devopsy.kinsta.cloud

Tag: devops

  • Fast Pass: Your Ultimate Guide to the Best of Jenkins World

    Fast Pass: Your Ultimate Guide to the Best of Jenkins World

    At the end of the month, Jenkins users and DevOps professionals from around the world will head to San Francisco for the annual Jenkins World conference, taking place Aug. 28-31. The conference lasts four days, but time flies when you’re attending trainings, keynotes, sessions and networking events. To make sure you get the best of everything at Jenkins World, we’ve put together a guide that will ensure you have the most productive and enjoyable experience.

    NOTE: DevOps.com readers can get 20 percent off registration with the code JWDEVOPSCUST.

    Take the Time to Develop Your Skills

    The first two days of the conference will be full of workshops and training sessions. Regardless of skill level, there are trainings for everyone. Those just getting familiar with Jenkins can attend an “Introduction to Jenkins” training for free and learn how to easily create pipelines while putting in place best practices for continuous integration (CI) and continuous delivery (CD).

    Those a bit farther along their Jenkins journey can attend workshops such as “The Final Mile: Jenkins Pipeline and Patterns for Operations,” where attendees will review patterns of common problems and solutions specific to operations teams in a CD environment , as well as how to create Jenkins pipelines that address the needs of operations.

    Don’t Miss These Essential Sessions

    All attendees should make sure they make it to each of the keynotes, of course! Keynote speakers include Sacha Labourey, CEO of CloudBees; Kohsuke Kawaguchi, founder of the Jenkins project; and Jez Humble, CTO at DevOps Research and Assessment LLC.

    In addition to top-notch keynote speakers, there are a number of DevOps professionals you’ll want to hear from while at the show. Try to attend at least one of these sessions:

    Keep an Eye Out For …

    Make sure you listen in to find out who the winners are of the first annual Jenkins World Awards Program. There are two awards tracks: Jenkins Community Awards and CloudBees Innovation Awards. Each track has several categories including Jenkins Contributor Award, DevOps Automation Excellence Award and more. Winners will be announced Thursday, Aug. 31, at the show.

    You’ll also want to stop by the sponsor expo hall to check out dozens of great vendors. As with any good conference, there will be plenty of swag passed out. Exhibitors will include GitHub, BlazeMeter, Docker, JFrog, Fugue, Sonatype and others. Don’t miss out on taking a photo with the famous Jenkins butler at the CloudBees booth!

    Can’t Forget to Network

    With so many great sessions to attend, don’t forget to make time for networking events. It would be a waste to not take advantage of dedicated networking time to speak with experts and peers who have likely dealt with some of the challenges your organization may be facing. There will be several networking opportunities, including a reception Aug. 30 sponsored by CA BlazeMeter. Or if you’re looking for ways to stay active, attend a scheduled walk or yoga class.

    If you can check off all of the above activities, you’re bound to leave Jenkins World a better professional! Make a checklist at the start of the conference to ensure you hit all the events and sessions you’re most excited for.

    If you haven’t registered yet, there’s still time! Use the promotional code JWDEVOPSCUST for 20 percent off.

    About the Author / André Pino

    André brings more than 20 years of experience in high technology marketing and communications to his role as vice president of marketing at CloudBees. He has experience in several enterprise software markets including application development tools, middleware, manufacturing and supply chain, enterprise search and software quality and testing tools. André has particular expertise in working with the executive teams of enterprise software companies to create unique competitive positioning, build pipeline and establish sustainable market leadership. Prior to joining CloudBees, he served as principal analyst serving technology marketers at Forrester Research. He has also held a number of senior management positions in marketing and communications with companies such as Segue Software, Hewlett-Packard, Unisys Corp. and Bluestone Software. André holds a BS from Eastern University.

  • DevOps Proves No Coaster Ride for Roller

    DevOps Proves No Coaster Ride for Roller

    Keeping amusement parks running and the fun flowing is Roller‘s main job. The company provides software for the leisure and entertainment industries, notably theme parks, amusement parks and trampoline parks. Its core functions are ticketing, POS and CRM. Clients include Coney Island Luna Park, Aussie World and Twinlakes Park.

    When Roller decided to expand and redevelop its operations in 2015, DevOps was the main attraction. CTO Andrew Brodie led the company’s push, having worked on Roller’s original implementation in his previous role as co-founder and technical director of digital product design studio Bravo!

    Automation of Roller’s processes was a major goal. Even small organizations should adopt good practices, Brodie says, and that includes automating everything that can be automated (within reason) to the point of being able to click one button to deploy a system.

    Before DevOps

    In its early days, Roller used Microsoft tools including Web Deploy to deliver a monolithic application that met the requirements of a minimum viable product. Roller initially ran on Ninefold, a now-defunct Australian IaaS platform.

    When the company attracted additional funding in 2015, it was able to expand its development team with people who had various skills including DevOps. Today, it comprises around 50 people—12 developers and various user experience, quality assurance and project management specialists.

    The newfound expertise enabled the redevelopment of the system as a series of applications and microservices and eliminating most frequently performed manual operations.

    Tools

    Roller’s deployment process had become a bottleneck, so the company invested time in adopting the most appropriate tools. Several came from HashiCorp, including Packer (for creating machine images), Terraform (cross-provider infrastructure management), Consul (service discovery, configuration and orchestration) and Vault (centralized storage and control of distributed secrets such as keys).

    After Ninefold’s demise, Roller became heavily involved with AWS, which “had everything we needed” in the way of APIs and toolsets “to code out our infrastructure,” Brodie says. But even though “we’re really happy with Amazon,” the company has avoided using exclusively AWS tools to retain the ability to move to other platforms such as Azure.

    Implementing load balancing, auto scaling groups and so on as code took about a month’s effort. “It was a great move for us,” he says.

    Other tools used by Roller include the Chocolatey package manager, and Microsoft’s PowerShell and its Desired State Configuration feature. After a machine image is tested, that’s exactly what moves into production, providing confidence that it will work as expected.

    Roller uses blue-green deployment with autoscaling groups to make it easy to roll back if necessary. Deployment or rollback takes less than 10 minutes. When individual problems arise, Roller’s practice is to kill the unhealthy server and bring up a new one.

    The company maintains separate deployment pipelines for each application and service, using Atlassian’s Bitbucket distributed version control system and its Pipelines feature to automate the deployment of checked-in code.

    Roller can deploy code within an hour if necessary, but currently works to a weekly release schedule. The goal is to move to multiple releases in a day.

    Resources

    Major Australian jobsite Seek served as an inspiration for Roller’s DevOps path. “We’ve always looked at the bigger players,” Brodie notes. In addition, Meetups (“there’s something for everyone”) and conferences (he specifically mentioned DDD Melbourne and NDC Sydney) have been invaluable in being able to talk with other companies about their experiences. “We’re keen to stay ahead of the latest practices,” he says, so the company encourages its people to attend such events.

    Other resources he finds useful include Stack Overflow and Plural. Plus, he recommends “The DevOps Handbook” by Gene Kim, Jez Humble, Patrick Debois and John Willis, which he describes as “a fantastic resource,” providing practical advice particularly around issues at the organizational level.

    Tips

    When asked for advice for those starting a new business or major project, Brodie recommends pragmatism:

    • Consider DevOps from the start “but don’t overcook it.” In other words, begin with the basics and evolve from there.
    • Aim for continuous improvement—people will keep generating new ideas, but picking the right time to implement them is important.
    • Look for a mentor, and talk to people about the tools they’re using.
    • Take advantage of outside organizations’ capabilities. For example, Rackspace can help architect an application for AWS.

    — Stephen Withers

  • Puppet Makes Development Kit Available to Advance DevOps

    Puppet Makes Development Kit Available to Advance DevOps

    Organizations that embrace DevOps often find themselves moving from having a paucity of IT automation tools to an embarrassment of riches in short order. As a result, many of the teams involved in those DevOps processes wind up making different IT automation choices. Before too long, the organization finds itself trying to bridge too many islands of automation.

    Puppet is working to bridge the automation gap between developers and IT operations teams with the release of a Puppet Development Kit that makes it easier for anyone to generate code that can be executed using the Puppet IT automation framework.

    Michael Olson, senior product marketing manager for Puppet, says all too often developers automate various tasks using their own favorite tool. When it comes time for IT operations teams that have standardized on Puppet to deploy that code, they have to rewrite various routines. Puppet Development Kit makes it possible for developers to now write code that can be shared seamlessly with IT operations teams that have adopted the Puppet IT automation framework.

    In some environments, DevOps has literally become too much of a good thing. Olson says the Puppet Development Kit represents an opportunity to truly unify fragmented processes in a way that developers can easily consume. The Puppet Development Kit includes unit test modules from Windows, OS X and Linux workstations to ensure that Puppet code is creating and managing configuration resources as intended.

    The existence of the Puppet Development Kit should also make it easier for organizations that have not embraced DevOps to get started. A recent survey conducted by Puppet finds that organizations that have embraced DevOps are delivering new applications and updates at rates that far exceed other organizations. The longer it takes for organizations to embrace DevOps the wider that gap grows. By making it easier to include developers in more structured approach to DevOps, many companies that are getting started late with DevOps now have an opportunity to close that gap.

    Developers don’t always have a lot of respect for IT operations. Many of them have been throwing code over the proverbial data center wall because deploying code in a production environment was always someone else’s problem. Tools such as the Puppet Development Kit essentially steal a page from the same playbook Tom Sawyer used in the book by Mark Twain to get the kids in the neighborhood to help him paint a picket fence.

    At the other end of the spectrum, however, are developers who are firmly convinced they can program the IT operations team out of existence now that “infrastructure is code.” In reality, most of those developers quickly discover that the ongoing care and feeding of hundreds of applications deployed in a production environment still requires a fair amount of human intervention. In fact, without some form of IT automation framework in place, deploying applications at that level of scale would not be possible. The challenge is striking the right balance between what can be automated and higher-level tasks that still require human expertise.

    — Mike Vizard

  • Creatures of Habit, Snowflakes and Integration Tax

    Creatures of Habit, Snowflakes and Integration Tax

    Donovan Brown of Microsoft, in conversation with Matt Hilbert of Redgate Software, discusses database DevOps’ biggest challenges

    When DevOps was first talked about in Flickr’s seminal “10 deploys per day” Velocity presentation in 2009, it was regarded by some as strange and alien to corporate culture. It was the antithesis to the accepted way of doing things, a threat to established and proven processes—it was downright dangerous.

    Times have changed. Unicorns such as Uber, Airbnb, Spotify and GitHub couldn’t live without it. Microsoft has embraced it and actively promotes it. It’s become the key to gaining competitive advantage in a technology marketplace that is moving faster and changing quicker than it ever has before.

    But what about the database? Why are practices such as version control, continuous integration and automated deployment being introduced to application development but left on the shelf when it comes to the database? The 2017 “State of Database DevOps survey,” for example, found that continuous integration was in place for 39 percent of applications, but fell to 20 percent for databases. What’s going on?

    In search of some answers, we spoke to Donovan Brown, Principal DevOps Manager at Microsoft and DevOps advocate. Also known as The Man in the Black Shirt, his unofficial tagline is #RubDevOpsOnIt. He lives DevOps. In fact, you can’t stop him talking about it and enthusing about its advantages.

    He describes DevOps as “the union of people, process, and products to enable continuous delivery of value to our end users.” The most important of those three, according to Donovan, is people. It’s also, conversely, the most difficult to fix.

    ‘People are Creatures of Habit.’

    “If you’ve been doing something the same way for 30 years,” he said, “why would you fix it? We all resist change, even if change is for the better, and DevOps requires a lot of change.”

    A large part of that needs to come from the Ops side of the equation because, while processes including version control and continuous integration have become second nature to developers, Ops teams traditionally don’t do them on a daily basis. In fact, Ops are often seen as the opponents of change.

    Donovan does, however, hold his hand up as being partly responsible for the division. “Historically,” he said, “they’ve had to become the gatekeeper because developers like me 20 years ago were wreaking havoc on production servers, running on there with admin credentials. Their job in my opinion has never been to deploy software for us. Their job is to protect and manage the infrastructure, to make sure it runs as efficiently as it can. That history, though, stays with us because there is so much regulation and red tape to get code from the fingers of developers to the hands of users.”

    He sees DevOps as the solution to the problem. “What I’m hoping is that DevOps will help automate what we’re forcing them to do, which was never their job, and rebuild the trust between Dev and Ops. We really need to help Ops people realize that we’re not trying to replace them, we’re trying to empower and enable them to allow us to continuously deliver value.”

    It’s not down to Ops teams on their own, however. C-level executives also have a part to play because they often favor a traditional approach to software development, with targets and long term strategies standing in the way of DevOps.

    “What I’ve noticed in a lot of companies that are struggling to adopt DevOps is that they’re not getting the backing from the executive level,” Donovan saids. “You have this waterfall mentality from the top that still wants GANT charts and milestones, and things that just do not line up with agile thinking at all. I’ve had the best success implementing DevOps in organizations where the C-level executive got it. When you have a grassroots team who get it, but no one else does, they usually get snuffed out by tradition.”

    The database is not separate from Donovan’s goal of people, process and products coming together. Prior to joining Microsoft, he was a Process Consultant and Scrum Master, helping a range of companies introduce DevOps to their development practices. He made sure the database was part of that.

    Then, as now, including the database was a challenge, but Donovan worked around it, using the technologies available to allow customers to treat the database just like every other element in their DevOps solution.

    He does, however, admit it was hard work. “It’s actually the most difficult part of the pipeline to automate because of the risk of failure,” he said. “You can easily roll back a front end; you can’t do the same for your database because any transactions that have occurred during the deployment could potentially be lost. So, it’s a crucial, integral part of your DevOps pipeline and I challenge any company that claims to be doing DevOps that only does it for the front-end but their back-end is still done manually. To me, they’re faking it.”

    ‘Infrastructure as code should not be a special snowflake. It’s just part of your solution.’

    The key is to remember that the code written to make changes to a database is just that: code. Traditionally, it has been managed outside of and separate to application code, with database changes often managed on-the-fly, at the last minute. Consequently, deployments have become worrying at best, with teams on hand for the expected firefight against downtime.

    Include it in version control, however—and continuous integration and automated deployments—and the database can be developed in parallel with applications. Problems are then picked up earlier, deployments become predictable and reliable, downtime and rollbacks are a thing of the past.

    What has made this even more appealing is the tooling now available—software that in Donovan’s days as a consultant was only just emerging. As he admitted: “The tooling had to mature to allow us to get over a lot of the hurdles that are unique to database deployments so that we can have everyone incorporated into the DevOps pipeline, not just the unicorns. Everyone should have the power available to them to be able to take their databases and incorporate them as part of their DevOps pipeline. Until you do, you still have that being the bottleneck.”

    There is a price to pay, however, if by introducing tools to bring DevOps to the database, companies get bogged down by what Donovan calls “the vendor explosion.”

    ‘Every vendor you add to your pipeline also adds integration tax.’

    Integration tax is the cost to companies, in terms of training and introducing unfamiliar ways of working, to use a new piece of software that resolves a piece of the DevOps puzzle. If that cost is too high by, for example, moving people out of the development environment they’re comfortable with, it betrays the ideals of DevOps. One onerous way of working is simply replaced by another.

    Donovan is keen to remove that tax by encouraging companies to work with as few vendors as possible—and preferably those vendors who have already paid the integration tax in advance. By, for example, introducing tools that work inside or alongside existing software, thereby reducing the time it takes to become familiar with them, and making the most of the current infrastructure rather than adding to it.

    Otherwise, Donovan concluded, “You’re paying tax for that integration. When we at Microsoft have partners who create extensions for our products, it’s the vendor and Microsoft who pay the tax in advance.”

    Finally, I asked Donovan what the biggest challenge was for companies who adopt DevOps for the database. His answer was the most telling.

    “If you’re doing DevOps differently for your database and the rest of your system, to me there’s something wrong there. When I think of DevOps, the database is part of that. I don’t need a separate conversation about it.”

    About the Author/Matt Hilbert

    Matt Hilbert is a technology writer at Redgate Software with 20 years’ experience working for lots of the world’s biggest tech companies – and many of the smallest. He has a particular fascination for emerging technologies and is on a continuing mission to decompile, untangle, and explain techspeak to a wider audience, and excite people about the endless possibilities technology offers.

     

  • Go Big or Go Home: Total DevOps Guarantees Results

    Go Big or Go Home: Total DevOps Guarantees Results

    As revealed by a recent survey, only enterprises that implement an “all-in” approach to DevOps achieve the results of best-in-class enterprises seen in the “2017 State of DevOps Report.” Total DevOps approaches DevOps transformations holistically, integrating the full breadth of your DevOps value chain as well as the many stakeholders across your organization that must be engaged to ensure broad, enduring success.

    Trace3’s Total DevOps transformation approach uses the following steps:

      1. Identify the DevOps Leadership & Core Team. Your Leadership and Core Team members should be open to change, early adopters and innovator-types.
      2. Together as a team, set your true north and determine your big picture business goals for your DevOps journey. End-to-end pipeline lead time, release throughput, release quality, security, satisfaction and productivity are some examples of DevOps goal areas.
      3. Map the end-to-end (E2E) value streams specific to your chosen DevOps goals. Focusing on the goals your organization has for DevOps will ensure your team and organization are aligned and focused on outcomes.
      4. Identify bottlenecks for each value stream that will most affect each goal. During this step, gaps between current state and desired state are made clear.
      5. Dig deeper into the processes and further explore bottlenecks and gaps. Concentrate on deeply understanding how the relevant bottlenecks and gaps affect lead time to define specific improvement opportunities.
      6. Define solution strategies and tactics that align with goals and address improvement opportunities identified during analysis of current state. Total DevOps takes a comprehensive perspective of people, process and technology to define strategies and tactics.
      7. Develop an overall DevOps road map, which includes considerations for people readiness, process improvement and technology-specific implementation plans. Each of these implementation plans should incorporate change management or adoption enablement techniques.
      8. Determine how the existing technical debt will be addressed. Give highest priority to the backlog of technical debt that will most support the goals.
      9. Design metrics including key performance indicators (KPI) and service level agreements (SLA). The use of KPIs and SLAs will enable the ability to tune, track and validate the success of the solution.
      10. Implement! Agile iterations may include detailed design, proof of concept trials, implementation for one viable application environment and team and then deployment to all target application environments and teams using a well thought-out sequence and strategy for onboarding.
      11. Employ continuous feedback. Monitoring the performance of all application environments utilizing the established KPIs and SLAs will provide unbiased measurement of the system performance.
      12. Employ continuous improvement. Feedback is critical for learning and improvement which will fuel each step in your ongoing DevOps journey.

    Summary

    What do you think? Do you agree the Total DevOps steps listed above are important to achieving big picture DevOps goals? Are there others you recommend? For more information about Trace3’s Total DevOps transformation approach, refer to our perspective paper, “Navigating Your Total DevOps Journey.”

    While DevOps implemented using the Total DevOps approach provides a strong foundation for long-term enterprise business improvements, it is important to understand DevOps is not an island. Enterprises implementing DevOps should be aware that DevOps interoperates with other IT systems and practices. Enterprises are well-advised to choose tool-agnostic IT partners that can provide solutions that best suit the needs of each unique enterprise and can integrate and evolve DevOps together with all their IT systems.

    — Marc Hornbeek

  • 5 Can’t-Miss DevOps Sessions at Jenkins World

    5 Can’t-Miss DevOps Sessions at Jenkins World

    In less than a month many Jenkins users and DevOps professionals will gather in San Francisco for Jenkins World, taking place Aug. 28-31. With more than 60 sessions to choose from, covering a wide range of topics, it can be difficult to narrow down your schedule. That’s why it’s important to go into the show with a goal in mind.

    For those of you specifically looking to hone your DevOps skills, here are five can’t-miss sessions that fall under the DevOps tracks.

    NOTE: DevOps.com readers get 20 percent off their registration with the promotional code JWDEVOPSCUST.

    DevOps: Delivering on the promise of innovation, agility and velocity

    Forrester Analyst Rob Stroud will discuss recent Forrester research that confirmed organizations are leveraging agile development techniques, automated CI/CD pipelines, testing and release automation to deliver differentiated products. The interactive discussion will allow attendees to review their DevOps maturity versus that of the market. Stroud also will lead discussions of how DevOps is adding value within enterprises and how the adoption of containers and serverless computing will further drive DevOps adoption.

    DevOps Leadership Panel

    Attend this panel to hear from a variety of experts on topics such as software delivery challenges, business value realized from DevOps, building internal support and more. Panelists will include:

    • Rob Stroud, Principal Analyst, Forrester – moderator
    • Kolby Allen, AWS Architect, WatchGuard Technologies
    • Andrey Falko, Principal Engineer, Salesforce
    • George Swan, Director of Engineering Solutions, Autodesk
    • Stas Zvinyatskovsky, Engineering Leader and Architect, Accenture

    Mapping Your DevOps Journey with the DevOps Quadrant Maturity Model

    In this session, Brian Dawson, DevOps evangelist at CloudBees, will map the DevOps journey to the DevOps Quadrant Maturity Model. He’ll go through the characteristics of organizations within each quadrant and present strategies for moving to the next stage of DevOps maturity. The DevOps Maturity Model is a great way to assess your current state of DevOps.

    Banking on DevOps: How Leading Financial Services Organizations Are Driving the DevOps Transformation

    Hear from financial services executives about how their organizations are embracing DevOps practices to speed innovation and deliver more value to customers. The financial services industry faces specific security, governance and regulatory hurdles that can prove challenging when changing processes and technology. This session will be moderated by Andre Pino, VP of marketing at CloudBees. Speakers will include:

    • Brock Beatty, Director, Software Engineering, Capital One
    • Karthrik Loganathan, Director, Business Technology, ESQM, Discover
    • Stefan Simenon, Head of IT Tooling & Software Development, ABN AMRO Bank N.V.
    • Moied Wahid, Director, Software Development, PayPal

    Leading a DevOps Transformation

    In this session, Jez Humble, CTO at DevOps Research & Assessment LLC (and also a Jenkins World keynote speaker), will discuss how implementing DevOps is more than just implementing tools. He’ll walk through how a DevOps transformation requires a different way of thinking about everything from budgeting to management to compliance. He’ll also break down exactly what DevOps is and isn’t.

    Don’t miss out on the hundreds of DevOps leaders and trailblazers to learn from at Jenkins World. You can view the full Jenkins World agenda to see what other sessions can help boost your DevOps skills!

    If you haven’t registered yet, make sure you to do so today with the promotional code JWDEVOPSCUST.

    — Alan Shimel

  • SecOps: The Next Stride for DevOps

    SecOps: The Next Stride for DevOps

    Global IT spending is now touching a figure of $4 trillion. In today’s technology-intensive environment, data is the biggest commodity, more valuable and powerful than ever. And like Peter Parker’s uncle Ben noted, “With great power comes great responsibility.”

    Security has always been a big concern for valuable things and IT is no exception. IT as a whole is trying to push security left in the development cycle—trying to involve it in every step of the development cycle. And just when development and operations teams are getting used to the “esprit de corps” we call DevOps, I think it’s time we add the third musketeer: security.

    What is SecOps?

    SecOps is a collaboration between security and operations teams, just like development and operations teams collaborate on DevOps front. SecOps is a set of practices organizations need to follow, processes they need to execute and tools they need to use to ensure the security of their application environment. SecOps is making sure organizations do not sacrifice security to attain set performance and uptime indexes.

    In a typical development cycle—requirements gathering, design, development, testing, implementation or deployment and maintenance—security normally is introduced in the later stages, somewhere between testing and deployment or even later. But SecOps is all about making sure to introduce aspects around security much earlier or at each stage of the software development life cycle (SDLC).

    I know what you are thinking: This is going to complicate things and increase the time to delivery. This is where operations and development teams need to join forces to uncomplicate the things and make it time efficient practice. Next thing you must be thinking of is, Why so much hassle? Think of it the other way. Wouldn’t it save more time when you address the security concerns at much earlier stages than at the time of delivery or implementation? All it takes is an amalgamation of the security group, development team and operations team; a little bit of planning; and a whole lot of execution.

    SecOps + Containers

    Containerization is slowly but steadily moving from an alternative to full virtualization to a serious platform for running your applications. Containers have some obvious advantages including scalability and flexibility, and this solves most of the problems related to resources in case of application development. Reduced size; reduced time to provision application environment and testing; platforms including Docker, Solaris Zones, BSD Jails; and orchestration platforms including Kubernetes, CoreOS Fleet, Amazon ECS and OpenShift make containers a more preferred option for application development environments.

    This increased traction toward containerization points to the increased need to concentrate on security aspects. Here are some best SecOps practices for container environment you and your organizational teams can follow:

    • Authentic sources and images: Always check for authenticity of container images. There are various tools such as Docker’s security scan. With Docker Cloud and Docker Hub you can scan images to check for potential security vulnerabilities. Most images are built from some base image and not built from scratch, so there is always a threat with the used images.
    • Vulnerability management tool: There are tools available in the market to analyze container image formats and libraries for threats before you actually start using them.
    • Follow benchmarks and hardening guidelines: Always make sure you do the checks and follow hardening guidelines for containers, images, hosts and platforms before you start with production. There are few standards and benchmark checks for containers such as CIS’s Docker security benchmark, PCI compliance checklist, etc.
    • Periodic auditing: Regular auditing of your application environment can help you save yourself from the future troubles. Moreover, automation of auditing process can help in detection of unused images and containers.
    • Use of management frameworks: Use frameworks that can automate behavior profiling and control all the users, authorize the access to the containers, images and hosts.
    • Security built in to container engine systems and third-party security solutions: Third-party vendors have a number of applications for container security in addition to security systems of container management platforms.

    Dev + Sec + Ops

    With the continuously increasing business demands for new applications and software, and new practices and development trends such as DevOps, Agile, cloud, automation, CI/CD and others, traditional security needs to upgraded in the new paradigm. Thankfully, some of these practices facilitate the security. Consider CI/CD as an example: Continuous integration requires continuous integration tools, or what we call build servers. Some popular examples are Jenkins, TeamCity, GitLab CI, Travis CI, Bamboo, Go CD, CircleCI and Codeship. The best SecOps practice is to check and fix vulnerabilities at early stages as a part of CI/CD workflow. Integration between authentication, scanning, management tools and CI/CD pipeline tools could be the best possible solution to your security-related problems. Some easy-to-implement solutions can include automated security testing, static code analysis, authentication checks and login tracking.

    SecOps enable organizations in lifecycle management, analysis of security threats, incident management, optimizing and measuring the effectiveness of security controls, reduced breach response time, reduced security risks and increased business security. The basic principle on which SecOps works is Avoid, Analyze, Respond, Review, Repeat. By analyzing the security events and data, you can build incident response plans to avoid future unwanted events.

    Frameworks and Tools

    Now that you have a clear understanding of why you need your security, development and operations teams to work together, let’s see what tools and frameworks you can use.

    • Docker-native tools: If you are using Docker as a platform then you can use few security tools provided by Docker itself for the security of production environment: Docker Bench and Docker Notary. Docker Bench is a script that checks common best practices around deploying Docker containers in production. Docker Notary enables you to check whether content is from a trusted publisher.
    • Chef: Chef provides different tools including Inspec to automate security testing.
    • Puppet: Puppet provides security compliance and policy defining frameworks.
    • Ansible: Ansible provides system tracking, setting up firewall rules, user lockdown and compliance automation solutions.
    • CoreOS Clair: CoreOS Clair is an open-source project for vulnerability analysis in applications and Docker containers.
    • SaltStack: SaltStack can help in orchestration and automation of security practices solutions for containers.

    This is just a look at some of the most popular ones. If you want, there are a number of others that can look after the security of your application environment.

    The main motive behind implying SecOps practices in any organization is involving security team at all possible stages to remove any ambiguity in any stage of development rather than security team providing analysis reports to the operations team and then sitting back and enjoying the show. When these teams perform in a synergistic manner, the business focus can be shifted to other important things.

    About the Author / Chaitanya Jawale

    Chaitanya Jawale is founder and CEO of Opcito Technologies, a leader in microservice-based product engineering and automation. Chaitanya comes with strong background in product engineering, data center automation, DevOps and multi-cloud orchestration and management.

  • 15 Things Your Competitors Know About DevOps

    15 Things Your Competitors Know About DevOps

    It’s no secret that DevOps is revolutionizing IT, helping organizations do more, faster. DevOps success is now essential for organizations in their quest to remain competitive. According to the “2015 State of DevOps Report” by Puppet, organizations utilizing DevOps deploy software 30 times more frequently and have lead times that are 200 times shorter. Plus, their failures are limited to 60 times while recovery is 168 times faster.

    Here are the 15 things your DevOps-enabled competitors know that you might not be aware of:

    Easier Code Evaluations

    Code evaluations have become easier than ever. Developers now can move on to tasks and get rid of frequent changes in the code. Successful enterprises quickly react to the changes within the system with ultimate results. This enables greater benefit for the end-user applications.

    Quality Software

    DevOps training is all about transforming the way businesses think about software.

    DevOps elements are meant to be employed in individual teams or projects. But, the real success of the organization lies in the support from the whole. Successful organizations change the way its IT operates, supports and leads the enterprise.

    Different Definition

    Successful DevOps adoption is different for different organizations. Whether it is continuous delivery, quality or speed, every enterprise defines DevOps differently. It depends on you how you define DevOps that meets your enterprise necessities in a clear and consistent tone. Focus more on the results than the methods.

    Continuous Delivery – Streamlining development and avoiding the hurdles to achieve efficient functionality.

    Release Speed – Effectively meeting the expectations of consumers.

    DevOps is Beyond IT

    DevOps has consistently evolved beyond the typical IT concept. It involves software, applications and tech-based services. It brings together the responsibilities of everyone in the company, and not just IT.

    This way the whole enterprise collaborates more closely on a defined DevOps platform. Complexities are effectively eliminated due to fewer barriers between IT Operations and Development teams.

    Transforming the IT Culture

    Transition to a DevOps operating model mainly depends on tools and principles. However, DevOps is all about changing the enterprise IT culture rather than just tools and processes.

    DevOps culture is all about removing the barriers and getting the whole team at one place, which further, improves the work efficiency. It is necessary that everyone—within and outside IT—must understand the importance and competitive advantages of a business to become more agile.

    Digital Transformation

    Digital Transformation is in high demand in recent years. Its foundation lies in applications that constantly create new channels that encourage customers and keep employees productive. DevOps is critical for the success of application strategy and forms an important element of digital transformation.

    Holistic Approach Toward Metrics

    Metrics are the parameters that guide any kind of organization. Your DevOps-enabled competitors are successful because they effectively measure the metrics and change them accordingly to improve growth in the industry.

    The right metrics make sure that DevOps transformation is working. Make a full-dimensional approach of metrics including:

    • Mean Time To Resolution (MTTR)
    • Mean Time Between Failure (MTBF)
    • Process and People Metrics
    • Active Users
    • Development-to-Deployment Lead Time

    Incorporating Automation

    Agility plays an important role in all processes of the DevOps operating model. To make the process more agile, it is essential to employ automation for repetitive tasks. This maintains the workflow of the whole process.

    Automation has expanded to all stages, including, development, testing, production and operation teams. The kinds of automation are:

    • Release Automation – Using tools such as Chef and Puppet.
    • Runbook Automation – Application performance management and monitoring solutions.
    • Automation achieves desired quality goals by maintaining compliance. It reduces costs and delivers a faster response.

    Feedback and Feedforward Cycles

    DevOps promotes agility through healthier integration within the organization. Feed forward and Feed backward in the development life cycle is critical in determining this agility.

    Different functions of the company interact smoothly only when tools lay their focus on software development process. This provides information on the content that is relevant to each audience. Context relevance enables easy creation of dashboards and present this information to the audience in a way which makes sense.

    Real-time Approach to APM

    DevOps is more about culture than just tools. Right tools and right actions highly improve odds of success and evade negative impact.

    Solutions you choose must provide visibility into future problems. Software development and implementation must be maintained in a volatile, fast-paced environment that requires production-ready APM solutions. Your competitors are highly efficient because they are aware of the trick: monitoring applications down to specific functions. Working together ensures quality and makes it easy to predict the success of applications.

    Application Analytics Improve Software Strategy

    Analytics plays an important role in improving software strategy. Utilizing analytics solutions prior to quality user expectations achieve competency.

    Software is not all about just software; it is about how it connects with customers to generate revenue. Ideal analytics are capable of connecting application performance with user management and business data. Be sure to define the vision and establish organizational priorities within the budget.

    Customer-centric and Innovation Cocused

    DevOps improves the communication between developers and IT Operations by building customer experience. DevOps provide value under pressure to the enterprises. Having DevOps within an organization is a definite necessity. It always upholds the competitive advantage and effectively delivers the software to the customers.

    Study Case Studies

    If you are the one aiming to make bigger by employing DevOps in your organization, read case studies and real-world examples. This effectively manages the DevOps transition for any size of the enterprise.

    Macro Environment

    Budget, roles and responsibilities and departments have a come a long way. Product releases have been reduced from annually to quarterly, monthly, weekly, daily and now to several times a day. Microbuilds, microreleases, microupdates, microtesting and microcheck-ins have now become an easy task.

    Welcome Ops Movement

    Don’t stop with the existing movements. Go and explore the Ops and its related tools: viz. DevOps, DevSecOps, BizOps, etc.

    Final Thoughts…

    It is clearly evident that investing in DevOps culture is pure benefit. DevOps is here to transform the way organizations develop, monitor and handle the applications and its underlying infrastructure. It has readily progressed from a niche concept to a business imperative. Every enterprise, small and large, aspires to integrate DevOps tools and principles. Employ the above points to successfully drive the DevOps conversation within your enterprise.

    About the Author / Sirisha Paladhi

    Sirisha Paladhi is a content writer at Mindmajix. During her career, she has written many articles on technology innovations. Connect with her on LinkedIn.

     

     

  • 9 Essential Ingredients for Modern Enterprise Applications

    9 Essential Ingredients for Modern Enterprise Applications

    Digital transformation. It’s the latest in a series of buzz phrases intended to describe how enterprises are embarking on top-to-bottom modernization of their IT environments. It’s easy to see why it’s a hot topic. Emerging technologies including cloud, containers, microservices and distributed applications hold the promise of greater flexibility, lower cost and faster release cycles. The benefits to companies that make this journey can be enormous.

    Unfortunately, making this journey can take years with today’s manual processes and antiquated tools. Not to mention that most IT budgets are at least 80 percent focused on keeping the lights on. Application modernization projects can be extremely complicated since legacy, monolithic enterprise applications are intrinsically dependent on underlying infrastructure and data stores. Cloning complex application environments, including critical production data, for upgrades or testing often can take days or weeks, slowing down cycles and contributing to lower quality releases. Even new applications are too often designed with infrastructure dependencies, trapping organizations onto specific cloud, server or container vendors. This vendor lock-in reduces choice and leaves IT organizations open to unexpected price hikes down the road.

    The truth is that the way we have designed, built, deployed and managed enterprise applications needs to change. Business-critical software is too often built in monolithic blocks that are nearly impossible to move to new infrastructure or storage options without lots of effort and time. The applications are hard to upgrade since updating even one small portion means rebuilding and retesting the entire thing. Managing the various versions of the discrete application modules and the resulting testing permutations can be quite challenging. It’s not unusual to hear from CIOs that they feel trapped in a world where they can only reasonably expect to update critical enterprise applications just twice a year at most.

    Business needs to move faster. There’s no reason why release cycles, even for enterprise applications, couldn’t be every few days instead of months. Application quality should actually be better in this world. Continuous delivery models such as DevOps should be an integral part of the process. And security should not be an afterthought; it should be built-in. To accomplish this, the future of enterprise applications must look very different from today.

    What are the essential ingredients for modern enterprise application platforms and tools in this new world? Here are a few suggestions.

    Complete Portability, Without Code Change

    Enterprise applications must be abstracted and separated from any dependency on underlying infrastructure, including sources of data. By abstracting the functions of an application into components that can run anywhere, it’s possible to then move the application to different infrastructure combinations, without changing a single line of code. It’s only through complete portability between cloud environments, container tools and servers that IT organizations will break vendor lock-in and gain the flexibility required to move their applications to vendors that offer the best combination of price, performance, reliability and features.

    On-Demand

    All enterprise applications should be on-demand, meaning the provisioning of new instances should be hands-free and fully automated. This implies tight integration with orchestration tools that most companies are already using to provision infrastructure. The key difference here is that the provisioning of storage options also needs to be fully automated. This is made possible by the fact that modern applications won’t have any dependencies on the specific data stores they rely on. This on-demand nature is not restricted to technical teams but includes business users that can easily perform user acceptance testing by simply provisioning full-fledged application environments.

    Self-Healing

    Modern enterprise applications should be self-healing, which means applications not only should have measurable data points to define their health but can then react based on these metrics. They must be able to scale up (or down) based on performance characteristics up to a certain cost threshold, restart on a healthy node in case of infrastructure bottlenecks and cache or deploy closer to the user based on latent use performance.

    Composable (DevOps-friendly)

    All enterprise applications should consist of a number of building blocks: APIs, web servers with content, databases seeded with data, security policies, the operating system, network configurations, deployment configurations and application binaries. By breaking apart monolithic enterprise applications into smaller components that can then act as independent services, IT organizations gain the flexibility to upgrade and automatically deploy individual components through standard DevOps processes and orchestration tools. The services can run anywhere desired, giving flexibility of choice in infrastructure or sources of data. And developers can use a point-and-click UI to pull pre-defined components together to build larger functions of an application.

    Model, Snapshot and Clone

    Once an application is separated into its essential components, a catalog can be maintained that makes it easy to create new versions of the application. Developers, test engineers and DevOps teams can then pick and choose whatever combinations of components they need to create or clone complex application environments for testing or deployment. The state of the application environments can be snapshotted, cloned and replicated. This cloning process should be efficient and quick. This dramatically speeds up development and testing processes, which to-date have been largely manual.

    Scalable

    Scaling application and infrastructure environments automatically, on-demand, and in near real-time is one of the essential capabilities that makes modern infrastructure so valuable. Any solution that is used to develop, test, deploy and manage enterprise applications should offer these same capabilities, giving the ultimate in cost flexibility, performance and scalability. As containers are moving quickly from the lab into production environments, look for a container-based solution that complements this strategy.

    Security is Included

    Application security should not be tacked on after deployment. This slows down continuous delivery processes like DevOps and creates friction between development/ops and the security team. Instead, security should be considered an essential component of the overall application environment and treated the same as any other component and baked into the application from the start.

    Push-Button Upgrades

    Upgrading enterprise applications should be made much easier by taking a point-and-click, push-button approach through a modern UI and integration with continuous deployment tools. Once an application is blueprinted into its various components, using a modern UI to choose versions and assemble the final application becomes entirely possible, saving time and reducing manual errors.

    Single-Pane-of-Glass Application Management

    By taking an end-to-end view of the enterprise application development, testing, deployment and management process, it’s now possible to create a “single pane of glass” console that gives development and deployment teams a powerful way to manage what’s been deployed to various infrastructures in the organization. With this approach, it’s also now possible to collect invaluable utilization and cost metrics which can help an IT organization continuously improve their portfolio.

    Enterprise applications of the future are going to look very different from today’s monolithic behemoths. By leveraging new technologies and processes, IT organizations will be able to dramatically speed up their modernization efforts and release cycles, improving competitive position. The inherent cost savings of this approach will be transformational as well, as IT budgets shift toward net-new innovation, not just keeping the lights on. The future looks bright indeed.

    About the Author / Rahul Ravulur

    Rahul Ravulur is the cofounder and CEO of appOrbit, which was founded in 2014. Most recently, he was the Director of Product Management at VMware managing the Availability suite of products. Before that, Rahul managed the vCenter Server and Client set of products with a special focus on scalability and extensibility to chart the evolution of vCenter to a broad virtualization management platform. Prior to VMware, Rahul held engineering leadership roles at BMC Software and Marimba.

  • Automation: Critical Missing Pieces in the CD Puzzle

    Automation: Critical Missing Pieces in the CD Puzzle

    As enterprises accelerate the frequency with which they develop and release new code into production to meet the ever-mounting demands of their consumers, there’s growing pressure on networking and security operations teams to keep pace with their DevOps counterparts. And it’s not hard to see why. According to Forrester, nearly four out of five business leaders believe it is IT’s responsibility to ensure the network can support the company’s digital transformation plans.

    And yet, 67 percent of businesses believe the network is the bottleneck—and with good reason. The current networks that NetOps and SecOps teams manage are highly complex, distributed entities that have historically been configured and provisioned manually—and often, in silos. Yet, as DevOps accelerates ahead at lightning pace, underpinned by the continuous integration, delivery and deployment (CI-CD) approach, NetOps and SecOps teams are scrambling for new ways to gain speed to more quickly launch, scale and secure applications and code updates in production.

    The Need for Speed 

    Enterprises are increasingly leveraging DevOps principles to execute daily deployments into their multicloud test and production environments. For example, Etsy deploys 80 times per day, while Netflix and Amazon deploy up to thousands of times a day. In this new world order, collaboration, communication and synchronization across development, operations, network and security teams is essential.

    This also means that testing of the network and application services infrastructure must happen concurrently with the application development and testing processes—not afterward, which can dramatically slow down the agile CI-CD process. Similarly, security cannot be retrofitted after the development and test phases are complete. A recent study by Puppet Labs found that high-performing teams spend 50 percent less time remediating security issues when security is addressed at every stage of the software development and delivery cycle.

    New CI-CD Tools Deliver on the Promise of DevOps  

    New innovations in virtualization and programmability of network and application service infrastructure are making it possible to test policies and configurations prior to production—even in highly complex environments. Powered by validated templates and APIs, these network orchestration and application services tools help automate task execution for scale, preserve provisioning and configuration policies for consistency and bolster security, while dramatically reducing management time cycles and the risk of human error. They empower NetOps and SecOps teams to leverage DevOps principles and apply them to network and security during the development, deployment and delivery of multi-cloud apps and code updates.

    Similarly to how software-defined components such as servers and storage are provisioned, network orchestration tools leverage a software-defined infrastructure (SDI) approach to rapidly provision network services across multiple network devices. These tools support flexible application provisioning across physical and virtual environments, help identify and address issues quickly and improve overall network performance. In the CI-CD model, network orchestration helps NetOps and SecOps teams ensure that all production-critical application and network elements—such as availability, core network services, security services and performance—are accounted for and are rolled out in proper sequence and at scale.

    Application services automation focuses on application availability, performance, and security. While automation used to focus solely on simple load balancing, it now also includes a range of solutions that help network teams configure and automate application services during the test phase. These include web app and network firewalling, DDOS protection, application acceleration, WAN optimization, DNS services and TCP optimization, among others. In the dev and test phases of the CI-CD process, automation allows for faster configuration and deployment of network settings and policies. Similarly, in the production phase, automation significantly speeds up and simplifies areas such as policy adjustment and other time-intensive processes by eliminating the need to reconfigure underlying infrastructure. This means that ticket resolution and necessary changes can be completed in a matter of minutes versus weeks. At the time of rollout, application services automation toolsets also help to ensure the infrastructure is ready to perform at peak levels.

    Network and application services automation innovations—the critical missing pieces in the continuous deployment puzzle—work together to ensure the entire DevOps team—including network and security—can deliver and deploy applications with the speed, reliability and security necessary to meet today’s business challenges.

    About the Co-Author / Ranga Rao

    Ranga Rao is Director of Product Management & Solutions Engineering at Cisco Systems, where he leads a team of product managers, architects/TMEs and software engineers to collaborate with partners to define use cases and build software integrations for leading Cisco solutions including Cisco ACI, Nexus 9000 and Tetration Analytics. Ranga earned an M.S. in Computer Science at Stanford after receiving his B.E. from the National Institute of Technology Karnataka. Ranga is also an author of a popular book, Programmability and Automation with Cisco Open NX-OS, published by Cisco.

    — Lori MacVittie