OFFICIAL (CLOSED) \ NON-SENSITIVE

C3339C – Cloud Security & DevOps

Introduction to DevOps
 OFFICIAL (CLOSED) \ NON-SENSITIVE

DevOps vs. Agile vs. Waterfall

Reference: https://analyze.co.za/wp-content/uploads/2018/06/DevOps-image-2-1.png
 OFFICIAL (CLOSED) \ NON-SENSITIVE

What is the Agile method?

• Agile comes about to overcome the traditional Waterfall model for
software development, which is not efficient in making changes
and deploying our codes in quick time.
• Hence the Agile approach came to the picture that formed the
collaboration between the software teams and the end users,
allowing them to oversee the progress of the project throughout
the development cycle. It was designed to break down the
project into small modules that allow developers to work in
parallel with regular end users’ feedbacks along the process,
guaranteeing a smooth workflow and efficient outcome.
OFFICIAL (CLOSED) \ NON-SENSITIVE
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Agile versus Waterfall

• Waterfall Development is not able to deploy new codes fast due
to pending Operation to allow test-to-deploy stage.
• Waterfall Operation could not automate the resources fast enough
and had difficulty to diagnose and feedback on deployment errors.
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Video – Agile vs. Waterfall (9 mins)

Ref: https://youtu.be/ygVXGSn2DIQ
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Agile vs. Waterfall - Three most impactful

differences

Agile Waterfall
1. No definite picture of the final Very clearly-defined picture of
product the final product

2. Produce an incremental Adhering to quality is more

result quickly is more important than producing a result
important than strictly adhering quickly
to quality
3. Change is expected so Change is formally controlled
features are added as-and- and affects baseline
when needed
 OFFICIAL (CLOSED) \ NON-SENSITIVE

“Failure” of the Waterfall Model

 OFFICIAL (CLOSED) \ NON-SENSITIVE

Common Complaints of a Software

Developer…
Before I can start testing, staging and deploying the software
application, I have to…
1. Provision a virtual machine (VM)
2. Install the application runtime
3. Deploy the application to the platform
4. Configure Secure Sockets Layer (SSL) termination (huh?)
5. Configure the load balancer (as if I know how to…)
6. Configure service connectivity (again as if I know…)
7. Configure the firewall (what? I need to know that too?)
8. …
 OFFICIAL (CLOSED) \ NON-SENSITIVE

What is DevOps?
 OFFICIAL (CLOSED) \ NON-SENSITIVE

History of DevOps

Where did DevOps come from?

• DevOps is the offspring of Agile software development –
born from the need to keep up with the increased
software development velocity and throughput that Agile
methods have achieved.
• The advancements in Agile culture and methods over the
last decade exposed the need for a more holistic
approach to the end-to-end software delivery lifecycle to
include considerations for IT operations too.
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Why DevOps?

• Agile has its common drawbacks too:

• Agile fast software development but slow infrastructure deployment
causes a bottleneck for application deployment
• Coordination to keep in pace both software development deliverables
and infrastructure updates is manual and tedious
 OFFICIAL (CLOSED) \ NON-SENSITIVE

What is DevOps?
 OFFICIAL (CLOSED) \ NON-SENSITIVE

What’s the current trend like for DevOps Engineer?

• Annual Salary: Singapore annual base

salary 2020 (michaelpage.com.sg)
 OFFICIAL (CLOSED) \ NON-SENSITIVE

DevOps Lifecycle Phases

Five phases that a software application goes through in DevOps environment:

Phases Tools
1. Continuous Development Git/GitHub/GitLab
2. Continuous Testing JUnit
3. Continuous Integration Jenkins/GitLab CI (as a central trigger for automating the integration of the
software application to its infrastructure environment)
4. Continuous Deployment Puppet with Docker (residing in the Cloud)
5. Continuous Monitoring Nagios or Splunk (to monitor the resources used)
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Periodic Table of DevOps Tools

16
 OFFICIAL (CLOSED) \ NON-SENSITIVE

A typical DevOps tools environment

Image source referenced from Edureka

 OFFICIAL (CLOSED) \ NON-SENSITIVE

How about DevSecOps?

Agile Planning Version Control Continuous App & Infra Governance Telemetry
Integration Deployment

Dashboards Branch Policies Continuous Testing Infra as Code Resiliency Diagnostics

Kanban Boards Collaboration Provisioning Compliance Analysis

Code Analysis

Desired State Feedback

Bug Tracking Branch Artifact Repo
Strategies

Repo Compliance

Continuous Security

Credential Vault

SDL Privileged Access Security

 OFFICIAL (CLOSED) \ NON-SENSITIVE

IT Security Perspective and Involvement

 OFFICIAL (CLOSED) \ NON-SENSITIVE

DevOps: Continuous Integration/Continuous

Deployment (CI/CD)
 OFFICIAL (CLOSED) \ NON-SENSITIVE

“Delivery” Vs. “Deployment”

Let’s go into the details of “Continuous Delivery” versus

“Continuous Deployment”…

…we will then understand their different focus…

 OFFICIAL (CLOSED) \ NON-SENSITIVE

DevOps: Continuous Delivery (CD)

3. 4.

2.

5.

1.
6.

8.
Definitive Media Library 7.

The electronic CI, which is in the

DML, is the latest version of the
released application.
 OFFICIAL (CLOSED) \ NON-SENSITIVE

DevOps: Continuous Delivery (CD)

• A practice where code changes are automatically prepared for a release

to production
• Verify application changes across multiple dimensions before deployment
➢ Automated testing that goes beyond just unit tests
• Include functional testing, load testing, API reliability testing, security testing, etc.

• Every code change is built, tested, and then pushed to a staging

environment (i.e. non-production testing environment)
➢ Can have multiple, parallel test stages before a production deployment
• Deploy builds (manually) to production as early as possible
➢ Release in small batches are easy to troubleshoot in case of a problem
➢ Use Feature flags to explicitly turn on the features ready for release to users
• Release application often to promptly get users’ feedback for subsequent
improvements
 OFFICIAL (CLOSED) \ NON-SENSITIVE

DevOps: Continuous Deployment (CD)

Unit Tests,
Integration
Tests

Functional
Tests, API
Tests

Load Tests
 OFFICIAL (CLOSED) \ NON-SENSITIVE

DevOps: Continuous Deployment (CD)

• Similar to Continuous Delivery except it further automates the

Approval step to deploy the changes to production environment
➢ Every change that passes all stages of the deployment pipeline is
automatically released to the users
➢ No human intervention in deployment
• Only a failed test will prevent a new change to be deployed to production environment

• The quality of the test suite is critical

• Speed up the release and deployment process
• Accelerate the feedback loop with the users on the changes made
to the application codes (i.e. software product/IT service)
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Benefits of DevOps (1/2)

1. Collaboration and trust

➢ Lack of visibility and shared goals means lack of dependency planning,
misaligned priorities, finger pointing, and “not our problem” mentality,
resulting in slower velocity and substandard quality.
• DevOps is that change in mindset of looking at the development process
holistically by the team.

2. Release faster and work smarter

➢ A lack of automated test and review cycles slow the release to production,
while poor incident response time kills velocity and team confidence.
Disparate tools and processes increase operating costs, lead to context
switching, and can slow down momentum.
• DevOps toolchain automates the whole workflow for faster and more
consistent releases.
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Benefits of DevOps (2/2)

3. Accelerate time-to-resolution
➢ If critical issues aren't resolved quickly, customer satisfaction tanks. Key
issues slip through the cracks in the absence of open communication,
resulting in increased tension and frustration among teams.
• Open communication in DevOps helps development and operations teams
swarm on issues, fix incidents, and unblock the release pipeline faster.

4. Better manage unplanned work

➢ Unplanned work is recovery work from unexpected failures that have major
impacts – a reality that still impacts team productivity. Transitioning and
prioritising unplanned work across different teams and systems is
inefficient and distracts from work at hand.
• Through raised visibility and proactive retrospection in DevOps, teams can
better anticipate and share unplanned work.
• Increased use of automation and cross-functional collaboration reduces
complexity and errors when incidents and outages occur.
 OFFICIAL (CLOSED) \ NON-SENSITIVE

In Summary

The ultimate aim of DevOps is to achieve the following:

1. Little waiting time for code deployment
2. Concurrent work in coding as the new codes are deployed
3. Infrastructure and Application Security are actively considered in early stages
across the whole DevOps cycle
4. Better collaboration between the application development and infrastructure
operation teams
5. Infrastructure systems are always up and running
6. Easy infrastructure administration (through writing codes or using scripts) for
infrastructure automation
Overall, the entire environment is effectively monitored, and has
essential reporting for critical errors (or fatal errors) that are quickly
corrected.
 OFFICIAL (CLOSED) \ NON-SENSITIVE

Quiz
Click the Quiz button to edit this object
 OFFICIAL (CLOSED) \ NON-SENSITIVE

The End
Thank You