Posted on

How To Integrate Security Into the DevOps Toolchain

Traditional Security Conundrum in DevOps

DevOps tactics and tools are significantly transforming the way businesses innovate. However, amidst this transformation, IT decision-makers are cognizing that traditional ‘siloed’ security approaches are hampering organizations from realizing the full potential of DevOps. In fact, the conventional security methods and controls are perceived as inhibitors to speed, agility, and scalability offered by DevOps.

Baking Security into DevOps

In response, forward-thinking and fortune 500 companies have started integrating security practices and controls into each phase of the DevOps software development lifecycle, a methodology popularly known as DevSecOps. It integrates security practices and procedures into DevOps tools and underlying policies, making security an integral part of software development. As DevSecOps gathers steam, IT firms are more likely to blend vulnerability assessment, risk modeling, and security automation into DevOps processes and toolchains. As a result, it improves security and compliance maturity levels of the DevOps pipeline and toolchain, while enhancing product quality and delivery. How? DevSecOps enables seamless flow of application changes through DevOps pipelines, bestowing on the developers the authority and autonomy, without axing security or increasing risk.

Posted on

GPU for DL: Benefits and Drawbacks of On-Premises vs. Cloud

As technology advances and more organizations are implementing machine learning operations (MLOps), people are looking for ways to speed up processes. This is especially true for organizations working with deep learning (DL) processes which can be incredibly long to run. You can speed up this process by using graphical processing units (GPUs) on-premises or in the cloud.

GPUs are microprocessors that are specially designed to perform specific tasks. These units enable parallel processing of tasks and can be optimized to increase performance in artificial intelligence and deep learning processes.

Posted on

Parameterize Jenkinsfile in MultiBranch Jobs

There is no need to spend time on telling how super useful the MultiBranch Job is in Jenkins. However, there is one drawback; You can define and use only one Jenkinsfile in a given repository which will be the default Jenkinsfile for all scanned branches.

As this may sound complicated, from time to time you may need to use different use Jenkinsfiles in the given repository for different purposes. In this case, your only option is to define different Pipeline Jobs with different Jenkinsfile and branch settings. 

Posted on

Increase Your DevOps Productivity Using Infrastructure as Low Code

As an individual developer or as a part of a wider software development or IT team, you will find that time is rarely on your side, with many competing priorities throughout the working week. This naturally focuses you to look for ways to increase your productivity through the use of technology and tools to help you achieve more in less time. Throughout this blog post, we’re going to look at DevOps productivity and compare traditional tools with infrastructure as low code tools. 

Automate Software Development Tasks With DevOps Tooling

Everyone has heard of DevOps, yet many people struggle to understand exactly what DevOps is. Fundamentally DevOps is a perfect mixture of the philosophy of DevOps along with daily practices and supporting technology tools to enable you to deliver value through technology rapidly to your customers. 

Posted on

Setup Cypress Tests in Azure DevOps Pipeline

This tutorial helps to integrate and run your Cypress tests with the Azure DevOps pipeline in an Easy Way

Pre-Requisite:

  1. You need to have already cypress framework up and running on your local machine
  2. Cypress Project should be checked into the repository
  3. Your framework should generate a JUnit XML file at the end of the execution of the test. If you are not sure how to do that refer to Generating JUnit XML article.

Step by Step Guide To Run / Set-Up Cypress Tests in Azure DevOps or TFS Pipeline CI/CD

This tutorial explains the easy way to configure and run Cypress Test Automation Framework into Azure DevOps. 

Posted on

Microservices on AWS: Part 2 [Video]

Introduction 

In this AWSome Pipeline tutorial, I will deploy a Spring Boot microservice to AWS Cloud using the different CI/CD tools provided by AWS. We will be creating different IAM roles needed and then set up the AWS pipeline to continuously deliver software changes to our EC2 instances. I will walk you through different steps involved from uploading your code to GitHub, then check out that using AWS code stage, building using AWS Code Build, and then deploying the generated artifact to your targeted auto-scaling group using AWS Code Deploy. We will be creating a new version of the application and then demo that how the AWS pipeline can deploy those changes to our environment seamlessly. 

Source code can be downloaded from the GitHub repository.

Posted on

Schedule Pipelines in Azure DevOps Using Cron Expressions

Azure DevOps UI provides an option to trigger multiple days or once a week. We know that many times we need to execute Azure DevOps pipeline triggers once a month, or twice a month, and this can be done using Cron Expressions in Azure DevOps.

Azure DevOps uses NCronTab to evaluate cron expressions, so advanced expressions are not fully supported by Azure DevOps. However, most of the expression is supported so it does the job.

Posted on

How to Run Parallel Cypress Tests on BitBucket Pipeline

Do you use BitBucket Pipeline as your CI server? Are you struggling with slow E2E tests in Cypress? Did you know BitBucket Pipeline can run parallel steps? You can use it to distribute your browser tests across several parallel steps to execute end-to-end Cypress tests in a short amount of time.

How to Run Tests in Parallel

Distributing tests across parallel steps to spread the workload and run tests faster might be more challenging than you think. The question is how to divide Cypress test files across the parallel jobs in order to ensure the work is distributed evenly? But… is distributing work evenly what you actually want?

Posted on

Mule 4 Continuous Integration Using Azure DevOps

Once we started developing applications in MuleSoft and storing our code in source control platforms like GitHub, Bitbucket, GitLab, or Azure, just to mention the most common ones, we needed to look into automating the process to deploy our applications either to CloudHub or an on-premise server.

In this post, I will try to explain how a MuleSoft application can be automatically deployed into CloudHub or an on-premise server from Azure DevOps as our main CI platform and source control platform.

Posted on

Every Branch Gets a Stack: A How-To Guide

Turbocharge your team’s development workflow with this strategy that provides quick feedback in a collaborative, no-risk environment.

Last year SingleStone set out to build its first SaaS solution. We decided to do things differently and lean into a branching strategy. We’ve built plenty of custom software in our 23-year history, but always for clients. In those projects, there are always pre-existing factors that guide design decisions: specific languages, tooling, and processes. Sometimes, there are existing CI workflows in place that dictate how our contributions are incorporated.

Posted on

Implement CI/CD for Multibranch Pipeline in Jenkins

Making multiple branches with Jenkins.

Introduction

Jenkins is a continuous integration server that can fetch the latest code from the version control system (VCS), build it, test it, and notify developers. Jenkins can do many things apart from just being a Continuous Integration (CI) server. Originally known as Hudson, Jenkins is an open-source project written by Kohsuke Kawaguchi. As Jenkins is a Java-based project, before installing and running Jenkins on your machine, first, you need to install Java 8.

The Multibranch Pipeline allows you to automatically create a pipeline for each branch on your Source Code Management (SCM) repository with the help of Jenkinsfile.

Posted on

Why I Am Thankful for DevOps

Here are some reasons to be grateful for DevOps.

In the United States, the end of the month of November is when time is taken to perform a retrospective-like event called Thanksgiving. What started out as a dedication to give thanks for the blessing of harvest and the preceding year has transformed into a time to simply be thankful for one's blessings.

Since Thanksgiving is recognized on the fourth Thursday in the month of November, I thought I would introduce a five-part technical twist with the following Thanksgiving-focused articles:

Posted on

How to Do Deep Learning for Java

Deep in thought studying deep learning for Java.

Introduction

Some time ago, I came across this life-cycle management tool (or cloud service) called Valohai, and I was quite impressed by its user-interface and simplicity of design and layout. I had a good chat about the service at that time with one of the members of Valohai and was given a demo. Previous to that, I had written a simple pipeline using GNU Parallel, JavaScript, Python, and Bash — and another one purely using GNU Parallel and Bash.

I also thought about replacing the moving parts with ready-to-use task/workflow management tools like Jenkins X, Jenkins Pipeline, Concourse or Airflow, but due to various reasons, I did not proceed with the idea.

Posted on

Where Can We Actually Use DevSecOps?

DevOps is widely adopted as it has shortened the software and application development life cycle by combining IT operations and software development. With DevOps incorporated in many organizations, they are releasing software, features, and updates faster than ever and with greater changes. This means that there are serious challenges in applying and scaling security testing in these processes without drastically slowing down the time taken for such releases.

Hence, security in DevOps has not been embraced as effectively as DevOps itself. Introducing security checks early on in the development process is crucial for effective security. Although many businesses agree that introducing security early in the development life cycle is important, few actually do so. In spite of the risk of missing security threats early on and the headache of rework by adding security to the app development process too late, many businesses continue to incorporate security far too late in the development cycle.

Posted on

Continuous Security for GitOps

Earlier this month, Weaveworks hosted a webinar on securing your GitOps pipelines. Speakers included Andrew Martin (@sublimino) of ControlPlane as well as Weaveworks’ customer success engineer, Brice Fernandes (@fractallamda).

Brice gave us an overview of what GitOps is, and why it is a logical and more secure way for large development teams to update applications in Kubernetes.

Posted on

Full Lifecycle Container Security

According to our 2019 DevSecOps Community survey of over 5,500 IT professionals, just 24 percent of companies with mature DevOps practices have integrated and automate security into their DevOps pipeline — that drops to 3 percent for those without a DevOps practice. While the change to integrating security into the development process is a big culture shift, the benefits in security compliance and eventual cost savings, far outweigh the initial friction.

But, alas, that is a case for different posts and presentations.

Posted on

Meet Bitbucket Pipes: 30+ Ways to Automate Your CI/CD Pipeline

The democratizing nature of DevOps has seen the responsibility of building and managing CI/CD pipelines transition from specialized release engineers to developers. But automating a robust, dependable CI/CD pipeline is tedious work. Developers need to connect to multiple tools to deliver software, and writing pipeline integrations for these services is a manual, error-prone process. There's research involved to ensure dependencies are accounted for, as well as debugging and maintaining integrations when updates are made. It's no wonder many teams put automating CI/CD firmly in the "too hard" basket.

Bitbucket Pipelines is a CI/CD tool in the cloud that's part of your repository and makes it easy for developers to configure pipelines with code. We are launching Bitbucket Pipes to make it easier to build powerful, automated CI/CD workflows in a plug-and-play fashion without the hassle of managing integrations. We've worked with industry leaders including Microsoft, AWS, Slack, Google Cloud, and more to build supported pipes that help automate your CI/CD pipeline, and made it simple to create your own to help abstract any duplicated configuration across your repositories.