Tag: continuous delivery

  • DevOps for the Rest of Ops

    DevOps for the Rest of Ops

    The IT pro gig usually includes a basic headwind. They’re part of a cost center, and budget for resources and staff are limited by design unless they’re managing a strategic initiative, which—at least for a while—is more generously funded.

    Early adopters of DevOps, Agile or site reliability engineering (SRE) teams have been budget beneficiaries when tied to transformation projects—as has always been the case for high-visibility IT initiatives. Fortunately, DevOps has proved more helpful and stickier than some other “next big things,” and for some organizations it’s the engine behind growth and even actual digital transformation success.

    IT pros—pragmatic as always—have taken note of DevOps potential, even while keeping lights on, systems up and reliably delivering the critical services businesses have depended on for decades. The question for IT leaders is, how can IT teams realize some of the benefits of DevOps, while operating inside traditional IT organizations?

    As DevOps has finally slid off the hype peak and into the shed of useful tools, experience has distilled out a couple of conclusions. First, the tenets of DevOps—breaking down walls, shared feedback loops and learning to love automation—don’t only apply to new or cool apps. They’re even more helpful in traditional IT. For example, the rise of automation isn’t driven by a conspiracy to replace admins with robots, it’s a necessity to shrink the toil of manually wrangling all the new complexity of cloud and cloud-native tech on-premises.

    Second, many of the ideas behind DevOps and resulting practices are a direct attempt to fix issues in IT that have frustrated IT teams for years. Ask any IT pro if they’d like to move all deployment to Monday through Thursday, 9 a.m. to 4 p.m., instead of midnight Saturday nights. That team will go nuts for CI/CD. Better, it turns out you don’t have to do all the DevOps things to get many of its advantages.

    But even if your business still operates from the C-suite down, entraining quarterly budget spending, waterfall models and lots of walled silos, there’s an opportunity to adapt DevOps processes and culture to deliver progress on truly transformative initiatives to help grow the business. The trick is figuring out which DevOps practices are valuable and which ones are more useful to developers.

    Luckily, focusing on just four can get your team most of the benefits without (much) disruption, and development teams are eager to share its growing body of new techniques and successes. We’re working in an interesting epoch of IT history, a potential democratization of DevOps for everyone, DevOps for the rest of ops.

    Continuous Delivery

    Until recently, some IT pros were skeptical, even suspicious that the development teams’ goal has been to automate them out of a career. Others felt developers were demanding everyone to learn how to program full-stack and invent a way to move fast and break things just as they can (more safely) do. A few admins have even had unpleasant encounters with some DevOps proponents when they showed interest. Nobody likes reflexive replies, such as “You use Oracle and DB2? Switch to MongoDB and come back later” to eager 101 questions, even if they’re just from a handful of community members. It’s especially unpleasant for developers and IT pros alike because that’s not how operations works. We share, we’re open, we’re helpful. We came to tech to help end users get more out of technology.

    Instead, successful teams often start by identifying tools supporting fundamental operations goals, without the distraction of any particular technology or vendor, and seek buy-in from both developers and ops. Because if you’re in operations, you’re the team that must:

    1. Find a way to get software into reliable production.
    2. Maintain functional, useful governance.
    3. Maintain apps for years more than anyone thinks they’ll possibly be online.

    Operations knows this because it has always been the last mile of delivery and deployment, it cares about availability and SLAs, and defines process for breakfast.

    One of the first tools associated with DevOps is CI/CD pipelines, which are literally implementations of automated policy about how code goes from origination to production. But, overlooked in many DevOps blogs is the last step of CD because it’s not for the faint of heart. That’s unfortunate—operations is good at figuring out that last mile.

    When operations teams embrace CI/CD/Continuous Deployment, they’re rewarded for investment in automation in the best possible way: less night and weekend work. As a result, the pipelines they build aren’t ephemeral experiments but production-grade CI/CD because it’s part of production itself. And as change velocity increases and error rates decrease, many teams refuse to go back to manual deployment unless they’ve exhausted all other options. Pipelines don’t replace IT pros, they improve work-life balance.

    When the operations teams present developers with standardized, battle-tested nozzles through which changes get more quickly deployed with fewer errors, the reaction is usually excitement. It allows developers to mate their build, unit test, packaging and delivery head ends to the typically complex delivery/deployment operations pipeline. Best of all, ops teams tend to include monitoring, security and even cost governance into their processes, resulting in effective controls being automatically and reliably applied. Further, ops metrics create and enrich the feedback loops dev need to improve code over time based on real-world performance, not dev or test data. In environments like that, culture change is more organic based on shared goals, success and the flexibility to let each team do what they enjoy most.

    Start Breaking Stuff Fast

    Operations teams can have a little envy when it comes to breaking things. They’re technologists just like developers, and like most people attracted to technology, they like to learn by disassembling, recombining and otherwise hacking tech to learn the intricate details of how it works. But unlike a developer testing code, experimental configurations or other normal laptop environment one-offs, operations absolutely can’t experiment. IT is risk-averse by commandment, for good reasons.

    “Get a lab!” sounds like an obvious suggestion, and it is—but it’s a great example of easier said than done. Because IT is a cost center, labs are often seen as duplication and waste because their value is harder to justify in a budget presentation. But with a little unconventional use of the monitoring data you already have, that’s not necessarily true. Operations regularly correlates change events with performance histograms in the ongoing search for improved reliability. Consider adding before and after metrics to changes tested in a lab environment first. You’ll likely find you can prove the more realistic the pre-deployment testing, the lower the error rate and higher the performance of that system.

    But the mechanism behind improved quality isn’t the lab itself or data it produces. It’s the team’s experimentation—and some blood, sweat and tears shed—impossible in a production environment. IT also allows operations to invite developers to go on deployment and tuning ride-alongs. Developers can use whatever tools they prefer, make changes, probe and otherwise disassemble the lab stack as needed. And from a communications and culture perspective, this can be helpful.

    Operations lab environments also allow IT pros to separate hype from reality on their own. They can install the latest shiny new tools for evaluation, try new methodology or even test significant platform architecture redesigns. In short, they can break whatever they want without affecting production and provide both feedback to developers and a place for dev to experiment with changes. Here again operations can be the lead, with new avenues for communication, cooperation and culture change.

    Monitor Your Success

    Most developers aren’t data driven, they’re functionally driven. They love data-informing design and are good with tools that wrangle it into something useful, but at the end of the day their job is to build code that does things. IT pros have monitoring in the DNA because detailed performance data collected over time is how they initially validate hunches but also break down conclusion bias. But while everyone seems to understand the value of metrics and data, it’s not usually considered a tool for DevOps communication.

    As mentioned earlier, feedback loops are a fundamental principle of DevOps. Changes go into production, production generates data sent back to developers to guide future changes to further improve service quality. It’s a virtuous cycle, and both teams value it highly. The trick is in creating a language between dev and ops about what to collect, how it’s used and the stewardship of feedback over time. Step one is to sweep away preconceptions on both sides and start fresh.

    A common approach is to bring a small—one-pizza small—team together and start with a blank whiteboard. The goal is to matrix the inventory of what’s already available with what’s helpful, then identify gaps for both teams. Development teams are hungry for the incredible richness of coverage operations can offer, while operations is eager to mine new instrumentation the development team relies on for troubleshooting and internal application performance monitoring (APM).

    APM for hybrid applications is a great example of both teams learning how to create ensemble visibility into hybrid on-prem/cloud-native services. High performing operations teams ensure they add metrics dev teams need, and developers discover that the “impossible” information to debug pesky apps has been collected for years and is an API call away. Once again, a little conversation can lead to relief, and earned changes to hearts and minds.

    Reward Success With Big Dreams

    The final common experience of developers and IT pros both are never really done. Code can always be improved, and service delivery can always get better. But because we’re human, sometimes we get tired, stuck or bored, and it’s easy to take a break, especially after a big win. That’s natural. There are years of deferred work and technical debt lying around, and no time for perfectionism, especially in enterprise IT. This critical aspect of DevOps needs to remain a focus of any team adopting DevOps techniques—remembering DevOps is never done. It’s a culture of continuous, collaborative improvement and evolution. This shared understanding sustains the bonds between dev and ops.

    When teams innovate, when they continue forging closer relationships and when they share improvements as the team culture changes, they start asking bigger questions. We’re conditioned in IT to accept that certain things can’t be achieved because, reasons. As a result, sometimes suggestions and questions that could finally resolve the team’s most bedeviling challenges might not always be made or asked.

    Track your “impossible” ideas which drive progress, then promote successful ones while sharing details of why they worked. This in turn helps socialize the value of success resulting from openness and encourages great ideas that may have been sitting on the bench for a long time.

    Again, you’re investing in more metrics and signals, but not limited to performance data. When you dream big, especially as you untangle the enormous expectations of digital transformation into operations changes, you’ll start to rely on new metrics. For example, business metrics tied to corporate objectives, behavior signals accurately reflecting CSAT, change and error rate data helping teams decide when to add new versus when to fix and new ways to assure leadership operations have everything under control. When managers are confident IT pros can safely transform gear, services and staff without interrupting the business, the most sought-after DevOps goal can come into focus: A new freedom to innovate at speed.

    — Patrick Hubbard

  • Small Teams Focused on Delivering Outcomes Produce the Best Results

    Small Teams Focused on Delivering Outcomes Produce the Best Results

    The days of big team consulting are over. Technology organizations are aligning their budgets to get projects done faster and more agilely. More applications are being built by small teams of cross-functional engineers moving fast, providing higher quality code, designing away waste and cutting out processes that don’t add value.

    It’s becoming apparent that engagements incorporating smaller footprints and shorter iteration cycles are more common. The best outcomes are where an engineering team is small, lean and iterating many times faster than much larger teams. That means that enterprises get their applications to provide value earlier and at lower cost, and they cost less to maintain over time, starting right away. It means applying higher quality and better managed teams using core engineering principles. It means cross-functional technologists, not cross functional teams working in silos in their specialties

    The catch is: How do you incorporate that at enterprise scale? It’s not easy to do because there is a lot of internal resistance and inertia. And many organizations will not achieve this.

    Agility and priorities are key here. Future thinking organizations don’t waste this effort on trying to knock out backlog. They make sure they’re applying themselves in a targeted fashion and they drive velocity higher on things that matter. It’s not about providing spot fixes. Don’t start with building a CI/CD pipeline or an AWS migration. Work with your engineering team on driving down the overhead that’s slowing down the delivery of your platform.

    It’s not about using this tool and that tool, and this programming language and that platform to host it, and that it will integrate a certain way, and you are now able to say that you are delivering in a continuous integrated fashion. You should get continuous delivery set up. However, continuous deployment is one step. What you really want to do is reduce costs by 20% and reapply that to a feature that you’re looking for next quarter, instead of waiting till next year. You can restructure the conversation because from the get-go you front load the delivery strategy with those kind of performance terms. And this is real money. We are applying these processes where customers are paying for software to be delivered.

    What doesn’t work is “Let’s do some DevOps over here, and then maybe a little over there and make incremental progress.” Spend resources doing principled engineering all in the same application—not bits and pieces in various places and hope to bring it together at some point

    One way to know if you are doing DevOps—or any cloud related engineering—better is that you have a better grasp of Amazon’s APIs than Amazon does. Literally, the best companies release updated APIs for Amazon before Amazon releases their new APIs. That’s how good they are.   

    Different organizations move at different rates with an understanding of DevOps. Some people still say “Get me a DevOps engineer.” Others say “Get me a DevOps’ culture change,” which is OK. But, really smart organizations are asking for small engineering teams to build high performance, high priority platforms quickly, at the lowest possible cost, using the best engineering principles available.

    One other way to know that you are doing good engineering and DevOps is when you need DevOps engineers and you talk to a big consulting outfit and they say, for example, that you need 65 SREs with different skill expertise, four project managers, a bunch of data scientists and product people and client partners. They say it’s going to be really expensive and that they’re going to be here forever, and that this is an engineering challenge. Let’s address it from that POV. The engineers are running it, the engineers are closest to the work, they understand the issues and the opportunities, and they just need 10 really good full stack engineers.

    The name of the game now is applying engineers that clearly have a specialty, but are more importantly good engineers with software and know how to write code well. You might have a platform engineer, which is going to be like your infrastructure SRE but he’s going to be knowledgeable and know how to write code at a basic level. That will work. You might have an engineer that isn’t the best software developer, but knows platforms, what clouds are available, how to offer it across those programmatically, etc. That will work, too.

    The bottom line is moving initiatives that are focused on building revenue or saving a lot of money and driving them forward at a higher velocity, with higher quality delivery at their product launch through foundational concepts, such as continuous integration, continuous delivery and continuous deployment. Leading organizations are focused on doing that in a way that is future-forward, focused on stateless and serverless infrastructures.

     

     

    This article was co-authored by Jack Keck. Jack is a seasoned technologist leading a cross-functional engineering organization at a global investment bank. He spearheads transformative initiatives with the goal of raising revenues through the use of future forward technologies.

    — Larry Gordon

  • OverOps Allies With SonarQube To Improve Application Quality

    OverOps Allies With SonarQube To Improve Application Quality

    OverOps, a provider of tools for dynamically analyzing code at runtime, has partnered with SonarQube, a provider of static analysis tools for source code, to enhance application quality by unifying code analytics.

    Chen Harel, vice president of product for OverOps, said the two companies have collaborated to create a plugin through which DevOps teams can now more easily analyze source code before it gets deployed in a production environment.

    The goal is to equip DevOps teams with the tools required to assure application quality as more responsibility for maintaining applications continues to shift left on to the shoulders of developers, said Harel. In the absence of tools to analyze code, he noted, developers are not going to be able to identify, for example, potential vulnerabilities in source code and errors at run-time.

    The plugin also allows issues identified by OverOps at runtime to be fed back into the SonarQube tools for analyzing source code to identify issues that previously would not have been discovered, he added.

    Specifically, when the OverOps plugin is installed, it automatically creates an event rule for Java code based on new, critical, resurfaced and unique runtime errors. When a quality gate fails a release based on these criteria, users can view the issues directly within their SonarQube dashboard. OverOps then provides a direct link to the event analysis containing the full context behind the error, including the stack trace, variable state and system state.

    As a result, Harel said DevOps teams are going to be able to reproduce an issue much faster, which should result in much shorter times to remediation. Without such tools, DevOps teams can spend weeks reproducing an error that only takes a few minutes to actually fix.

    Harel said with both the OverOps and SonarQube tools included as part of the gates set up within a continuous integration/continuous delivery (CI/CD) platform, it becomes possible to substantially improve the overall quality of the applications being developed. That’s critical because developing applications faster often results in more errors having to be addressed, said Harel.

    There’s a lot of debate these days concerning the degree to which the adoption of DevOps might be increasing the total cost of IT. It’s a lot more expensive to fix an application after it’s deployed in a production environment than it is to address issues as they arise in the application development process. As such, there’s a lot more focus on code analytics to help ensure that DevOps processes are churning out not just more code faster but also higher quality applications.

    Of course, the level of DevOps sophistication tends to vary widely by organization. However, as more gates that address application quality assurance are erected on CI/CD platforms, the better the DevOps outcome will become. The challenge is making sure the DevOps culture being fostered prizes application quality as much as it does how much code is being written and deployed how fast.

    — Mike Vizard

  • 2nd Watch Allies With GitLab for Managed DevOps Service

    2nd Watch Allies With GitLab for Managed DevOps Service

    2nd Watch today launched a managed DevOps service based on the continuous integration/continuous deployment (CI/CD) platform from GitLab that it will operate on behalf of customers in addition to coaching them on how to adopt best DevOps practices.

    Stefana Muller, a senior product manager, said the 2nd Watch Managed DevOps service combines the managed and professional services capabilities of 2nd Watch into a single offering. That approach is required because when it comes to DevOps most organizations need as much help transitioning their culture as they will operating their CI/CD environment, she said.

    One of the major challenges organizations face when trying to embrace DevOps is they typically spend a lot of money upfront only to see those efforts flounder when changing the internal culture of the organization becomes too difficult, Muller said. As part of an effort to smooth that transition, 2nd Watch DevOps experts will assess an organization’s readiness to adopt DevOps tools and processes and then train internal teams on DevOps fundamentals such as managing infrastructure as code and Git principles. The assessment is based on a Culture, Automation, Lean Practices, Measurement and Sharing (CALMS) methodology.

    The 2nd Watch service is built around an on-premises edition of the GitLab CI/CD platform that it will host and upgrade on behalf of a customer on either an Amazon Web Services (AWS) or Microsoft public cloud platform. The DevOps service will focus on enabling organizations to build both monolithic and microservices-based applications faster because no organization today has fully transitioned to microservices. The company already provides a managed Kubernetes service for building and deploying applications based on a microservices architecture.

    2nd Watch chose to partner with GitLab because of the completeness of that CI/CD platform, which among other things includes integrated security modules that can be employed to advance DevSecOps practices as well, Muller said, noting that longer-term, 2nd Watch is planning to layer a more robust set of managed DevSecOps services on top of the GitLab platform.

    Managed DevOps offerings are starting to proliferate as the number of services providers that have attained certifications from multiple IT vendors has increased. It’s not clear to what degree organizations will prefer to rely on these services just yet. However, it’s is apparent many organizations are trying to shift as much of their limited resources to building application code versus managing IT infrastructure. It’s also possible that as the COVID-19 coronavirus pandemic becomes more widespread many organizations will need to rely on external service providers to manage their DevOps environments.

    Regardless of the motivation, organizations that are at the beginning of their DevOps journey clearly will need more help than those that are further along the DevOps maturity curve. The decision most organizations will need to make is to what degree will they rely on a managed DevOps service to accelerate their transition versus opting to rely permanently on an external IT service provider to manage one of their most critical IT environments.

    — Mike Vizard

  • Scaling DevOps for the Enterprise

    Scaling DevOps for the Enterprise

    Information technology has been an integral piece of the modern enterprise for multiple decades and that dependency is only growing. With digital transformation, there’s the inevitable increase in demand for new applications. As such, software development services will continue to be a vital component of the business amidst the mounting pressure to innovate and deliver. This has resulted in many organizations moving from traditional development practices to more flexible and agile methodologies. Conventional software delivery methods are also being replaced in favor of enterprise DevOps practices such as continuous integration (CI) and continuous delivery (CD).

    While DevOps stimulates innovation and speeds up software delivery, adopting DevOps practices does not guarantee success as there are times when companies have been underwhelmed after implementing DevOps practices across their development teams. Knowing this, it is important to state that most DevOps failures come down to flaws in the execution of the methodology. A best-practice DevOps implementation should increase the value and impact of IT infrastructure by bridging new and old technologies. This allows for companies to better navigate change with clear time-to-value merits and lower risk. In short, it’s about scaling DevOps practices with security and quality embedded every step of the way.

    Look for Small Wins and Build on What Works

    Implementing DevOps best practices can mean a radical shift from the way an organization currently works. It is important that the entire team buys into this new approach. However, different dynamics within different organizations can lead to different results.

    Ideally, you should never have large complex projects. The best approach would be to work in small batches where you and your team can quickly learn from your decisions. By identifying the bottlenecks causing the largest constraints in your delivery process and incrementally changing, transforming and optimizing, your team could demonstrate the advantages of the new DevOps practices and build confidence in the team’s ability to implement the new methodology. Wins like these give a great start to the project before you’ve even introduced the entire IT organization to the changes needed to implement DevOps best practices. 

    Break Down Organizational Silos

    Known as well-intentioned areas of specialization, organizational silos are defined within the business to sharpen expertise and assign roles. Silos may have unintended consequences over time though, as each department potentially starts paying less and less attention to the other departments as they become consumed by their own assignments. As a result, silos inadvertently limit collaboration and have the potential to contribute to delays, bugs and conflicts. This is why C-level executives must initiate the process of removing the barriers to these silos and integrating the different disciplines within the IT department.

    For DevOps to work across the enterprise, executives must reorganize the configuration of software development projects by bringing in representatives from all important IT disciplines.

    Everyone Needs to Be on the Same Page

    Sometimes silos can be deeply rooted in an organization, and even if you do succeed in removing the barriers, there’s always the risk that they could re-emerge. Due to this, it’s important to create motivation for a silo-less enterprise.

    Anyone wanting to change a culture needs to define the actions and behaviors they desire, and design the work processes that are required to reinforce those behaviors. If your ops team is measured only by mitigating risk and your dev team is measured by delivering change, it goes without saying that you have a conflict.

    Through the incorporation of intra- and inter-team collaboration metrics into individual and team performance reviews, you can base a considerable amount of the review on lead times and quality metrics for software delivery. This is important not just for the dev and ops teams, but also QA and security. It’s easier to act your way to a new way of thinking rather than think your way to a new way of acting. 

    Real-Time Visibility Across the Toolchain and Environments

    When a team has poor visibility of their system, it can result in bad decisions and missed opportunities. Teams must replace manual project and release tracking methods that use spreadsheets and emails with an open, web-based solution that your team can leverage to plan, track and govern the entire application release management process.

    As teams and their stakeholders need real-time visibility across the entire DevOps toolchain and production environments, it is important that the chosen solution enables product team members to focus on their critical tasks while providing pertinent real-time information to their managers and stakeholders. 

    Don’t Lose Sight of the End User

    Once deployed, the application or service will interact with existing, and quite often, new systems. As it is developed for use by humans, don’t lose sight of the end user. Their satisfaction determines the success of your application or service.

    Actively involve users every step of the way, not just at the ideation and product requirements level. Teams should take the appropriate time to properly assess and fully understand the issues, challenges, priorities and constraints of their users. This knowledge can be utilized to define key performance indicators (KPIs) and continuous feedback throughout the DevOps toolchain.

    Move Forward on Orchestrating Continuous Delivery

    There’s no question that a lot of work goes into preparing and deploying a release. With the goal of delivering releases that have a high impact, it seems that companies sometimes choose to hold and then bundle together multiple application improvements into a single release. Such a strategy can lead to poor quality and failure—a result of deploying large infrequent releases. As another key driver toward an increased need for orchestration and automation, a lack of skilled employees means that many organizations have trouble releasing software in a reliable manner.

    The orchestration of continuous delivery is a fairly new way of planning and delivering business applications across the enterprise. With a focus on continuous improvement, continuous integration and ensuring you are always ready to deliver what the business needs, release control and deployment automation are vital to ensuring smooth delivery and a basis for governance.

    Conclusion

    The implementation of DevOps is a long term commitment. More a philosophy directing how you work, DevOps is not a rigid set of practices like ITIL, lean or Agile development.

    No organization will reach a state where it can comfortably say it has perfected its DevOps best practices model. Instead, it must continuously experiment with new processes, capabilities and tools identifying those that can yield the highest possible integration across the entire DevOps toolchain to deliver the best value for the business.

    — Mark Levy

  • Wind River Launches CD Platform for Embedded Systems

    Wind River Launches CD Platform for Embedded Systems

    Wind River is fostering the adoption of DevOps processes for embedded systems by making available a continuous delivery (CD) platform that its customers can download.

    Glenn Seiler, vice president for open source strategy for Wind River, said the CD platform is based on an open source instance of the Jenkins continuous integration/continuous delivery (CI/CD) platform. The company envisions organizations downloading the platform as source code that Wind River will update regularly for use on top of the Wind River Linux platform, he said.

    Wind River is taking advantage of containers, Kubernetes, the Puppet IT automation framework and a repository to ease deployment of its CD platform, added Seiler. The company is committed to providing updates to that platform, which Wind River uses internally, at least every three weeks, said Seiler.

    Wind River expects most organizations will already have some form of a CI process in place. The CD platform provided by Wind River will focus on accelerating the delivery of applications built using whatever CI process organizations have in place today, said Seiler.

    In the embedded systems space, Seiler said the adoption of best DevOps practices is still in its very early days. However, with the rise of edge computing and the internet of things (IoT), organizations will need to find a way to securely deploy and update highly distributed application environments. To achieve that goal, many organizations will apply the same DevOps principles enterprise companies have been applying to their embedded systems, he said.

    To ensure the integrity of the software supply chain on which the Wind River CD platform is delivered, Wind River has also been certified under the ISO 9001:2015 specification for management processes, as well as the OpenChain specification for open source compliance.

    Wind River also has the Wind River Workbench for Linux LTS, based on the Eclipse integrated development environment (IDE), along with various system analysis tools including a trace visualization tool from Percepio AB to identify the root cause of anomalies.

    While it’s taken more than 10 years to drive the adoption of best DevOps practices in the enterprise, adoption in embedded systems environments should be faster now that the journey has begun. Organizations of all sizes are pushing more application workloads to the edge at faster rates. Traditional approaches to building and deploying applications on standalone embedded systems will not be able to keep pace. Organizations that build applications for embedded systems will be challenged by first acquiring the right tools and then adapting their internal culture to the complexities that arise when they need to build and deploy applications faster.

    Wind River is making the case for a curated open source CD platform that should enable organizations to spend less time on managing the underlying DevOps platform in favor of focusing more time and energy on changing their internal culture.

    — Mike Vizard

  • How to Successfully Adopt Mobile DevOps Practices

    How to Successfully Adopt Mobile DevOps Practices

    Mobile DevOps is more than simply adopting a new set of tools and practices. It also comes with the need to adopt a completely different mindset, in the form of a cultural-organizational change. The approach is based on the Agile methodology, but takes its practices further— not only by getting other teams more involved, but by replacing function-based teams with product- and project-oriented teams as well. The main idea behind this is that nothing inspires collaboration like having a common goal and working together towards reaching it. 

    Let’s take a look at the key elements of Mobile DevOps practices.

    Continuous Communication and Planning

    The goals and purposes of Mobile DevOps correspond with the original DevOps principles, such as customer satisfaction, sustainability, enhanced teamwork and shortened software development lifecycles. Similarly to DevOps, it aims to resolve problems by using common sense and implementing a culture of shared responsibility, transparency and shorter review cycles. In mobile development, constant and interaction-based communication between developers, website, product and QA teams is particularly important in order to accelerate feedback loops and consequently, resolve issues faster. In Mobile DevOps, there is more focus on transparent, traceable documentation, which can be achieved by using a source control system that helps keep track of documentation of code changes and details of the whole process. Raised visibility also helps teams share the workload—especially when it comes to unexpected work—and to fix incidents, and unblock the release pipeline rapidly. 

    Continuous Integration, Delivery and Deployment

    The Android and iOS operating systems are dominating the current mobile landscape, and both of them—especially Android—are incredibly fragmented. For this reason, it is necessary for developers to maintain separate builds, depending on the many supported versions, device types and platforms. A stable CI/CD tool ensures that the codes created by different teams are compatible with each other and new ones can be integrated into previous ones with no issues. These tools eliminate the manual aspects of app development from planning, code testing, integrations to deployment and monitoring, and automate as much as possible throughout the entire lifecycle of app development, which ensures the seamless merging of codes and reduces the risk of errors. Device fragmentation is the main reason why Mobile DevOps and CI/CD automation are inseparable in any team that wants to automate their app development, their testing and their monitoring processes. 

    Continuous Testing and Monitoring

    Mobile applications have to go through rapid iterations and more frequent releases than web applications. This results in new features in the app which are not always supported in the production environment at the time of the release. To understand the quality level and potential risk of each new release, mobile app companies can conduct different types of tests—ranging from automated unit and UI interaction testing, all the way to manual QA testing—depending on the maturity of the app and the size of the team. Besides implementing an iterative process for testing, adding monitoring and real-time performance tracking tools are all crucial in mobile app development. Not only do these enable teams to find the root cause of failures faster, but to save on hardware costs as well. Adding third-party SDK, performing crash reports and continuously monitoring both the app performance and the feedback in the app stores all help developers constantly improve the quality of the app. 

    Conclusion

    DevOps is just as much about the culture as it is about technology. Successfully adopting Mobile DevOps requires all teams at app companies to make important technical and business decisions, have a hard look at their processes, identify the bottlenecks and be prepared to make significant changes. The essence of Mobile DevOps not only lies in a mindset change and choosing the right tools, but also in close-knit teamwork that allows teams to focus on market needs, user behavior, feedback and other factors that significantly affect the product perception.

    — Nóra Bézi

  • Why Is QA so Important in Executing a DevOps Implementation Strategy?

    Why Is QA so Important in Executing a DevOps Implementation Strategy?

    In a rapidly growing global digital landscape, enterprises are facing many challenges. These include changing customer behavior and the need to be in line with the latest technology trends. To address these challenges and to stay up the competition curve, enterprises are adopting a slew of strategies. These comprise expanding the capacity of processes, quick quality checking and delivery of applications and timely marketing of the applications. This is where DevOps comes as a one-stop solution to the aforementioned requirements. 

    When it comes to assuring the quality of software applications, the Agile and DevOps model of testing is favored over the traditional waterfall model. This is because software applications need to be tested across a swathe of platforms—devices, browsers and operating systems. In the DevOps scheme of things, software builds are continuously integrated and deployed in the development pipeline by using test automation. It involves the development and implementation of new features along with the streamlining of processes. 

    What Is DevOps?

    DevOps is an amalgamation of terms “development” and “operations” and is underpinned on four basic pillars—culture, tools, collaboration and practices. Combining processes and philosophies, the DevOps approach helps enterprises deliver quality builds in the SDLC. Here, development and operations teams no longer work in silos but in close coordination with each other. As a result, quality becomes a shared responsibility and a culture of accountability gains ground. DevOps implementation leads to the quick development and deployment of quality builds, faster solving of critical issues and engendering greater trust and confidence.

    Let us understand the best DevOps implementation strategies to derive outcomes such as continuous integration (CI) and continuous delivery (CD). To begin with, getting the QA basics right the first time and every time should be considered as part of the strategy. This is due to the fact that in a pure DevOps ecosystem, the lines between development and QA are blurred.

    Test Automation

    Since the software needs to have an omnichannel interface with third-party applications to perform optimally, the test process should be automated. There should be a smooth QA-DevOps alignment to detect and mitigate glitches early on in the SDLC. Thus, DevOps testing may involve choosing automated tools that are either open-source or commercial. 

    Teams Merge

    To derive DevOps transformation, the integration of the QA team with other technical specialists becomes important. The final DevOps team should adapt a culture wherein identifying glitches becomes a shared responsibility. 

    Metrics

    Since DevOps testing is all about quick identification and fixing of glitches, the metrics should be defined at the beginning. It will help the DevOps team to stay focused on the challenges and requirements. This calls for the QA engineers to setup test requirements into the workflow and guide the team therein.

    Virtualization

    The software application should be tested across a slew of platforms—devices, browsers or operating systems. Since it is well-nigh impossible to test the codes for numerous users (during usability testing), the same ought to be created virtually. The QA team can virtualize every test requirement to emulate the behavior of software components. Moreover, it helps to do away with the need for dependencies and addresses constraints faced in interdependent environments.

    Choose the Right Tools

    To enable DevOps automation, the QA team should choose the right test automation tool. The main criteria for choosing the tool should be the team’s expertise in using it. The tool should offer the ease of writing the test script in a single programming language. It should allow the testing of applications across operating platforms and browsers.

    Continuous Integration and Continuous Deployment

    These are the outcomes of any DevOps methodology. DevOps continuous integration and deployment encompass adding code changes in a repository and creating automated builds. This leads to an early recovery from failures as well as testing and delivery of products within fast turnarounds. Continuous integration based on test automation leverages regression testing and a version control system when a new code is added. Further, DevOps continuous deployment is about the capability to add new features to the existing applications. This makes enterprises follow a user-driven improvement of software and agile approach.

    Conclusion

    With the quality of software applications becoming the final arbiter in making an enterprise successful, taking the DevOps approach is crucial. However, since the whole process is hinged on executing comprehensive quality testing, the QA basics should be done right.

    — Akshaya Choudhary

  • Best of 2019: The Time Has Come for an Engineering Approach to DevOps

    Best of 2019: The Time Has Come for an Engineering Approach to DevOps

    As we close out 2019, we at devopsy.kinsta.cloud wanted to highlight the five most popular articles of the year. Following is the third in our weeklong series of the Best of 2019.

    Do you want to know how to do DevOps? Are you doing DevOps but not satisfied with the results you are getting? DevOps is complex. It does not come with a prescription, installation guide, user’s manual or maintenance manual. It doesn’t even have a standard definition. How can anyone expect to get good results with DevOps without clear and definitive guidance? There are plenty of books that describe different aspects of DevOps and customer user stories, but up until now there has not been a book that frames DevOps as an engineering problem with a step-by-step engineering solution and a clear list of recommended engineering practices to guide implementers.

    My book, Engineering DevOps: From Chaos to Continuous Improvement … and Beyond, provides a step-by-step engineering prescription that can be followed by leaders and practitioners to understand, assess, define, implement, operationalize and evolve DevOps for their organization. It provides a unique collection of engineering practices and solutions for DevOps. By confining the scope of the content of the book to the level of engineering practices, the content is applicable to the widest possible range of implementations.

    This book was born out of my desire to help others to do DevOps, combined with a burning personal frustration. The frustration comes from hearing leaders and practitioners say, “We think we are doing DevOps, but we are not getting the business results we had expected.”

    There are many documented references, courses and other sources of information that explain a multitude of different aspects of DevOps, but there is not a comprehensive step-by-step prescriptive guide that details how to engineer a DevOps solution for any organization given any starting point.

    Engineering DevOps takes a strategic approach, applies engineering implementation discipline and focuses operational expertise to define and accomplish specific goals for each leg of your DevOps journey. This book guides the reader through a journey from defining an engineering strategy for DevOps to implementing The Three Ways of DevOps maturity using engineering practices: The First Way (called “Continuous Flow”) to The Second Way (called “Continuous Feedback”) and finally The Third Way (called “Continuous Improvement”). This book is deliberately intended to be a guide that will continue to be relevant over time as your specific DevOps, and DevOps more generally, evolves.

    Structure of this book

    This book is organized as an engineering reference guide presented in five parts as follows:

    Part I: What Is Engineering DevOps and Why Is It Important? is organized into three chapters. Chapter one, “What is Engineering DevOps?,” explains engineering concepts and terms used in this book that have proven to work with many clients I have encountered during my consulting experiences. My depiction of a DevOps Engineering Blueprint is presented for as a useful, practical “big-picture” reference for discussing engineering the major parts of DevOps. Chapter two, “Nine Pillars of DevOps,” describes a classification of DevOps practices that I have found to be useful characterization of DevOps engineering practices readily applied when engineering DevOps implementations. Chapter three, “Why Is Engineering DevOps Important?,” explains the benefits of taking an engineering approach to engineering DevOps.

    Part II: Engineering People, Processes and Technologies for DevOps provides a comprehensive explanation of recommended engineering practices for the higher levels of the DevOps Engineering Blueprint. DevOps transformations are not normally understood or applied using strict engineering principles. Engineering practices are presented in nine chapters. “How Should DevOps Be Engineered?” includes a discussion of DevOps Engineering Maturity Levels for each of the Three Dimensions (People, Process, and Technology), Twenty-Seven DevOps Engineering Critical Success Factors and Lean DevOps Value-Stream Pipeline Engineering.

    I describe recommended engineering practices for the top layers of the DevOps Engineering Blueprint in the next chapters, which include “Value-Stream Management (VSM),” “Application Release Automation (ARA),” “Version Management,” “Continuous Security (a.k.a. DevSecOps),” “Service Catalog,” “Governance,” “Site Reliability Engineering (SRE),” “Disaster Mitigation” and “Recovery.”

    Part III: Engineering Applications, Pipelines, and Infrastructures Engineered for DevOps provides a comprehensive explanation of recommended engineering practices for the lower levels of the DevOps Engineering Blueprint, presented in six chapters as follows: “DevOps Applications Engineering,” “CI/CD Pipelines Engineering,” “Elastic Infrastructure Engineering,” “Continuous Test Engineering,” “Continuous Monitoring Engineering” and “Continuous Delivery and Deployment Engineering.”

    Part IV: DevOps Seven-Step Transformation Engineering Blueprint provides a description and tools for my approach to realize and evolve DevOps. The seven steps are Visioning, Alignment, Assessment, Solution Engineering, Realization, Operationalize and Expansion. By using these tools, DevOps leaders and practitioners can create, implement, operate and expand their DevOps across the organization. The chapter goes further to explain how to evolve DevOps from a successful First Way DevOps (Continuous Flow) toward realizing more advanced Second Way (Continuous Feedback) and Third Way (Continuous Improvement) DevOps implementations. This part includes a discussion of “Beyond Continuous Improvement”—a look at emerging technologies shaping DevOps in the future, and how you can prepare your DevOps and yourself for the future. This part includes a discussion of how to set up an effective DevOps engineering training program that supports continuous learning of DevOps engineering skills needed to maintain and enhance DevOps.

    Part V: Appendices, Continuous Learning, and References includes materials and sources I have found most useful for engineering DevOps.

    To get a copy of my book “Engineering DevOps: From Chaos to Continuous Improvement … and Beyond,” or start reading for free, click here.

    — Marc Hornbeek

  • Synack: DevSecOps Being Accelerated by Cultural Shifts

    Synack: DevSecOps Being Accelerated by Cultural Shifts

    The 2020 State of Compliance and Security Testing Report from cybersecurity testing platform vendor Synack claims that some of the world’s largest organizations are encountering a significant cultural shift within their development teams, and that bodes well for those seeking to build DevSecOps teams. For the report, Synack surveyed leaders from more than 300 organizations representing a number of industries and verticals, including technology, government, health care, information technology and financial services. 

    According to the report, a large percentage of organizations and institutions are moving toward a rigorous, continuous testing model to ensure compliance. As part of this shift, organizations are utilizing crowdsourced security testing to achieve regulatory compliance and real security, with adoption expected to increase four-fold in 2020.

    Perhaps those companies are being driven by numerous new regulations on the horizon, including the  California Consumer Privacy Act (CCPA), PCI  DSS 4.0, New York’s SHIELD Act and  other proposed data compliance regulations. Or perhaps the shift toward continuous crowdsourced security testing is being driven by the failures some organizations have encountered with traditional security testing methods, which were performed less frequently and failed to keep up with the CI/CD (continuous integration/continuous delivery) pipelines that many organizations have embraced. 

    Simply put, Agile and DevOps application development and delivery methodologies were poorly served by the traditional, siloed security testing methodologies of the past. A realization that has driven many organizations to embrace the DevSecOps model, in which cybersecurity becomes part of the overall team, having equal standing with both development and operations team members. 

    Organizations pushing ahead with the DevSecOps model quickly realized that security toolsets and team member interactions must change to be successful. Synack’s research bears that out, and the report offers that the adoption of continuous security testing platforms is expected to increase by 4X in 2020.

    “The rapid embrace of crowdsourced security testing has happened because it is proven to work better than traditional security testing methods and addresses the ever-growing talent gap within organizations,” said Synack CTO and co-founder Mark Kuhr. 

    The report found security testing is becoming part of an organization’s normal routine, rather than a once-a-year check of the box focused only on compliance. According to the report, 44% of the organizations and institutions surveyed perform security tests on a monthly or weekly basis, suggesting that they are moving toward a continuous model, which is further enabled by crowdsourced solutions.

    The report also revealed that some 63% of organizations commonly use external vendors to identify and reduce vulnerabilities. However, 52% experience unwanted cost and complexity due to overlap in functionality from using multiple security vendors. Those two data points demonstrate that simplification provided by leveraging a single security testing platform could deliver savings. Synack claims crowdsourced security testing solutions provide 147% higher ROI than a typical pen test and can decrease the burden of testing on organizations by reducing the signal-noise ratio. 

    “This shift toward continuous crowdsourced security testing will allow organizations and institutions to have the best of both worlds by procuring technology that offers efficient and effective results while fulfilling best practice standards such as NIST 800-53 to meet compliance objectives,” said Kuhr.

    “Although we are seeing a move toward a 24/7, 365 security culture at organizations in a wide variety of industries and geographies, there is still ample room for improvement,” said Aisling MacRunnels, Synack’s CMO. “Our survey found that on average, most security tests are lasting just 20 hours. As the number of cyber incidents continues to increase, it will be imperative for decision-makers to implement security testing solutions on a continuous basis with 1500-2000 hours of testing a year.”

    Those increased testing requirements will ultimately become the foundation to build a DevSecOps culture in most any organization bound by compliance regulations.

    — Frank Ohlhorst