Automated Governance - Continous Lifecycle 2019 - Schlomo Schapiro

Automated Governance
DB Systel GmbH | Schlomo Schapiro | Chief Technology Office | 12-13.11.2019
Platzhalter für Titelbild – Hier können Sie Bilder aus der Mediathek einfügen!
Placeholder for title picture – You can insert here pictures from the Mediathek!
Pixabay / 4423750
@schlomoschapiroThis work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License
(with the exception of the stock images with copyright notice)

DB Systel | Schlomo Schapiro | @schlomoschapiro | 13-14.11.20192
https://pixabay.com/i-3303396

Problem?
What is governance?
Ø Align IT strategy with business strategy
Ø Make sure we have and keep rules

4
git
?CI CD
Engineering
Teams

5
git
?CI CD
Engineering
Teams
Architecture &
Governance
Security &
Compliance

20/day
20 / day /
team ???
We can´t check
everything!
We
can‘t
work!
Challanges:
• Time to Market
vs. Stability?
• Change Frequency vs.
Risk & Security?
• Governance
& Compliance?
• You build it – you run it?
• DevOps???

7
git
?CI CD
Engineering
Teams
Non
Functional
Requirements

8
git
?CI CD
Engineering
Teams
Non
Functional
Requirements

9
git
?
git git
CI CD
Engineering
Teams
Governance Security

10
git
?
git git
CI CD
Engineering
Teams
Governance Security
Compliant!

11
git
?
git git
CI CD
Engineering
Teams
Governance Security
Compliant!
Dev- Sec-
Arc- Ops

What is automated?
Ø „operated automatically“
Ø Synonyms: automatic, laborsaving, robotic, self-
acting, self-operating, self-regulating
Ø Not people doing it manually
Source: https://www.merriam-webster.com/dictionary/automated

Compliance Automation is Very Hard!
Automation
friendly?
How to
check?

14
git
?CI CD
Engineering
Teams

15
git
?CI CD
WHAT HOW
Declarative
Descriptions
Deployment
Automation
Test for Compliance Test for Correctness
Product
Teams
Platform
Teams

Test for Compliance
Declarative Descriptions Example
stage_deploy:
script:
- ssh user@host "mkdir htdocs/_tmp"
- scp -r build/* user@host:htdocs/_tmp
- ssh user@host "mv htdocs/live htdocs/_old && mv htdocs/_tmp htdocs/live"
- ssh user@host "rm -rf htdocs/_old"
gitlab-ci.yaml
stage_deploy:
image: deploy_with_ssh
script: config.properties
gitlab-ci.yaml
#!/bin/bash
source "$1"
ssh $TARGET "mkdir $DIR/_tmp"
scp -r $SRC/* "$TARGET:$DIR/_tmp"
ssh $TARGET "mv $DIR/$NAME $DIR/_old && mv $DIR/_tmp $DIR/$NAME"
ssh $TARGET "rm -rf $DIR/_old"
Docker Image deploy_with_ssh ENTRYPOINT
TARGET=user@host
SRC=build
DIR=htdocs
NAME=live
config.properties
Test for Correctness
Source: https://docs.gitlab.com/ee/ci/examples/deployment/composer-npm-deploy.html

Test for Compliance
Declarative Descriptions Example
stage_deploy:
script:
- ssh user@host "mkdir htdocs/_tmp"
- scp -r build/* user@host:htdocs/_tmp
- ssh user@host "mv htdocs/live htdocs/_old && mv htdocs/_tmp htdocs/live"
- ssh user@host "rm -rf htdocs/_old"
gitlab-ci.yaml
stage_deploy:
image: deploy_with_ssh
script: config.properties
gitlab-ci.yaml
#!/bin/bash
source "$1"
ssh $TARGET "mkdir $DIR/_tmp"
scp -r $SRC/* "$TARGET:$DIR/_tmp"
ssh $TARGET "mv $DIR/$NAME $DIR/_old && mv $DIR/_tmp $DIR/$NAME"
ssh $TARGET "rm -rf $DIR/_old"
Docker Image deploy_with_ssh ENTRYPOINT
TARGET=user@host
SRC=build
DIR=htdocs
NAME=live
config.properties
Test for Correctness
Source: https://docs.gitlab.com/ee/ci/examples/deployment/composer-npm-deploy.html
C
ode
(H
ow
)
Config
(W
hat)

Declarative Descriptions → Automated Governance
Config Tools
Cloud Formation aws cf create
Kubernetes Manifest kubectl apply
Swagger YAML
Terraform YAML
…
AndroidManifest.xml
…
Test Strategy
Static Code Analysis
Linting
Integration Tests
Unit Tests

Declarative Descriptions → Automated Governance
Config
Cloud Formation
Kubernetes Manifest
Swagger YAML
Terraform YAML
…
AndroidManifest.xml
Compliance Check
cfn-nag: Linting tool for CloudFormation templates
K8S Admission Controller / OPA Gatekeeper
zally: A minimalistic, simple-to-use API linter
terraform-compliance.com
. . .
Tools
aws cf create
kubectl apply
…
?CI CD
Compliant!
Automated Compliance Checks
as Quality Gate for Deployments

Everything as
code
Managed
Pipeline
git commit
Feedback-/
Improvement-Loop
GitLabCI
Certified Changes –
Compliant by default!
Certified Space
AWS Azure K8S
DB
custom cloud services
(DNS, Proxy …)
Non Functional
Requirements
Automation
„on the border“ to
the certified space

DevOps' Seven Deadly Diseases - John Willis
https://youtu.be/jdN3E9OwFoE
https://itrevolution.com/book/devops-automated-governance-reference-architecture/

Summary: Compliant by Default!
1. Think in Code:
Build Tools
2. Craft precise policies:
Easy to automate checks
3. Production is
Your Certified Space
4. Every Change in Pro-
duction Starts in git
5. Declarative Descriptions

Q&A
DevOps
bit.ly/5pdops
Contact
@schlomoschapiro
schlomo.schapiro@
deutschebahn.com
Slides
go.schapiro.org/slides
DB Systel Vorträge
DevOps ist normal
Mittwoch, 14:00
Hörsaal Arnold Schönberg
DevOps im Konzern:
Autonomie von
DevOps Teams vs.
Betriebssicherheit
Donnerstag, 14:00
Hörsaal Arnold Schönberg

Vielen Dank für Ihre Aufmerksamkeit

Automated Governance - Continous Lifecycle 2019 - Schlomo Schapiro

Automated Governance - Continous Lifecycle 2019 - Schlomo Schapiro

Recommended

More Related Content

What's hot

What's hot(20)

Similar to Automated Governance - Continous Lifecycle 2019 - Schlomo Schapiro

Similar to Automated Governance - Continous Lifecycle 2019 - Schlomo Schapiro(20)

More from Schlomo Schapiro

More from Schlomo Schapiro(17)

Recently uploaded

Recently uploaded(20)

Automated Governance - Continous Lifecycle 2019 - Schlomo Schapiro