid.

    Anyway, gentlemen, welcome, both of you, here. You guys have an announcement, some news we’re gonna break. Which one of you wants to go first?

    Gary Gruver: Well, let me give it a try, since I kind of started this.

    Alan Shimel: Okay.

    Gary Gruver: You know, [crosstalk] all of my time, whether it’s books or webinars or keynotes or whatever, I’ve been trying to help as many people as I can on this journey, because of the benefits that we realized. And, you know, I came up – what I realized is people weren’t making the progress that I felt like they needed to be. And what I realized is, I started looking at other industries, whether it was the manufacturing industry or organizational change management. One of the things that was out there was I realized that, in the 1980s, the automobile companies in the US started getting attacked by Japan and really losing out on quality, and they came to the conclusion that, you know, we really needed to copy what Toyota was doing. And they spent years doing that, and it didn’t work, which feels a lot similar to what we’re doing in software. We’re going and looking at the people who are doing it well and trying to copy what they did.

    Eventually, manufacturing realized the key to success was not copying, but coming up with a systematic approach to continuous improvement. So I’ve been really focused on that, and trying to do it in a way that overcomes the resistance to change, and coming up with a systematic approach and getting people excited about it. And then once people get excited about it, we really want’em to be able to be successful implementing these changes. A lot of them are new, and I’m looking for somebody that understands more, at the technology level, how to make all this stuff happen. And I ran across Dave and started reaching out to him, and what we realized is we started in different times and different places, but we ended up in a similar place, because they were the things that worked.

    And so, we’ve come together to create a training program to help people, and we’re both at a similar point in our career where we wanna help as many people as we can, and we continued to do that through traditional engagements. But we realized if we digitized this content and made it accessible to everybody, we could help more people and it would be more affordable for them, if they could learn how to do it for themselves instead of needing the hands-on engagement.

    Alan Shimel: Very cool, very cool. Dave, you wanna kind of fill in some of the gaps, here, or a little color to this?

    Dave Farley: Yeah, sure, so as Gary said, we kind of come at this from slightly different angles, but tend to have coevolved similar approaches. I’m a technologist and I think in technical terms, and I think that some of the ideas that underpin the approaches that Gary and I talk about have some fairly deep reasons why they work. I think that continuous delivery, in particular, and the kind of engineering approach to dev ops that I talk about is genuinely, defensively an application of scientific-style rationalism to solving problems in software, which is something that I would call proper software engineering. And if that were the truth, then we’d expect to get better results by doing that, because that’s how engineering works

    the disciplines. And I think we’ve got that.

    I think that if you followed our advice, we can’t guarantee you success, but we can guarantee you that you’ll have a better chance of success if you follow our advice. Because I think that’s the kind of input that we can deliver, with the approach to software development that we describe. It’s the approach that underpins many of the organizations that we think of as exemplary at software development. This is how the best organizations in the world practice software development. And Gary and I have been doing this for a long time and advising people for a long time, and as he said, we came to the conclusion that we’d be able to help more people by trying to digitize some of our understanding and knowledge in a way that can help more people, you know, than we can just do talking to them as consultants.

    Alan Shimel: Sure. You know, interestingly, you know, we’ve recently gone through a whole rebranding here, and we’re now the TechStrong Group and part of TechStrong TV, and we have TechStrong Media, TechStrong Associations, TechStrong Education. And as part of that exercise, we’ve been talking about just the whole way people learn today, right? I grew up where you wrote a whitepaper, right? A company wanted to tell you about their product, I wrote a whitepaper, or a series of whitepapers. When was the last time any of us read a whitepaper? You know, when was the last time someone wrote a whitepaper? But anyway, forget whitepapers for a second, just education in general, right?

    We went from, you know, in-person being the only way to do education. You know, we always understood people learn, you know, via vision, via hearing, or tactile via touching. We went from that in-person education to online education, we went from formal certification to informal learning as you go, we have virtual reality, augmented reality education, anything goes, love is love. But, so, I gotta ask you guys, how are you packaging this? How does our audience consume this? And why did you choose that particular methodology or method?

    Gary Gruver: Well, it starts with the white belt training, which is computer-based. And what I realized, when I was writing books, is I was hoping people would get’em and engage and then start reading them as an organization. And what I realized is, people would buy the books, and they’d sit around and gather dust. And one of the challenges is, how do you get people to absorb the content as it’s a computer-based system that can be integrated into your learning management systems, and there are large organizations that have integrated it into their employee development. So they buy an enterprise package and they’re having everybody take the training, and that’s a process that doesn’t tell them what to do, but it teaches them how to make their processes visible, and make the waste and the opportunities for improvement visible for everybody so they can align on those improvement ideas.

    And that includes videos and texts, and more importantly, it’s scenario-based assessments: “If you are this person in this role and you saw this data, what would you prioritize doing?” And I came up with a lot of those scenarios based on things that I saw customers doing in the industry that I interacted with. So it shows how to use the views of trying to identify it, but it also shows some of the things that people are doing wrong. So it helps to highlight those types of things, and we put that together, and then, you know, we leveraged a little bit off of Lean Six Sigma and manufacturing, not in exactly what to do, but with the idea that, to get higher levels of certification, you really need to do an improvement project.

    It’s more than just understanding the concepts and repeating them back. You’ve gotta go do a four- to six-month improvement project where you identify the issues, you highlight the problems, and you go to fix something, and you have metrics that quantify it. And the initial green belts were coming out with they’re saving, you know, over $50,000.00 in annual savings a year of waste _____ from the organizations. So we’re trying to motivate as many people to do that. And then, as we get’em motivated, we pulled in Dave to help’em avoid common mistakes and struggles along the way, and I’ll let him talk to that.

    Dave Farley: Yeah, so you were talking, a little bit earlier, Alan, about the start of the pandemic, and the start of the pandemic triggered me into starting a YouTube channel. And I started recording videos, short videos on different aspects of software engineering, continuous delivery, dev ops, software development, those kinds of things. And that kind of led me to kind of thinking more seriously and taking more seriously the ideas of education and the ways in which I can help more people do more stuff. And Gary reached out and started explaining his ideas about the white belt training, and so on. And so, I started working on that material that can help with those separate improvement projects, to allow people to solve problems. So, we’ve come up with a bunch of tools that will allow people to explore different ideas.

    So, my part of the offering is a multimedia wiki that will allow you to explore ideas as a wiki normally will and kind of jump around randomly. But also a bit like, when you’re going to visit the hospital and you follow the yellow track to get to x-ray, there are paths through the information that, if you follow those paths, they will guide you and give you advice on different ways of solving different parts of the problem. And that’s gonna be growing, over time, as we add more and more stuff, but already there’s a lot of useful information that can help people do things, like do more effective approaches to automated testing beyond deployment pipelines. And adopt the approaches of dev ops and continuous delivery into their discipline, and start to think about this engineering approach that we’ve both been talking about.

    Gary Gruver: And what I really like about it is there’s specific design patterns, but there’s actually code you can look at. So you can see why Dave coded it a way, and the implications of not coding it that way. ‘Cause we don’t want people to get excited about making improvements and go forward and to get frustrated and get stopped, and we don’t want’em to create something that’s really hard to maintain and brittle. So we wanna try to – we can’t answer all the technology and we can’t tell them how to do it, but if – you know, Dave’s been doing this for a lot of years and has done it wrong a lot of times, and so, if he can help people avoid those mistakes, they’re gonna be more successful and more likely to continue along their journey.

    Alan Shimel: Fair, fair. Guys, is this available now?

    Gary Gruver: Yes, and there’s another thing that I’ve struggled with. One is, how do you get leadership engagement? Right? For leadership engagement, they’ll say, “Yeah, go do safe, or go do this, or go do that, copy what they did, and I’m gonna measure you and I’m gonna drive you on metrics,” but the leaders don’t really take the time to engage and truly understand the problems. And it’s so important to do, because, you know, because the same team does product development and improvement of the process, the process improvements always get traded off. And we call that technical debt. In manufacturing you have different groups, but you have a group very focused on the process.

    If we can’t get the leaders to understand the opportunities for doing the process improvements, we’re not gonna get’em to champion that and put it in perspective with what they’re being demanded from the product standpoint. So we wanna get the leadership engaged, and we’ve tried to prototype processes working in a few large companies where they’ve had a lot of success. Well, we let the executives take the training together as a team, and we don’t say, “Go do the training,” ’cause it’s eight to ten hours and they’ll never get it done. We’ll say, “Can we put one more meeting on our agenda and we’ll do the training together, every week, for an hour. And then, it’s not just the training. We have somebody take the training ahead of them and bring examples from their organization.

    So it’s not just training for training’s sake. It’s, like, “Okay, here’s a way of thinking about it and viewing the problem, and here’s that applied to our organization,” and then we leave’em time to debate. And it takes a little longer for’em to get through the training, but the alignment across the executives goes much quicker. And this, having done a lot of these transformations, this executive alignment is so important that I’m willing to offer a free prototype of the training to any organization that can get a group of executives committed to it, and has a change management person who’s willing to lead it and start to collect the data to facilitate those conversations.

    And that’s available now, and you could just send the e-mail at garygruver.com, and I’ll help you get set up with the prototype. And the training’s available at garygruver.com, or you can go directly to engineering the digital transformation, and get all this training and certification that is available and is being used successfully at large companies today.

    Alan Shimel: Very cool. So it’s garygruver.com for the information, here.

    Gary Gruver: Yeah.

    Alan Shimel: Cool. Guys, we’re almost out of time, but I gotta tell ya, I’m really stoked to have the both of you together on this. I think it’s a powerful testament, right, that this is gonna be something that’s worthwhile, if the both of you are the folks behind it. So best of luck with it. Guys, you gotta come back on and give us a progress report, maybe in a month or so, what do you think?

    Gary Gruver: Yeah, sounds good to me.

    Alan Shimel: All right. All right, go check out, look, if you’re interested in learning and learning right, about continuous delivery, about dev ops, about, you know, leading the transformation, engineering the transformation, check out this series of questions. I think you’ll find it worthwhile. Gary, Dave, thanks for being on TechStrong TV. We’ll talk to you soon.

    Gary Gruver: Sounds great. Thanks for having us, Alan.

    Dave Farley: Thank you. Bye.

    Alan Shimel: Bye-bye.

    [End of Audio]